summaryrefslogtreecommitdiffstats
path: root/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix error handling in X509_REQ_print_exBernd Edlinger2018-01-061-8/+16
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5025)
* Rewrite RT3513.Rich Salz2018-01-041-6/+9
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5011)
* crypto/rand: restore the generic DRBG implementationDr. Matthias St. Pierre2018-01-045-40/+101
| | | | | | | | | | | | | | | | | | The DRGB concept described in NIST SP 800-90A provides for having different algorithms to generate random output. In fact, the FIPS object module used to implement three of them, CTR DRBG, HASH DRBG and HMAC DRBG. When the FIPS code was ported to master in #4019, two of the three algorithms were dropped, and together with those the entire code that made RAND_DRBG generic was removed, since only one concrete implementation was left. This commit restores the original generic implementation of the DRBG, making it possible again to add additional implementations using different algorithms (like RAND_DRBG_CHACHA20) in the future. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4998)
* crypto/rand: rename drbg_rand.c to drbg_ctr.cDr. Matthias St. Pierre2018-01-042-1/+1
| | | | | | | | | | | | | | | | | | | | | The generic part of the FIPS DRBG was implemented in fips_drbg_lib.c and the algorithm specific parts in fips_drbg_<alg>.c for <alg> in {ctr, hash, hmac}. Additionally, there was the module fips_drbg_rand.c which contained 'gluing' code between the RAND_METHOD api and the FIPS DRBG. When the FIPS code was ported to master in #4019, for some reason the ctr-drbg implementation from fips_drbg_ctr.c ended up in drbg_rand.c instead of drbg_ctr.c. This commit renames the module drbg_rand.c back to drbg_ctr.c, thereby restoring a simple relationship between the original fips modules and the drbg modules in master: fips_drbg_lib.c => drbg_lib.c /* generic part of implementation */ fips_drbg_<alg>.c => drbg_<alg>.c /* algorithm specific implementations */ Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4998)
* Fix minor 'the the' typosDaniel Bevenius2018-01-022-3/+3
| | | | | | | | | | Similar to commit 17b602802114d53017ff7894319498934a580b17( "Remove extra `the` in SSL_SESSION_set1_id.pod"), this commit removes typos where additional 'the' have been added. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4999)
* ec/curve25519.c: "double" ecdhx25519 performance on 64-bit platforms.Andy Polyakov2017-12-281-6/+482
| | | | | | | | | | | | | | | | "Double" is in quotes because improvement coefficient varies significantly depending on platform and compiler. You're likely to measure ~2x improvement on popular desktop and server processors, but not so much on mobile ones, even minor regression on ARM Cortex series. Latter is because they have rather "weak" umulh instruction. On low-end x86_64 problem is that contemporary gcc and clang tend to opt for double-precision shift for >>51, which can be devastatingly slow on some processors. Just in case for reference, trick is to use 2^51 radix [currently only for DH]. Reviewed-by: Rich Salz <rsalz@openssl.org>
* ec/ecp_nistp*.c: sanitize for undefined/implmentation-specific behaviour.Andy Polyakov2017-12-273-20/+19
| | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4974)
* poly1305/asm/poly1305-x86_64.pl: add Knights Landing AVX512 result.Andy Polyakov2017-12-231-19/+21
| | | | | | | | Hardware used for benchmarking courtesy of Atos, experiments run by Romain Dolbeau <romain.dolbeau@atos.net>. Kudos! Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4855)
* Add sha/asm/keccak1600-avx512vl.pl.Andy Polyakov2017-12-221-0/+390
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4948)
* Fix a typo in commentBernd Edlinger2017-12-181-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4949)
* Make DRBG uninstantiate() and instantiate() methods inverse to each otherDr. Matthias St. Pierre2017-12-172-14/+19
| | | | | | | | | | | | Previously, the RAND_DRBG_uninstantiate() call was not exactly inverse to RAND_DRBG_instantiate(), because some important member values of the drbg->ctr member where cleared. Now these values are restored internally. Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4402)
* Allocate the three shared DRBGs on the secure heapDr. Matthias St. Pierre2017-12-171-28/+46
| | | | | | | | Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4402)
* Implement automatic reseeding of DRBG after a specified time intervalDr. Matthias St. Pierre2017-12-172-15/+58
| | | | | | | | | | | Every DRBG now supports automatic reseeding not only after a given number of generate requests, but also after a specified time interval. Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4402)
* Add master DRBG for reseedingDr. Matthias St. Pierre2017-12-174-58/+195
