summaryrefslogtreecommitdiffstats
path: root/providers/implementations/kdfs (follow)
Commit message (Collapse)AuthorAgeFilesLines
* kdf_scrypt_reset(): NULLify freed pointersTomas Mraz9 days1-0/+2
| | | | | | | | Otherwise doublefree happens with further usage. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26488)
* scrypt: Do not free the context itself when fetch failsTomas Mraz9 days1-1/+0
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26488)
* Code & comments changes to make them in consistentwillmafh2024-12-061-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* Change all one's complement to ones' complement for consistencywillmafh2024-12-061-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* pbkdf2: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli2024-11-281-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* hkdf: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli2024-11-281-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* Add utility function ossl_param_is_empty()slontis2024-10-0913-22/+22
| | | | | | | | | | | | Changed all provider implementations that have a set_ctx_params() to call this function instead of just testing (params == NULL).This detects the case wherean OSSL_PARAM array contains just a terminator entry. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25499)
* Use the correct length value for input saltSimo Sorce2024-10-021-1/+1
| | | | | | | | | | | | | | | | | | | In this function the salt can be either a zero buffer of exactly mdlen length, or an arbitrary salt of prevsecretlen length. Although in practice OpenSSL will always pass in a salt of mdlen size bytes in the current TLS 1.3 code, the openssl kdf command can pass in arbitrary values (I did it for testing), and a future change in the higher layer code could also result in unmatched lengths. If prevsecretlen is > mdlen this will cause incorrect salt expansion, if prevsecretlen < mdlen this could cause a crash or reading random information. Inboth case the generated output would be incorrect. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25579)
* kdfs: implement key length check in X9.42Dimitri John Ledkov2024-09-301-6/+46
| | | | | | | | | Similar to other KDFs, the input key should be 112 bits long. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25529)
* argon2: Fixed an thread availability error stringPIums2024-09-051-2/+2
| | | | | | | | | | | | Correctly display the number of requested threads and the number of available threads. CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25375)
* Copyright year updatesTomas Mraz2024-09-057-7/+7
| | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
* EVP_MD_size() updatesslontis2024-08-292-5/+5
| | | | | | | | | | For SHAKE algorithms we now return 0 from EVP_MD_size(). So all the places that check for < 0 needed to change to <= 0 (Otherwise the behaviour will be to digest nothing in most cases). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25285)
* Update code to use EVP_MD_xof()slontis2024-08-296-6/+6
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25285)
* Cleanups for FIPS options..slontis2024-08-286-26/+14
| | | | | | | | | | | | | | | | | | The options in fipsprov.c are now generated using macros with fips_indicator_params.inc. This should keep the naming consistent. Some FIPS related headers have moved to providers/fips/include so that they can use fips_indicator_params.inc. securitycheck.h now includes fipsindicator.h, and fipsindicator.h includes fipscommon.h. fipsinstall.c uses OSSL_PROV_PARAM_ for the configurable FIPS options rather than using OSSL_PROV_FIPS_PARAM_* as this was confusing as to which one should be used. fips_names.h just uses aliases now for existing public names. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25162)
* Add FIPS KMAC key checkslontis2024-08-211-3/+4
| | | | | | | | | | | This adds a FIPS indicator for KMAC key size. Note that 112 bits keys are still smaller than the sizes required to reach 128 bits for KMAC128 and 256 bits for KMAC256 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25049)
* Add HMAC FIPS keysize check.slontis2024-08-211-4/+3
| | | | | | | | | | | | | | | | | HMAC has been changed to use a FIPS indicator for its key check. HKDF and Single Step use a salt rather than a key when using HMAC, so we need a mechanism to bypass this check in HMAC. A seperate 'internal' query table has been added to the FIPS provider for MACS. Giving HMAC a seprate dispatch table allows KDF's to ignore the key check. If a KDF requires the key check then it must do the check itself. The normal MAC dipatch table is used if the user fetches HMAC directly. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25049)
* fips: add kbkdf key length check as per SP 800-131a revision 2Pauli2024-08-081-7/+50
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25095)
* Add new configurable item `pbkdf2-lower-bound-check`pohsingwu