| | | | | | | | | | | | | | | | | | | | A third shared DRBG is added, the so called master DRBG. Its sole purpose is to reseed the two other shared DRBGs, the public and the private DRBG. The randomness for the master DRBG is either pulled from the os entropy sources, or added by the application using the RAND_add() call. The master DRBG reseeds itself automatically after a given number of generate requests, but can also be reseeded using RAND_seed() or RAND_add(). A reseeding of the master DRBG is automatically propagated to the public and private DRBG. This construction fixes the problem, that up to now the randomness provided by RAND_add() was added only to the public and not to the private DRBG. Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4402)
* Add comments to NULL func ptrs in bio_method_stDaniel Bevenius2017-12-1710-20/+20
| | | | | | | | | | | | This commit adds comments to bio_method_st definitions where the function pointers are defined as NULL. Most of the structs have comments but some where missing and not all consitent. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4881)
* Fix invalid function type casts.Bernd Edlinger2017-12-1513-35/+31
| | | | | | | Rename bio_info_cb to BIO_info_cb. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4493)
* Fix 'make update'Todd Short2017-12-151-2/+2
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4931)
* Send supported_versions in an HRRMatt Caswell2017-12-141-0/+1
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Merge HRR into ServerHelloMatt Caswell2017-12-141-0/+1
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Drop CCS messages received in the TLSv1.3 handshakeMatt Caswell2017-12-141-1/+3
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Implement session id TLSv1.3 middlebox compatibility modeMatt Caswell2017-12-141-0/+1
| | | | | | | Clients will send a "fake" session id and servers must echo it back. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Update ServerHello to new draft-22 formatMatt Caswell2017-12-141-0/+3
| | | | | | | | | | The new ServerHello format is essentially now the same as the old TLSv1.2 one, but it must additionally include supported_versions. The version field is fixed at TLSv1.2, and the version negotiation happens solely via supported_versions. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Minor cleanup of the rsa mp limits codeBernd Edlinger2017-12-132-3/+5
| | | | | | | | | Reduce RSA_MAX_PRIME_NUM to 5. Remove no longer used RSA_MIN_PRIME_SIZE. Make rsa_multip_cap honor RSA_MAX_PRIME_NUM. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4905)
* Fix more OCSP_resp_get0_signer() nitsBen Kaduk2017-12-121-1/+1
| | | | | | | Fix a typo for "retrieve" and some indentation. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4919)
* crypto/bio/bss_dgram.c: annotate fallthrough (-Wimplicit-fallthrough)Patrick Steuer2017-12-121-0/+1
| | | | | | | | Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4916)
* Fix leak in ERR_get_state() when OPENSSL_init_crypto() isn't called yetRichard Levitte2017-12-121-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If OPENSSL_init_crypto() hasn't been called yet when ERR_get_state() is called, it need to be called early, so the base initialization is done. On some platforms (those who support DSO functionality and don't define OPENSSL_USE_NODELETE), that includes a call of ERR_set_mark(), which calls this function again. Furthermore, we know that ossl_init_thread_start(), which is called later in ERR_get_state(), calls OPENSSL_init_crypto(0, NULL), except that's too late. Here's what happens without an early call of OPENSSL_init_crypto(): => ERR_get_state(): => CRYPTO_THREAD_get_local(): <= NULL; # no state is found, so it gets allocated. => ossl_init_thread_start(): => OPENSSL_init_crypto(): # Here, base_inited is set to 1 # before ERR_set_mark() call => ERR_set_mark(): => ERR_get_state(): => CRYPTO_THREAD_get_local(): <= NULL; # no state is found, so it gets allocated!!!!! => ossl_init_thread_start(): => OPENSSL_init_crypto(): # base_inited is 1, # so no more init to be done <= 1 <= => CRYPTO_thread_set_local(): <= <= <= <= 1 <= => CRYPTO_thread_set_local() # previous value removed! <= Result: double allocation, and we have a leak. By calling the base OPENSSL_init_crypto() early, we get this instead: => ERR_get_state(): => OPENSSL_init_crypto(): # Here, base_inited is set to 1 # before ERR_set_mark() call => ERR_set_mark(): => ERR_get_state(): => OPENSSL_init_crypto(): # base_inited is 1, # so no more init to be done <= 1 => CRYPTO_THREAD_get_local(): <= NULL; # no state is found, so it gets allocated # let's assume we got 0xDEADBEEF => ossl_init_thread_start(): => OPENSSL_init_crypto(): # base_inited is 1, # so no more init to be done <= 1 <= 1 => CRYPTO_thread_set_local(): <= <= <= <= 1 => CRYPTO_THREAD_get_local(): <= 0xDEADBEEF <= 0xDEADBEEF Result: no leak. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4913)
* rsa: Do not allow less than 512 bit RSA keysSebastian Andrzej Siewior2017-12-113-6/+3
| | | | | | | | | | | | | | | | | | | | As per documentation, the RSA keys should not be smaller than 64bit (the documentation mentions something about a quirk in the prime generation algorithm). I am adding check into the code which used to be 16 for some reason. My primary motivation is to get rid of the last sentence in the documentation which suggest that typical keys have 1024 bits (instead updating it to the now default 2048). I *assume* that keys less than the 2048 bits (say 512) are used for education purposes. The 512 bits as the minimum have been suggested by Bernd Edlinger. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4547)
* Make BIO_METHOD struct definitions consistentDaniel Bevenius2017-12-096-6/+12
| | | | | | | | | | | | | | I noticed that some of the BIO_METHOD structs are placing the name on the same line as the type and some don't. This commit places the name on a separate line for consistency (which looks like what the majority do) CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4878)
* Convert the remaining functions in the record layer to use SSLfatal()Matt Caswell2017-12-081-0/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4841)
* Address some code-analysis issues.FdaSilvaYY2017-12-086-35/+27
| | | | | | | | | Expression '...' is always true. The 'b->init' variable is assigned values twice successively Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4753)
* Fix an incoherent test.FdaSilvaYY2017-12-081-6/+13
| | | | | | | | | | Pointer 'o' is set inside a local buffer, so it can't be NULL. Also fix coding style and add comments Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4754)
* Add missing range checks on number of multi primes in rsa_ossl_mod_expBernd Edlinger2017-12-081-2/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4862)
* chacha/asm/chacha-x86_64.pl: add AVX512VL code path.Andy Polyakov2017-12-081-4/+588
| | | | | | | | 256-bit AVX512VL was estimated to deliver ~50% improvement over AVX2 and it did live up to the expectations. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4838)
* crypto/x86_64cpuid.pl: suppress AVX512F flag on Skylake-X.Andy Polyakov2017-12-081-0/+8
| | | | | | | | | | It was observed that AVX512 code paths can negatively affect overall Skylake-X system performance. But we are talking specifically about 512-bit code, while AVX512VL, 256-bit variant of AVX512F instructions, is supposed to fly as smooth as AVX2. Which is why it remains unmasked. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4838)
* Consistent formatting for sizeof(foo)Rich Salz2017-12-0823-47/+47
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4872)
* bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.Andy Polyakov2017-12-061-8/+7
| | | | | | | | Credit to OSS-Fuzz for finding this. CVE-2017-3738 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix minor typo in comment in rsa_stDaniel Bevenius2017-12-051-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4845)
* Update eng_fat.cMerQGh2017-12-041-0/+1
| | | | | | | | | | | | This line will allow use private keys, which created by Crypto Pro, to sign with OpenSSL. CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4836)
* modes/asm/ghashv8-armx.pl: handle lengths not divisible by 4x.Andy Polyakov2017-12-041-9/+137
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* modes/asm/ghashv8-armx.pl: optimize modulo-scheduled loop.Andy Polyakov2017-12-041-31/+28
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* modes/asm/ghashv8-armx.pl: modulo-schedule loop.Andy Polyakov2017-12-041-3/+70
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* modes/asm/ghashv8-armx.pl: implement 4x aggregate factor.Andy Polyakov2017-12-041-12/+171
| | | | | | | | This initial commit is unoptimized reference version that handles input lengths divisible by 4 blocks. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* Add some more cleanupsMatt Caswell2017-12-041-0/+2
| | | | | | | | | | Follow up from the conversion to use SSLfatal() in the state machine to clean things up a bit more. [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Add some sanity checks for the fatal error conditionMatt Caswell2017-12-041-0/+1
| | | | | | | | | Sometimes at the top level of the state machine code we know we are supposed to be in a fatal error condition. This commit adds some sanity checks to ensure that SSLfatal() has been called. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Fix up a few places in the state machine that got missed with SSLfatal()Matt Caswell2017-12-041-0/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert more functions in ssl/statem/statem.c to use SSLfatal()Matt Caswell2017-12-041-0/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert remaining functions in statem_srvr.c to use SSLfatal()Matt Caswell2017-12-041-0/+8
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert remaining functions in statem_clnt.c to use SSLfatal()Matt Caswell2017-12-041-0/+12
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert the state machine code to use SSLfatal()Matt Caswell2017-12-041-0/+47
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* A missing semicolon prevents compilation with ENGINE_REF_COUNT_DEBUG enabled.Pauli2017-11-281-1/+1
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4816)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 13:40:06 +0100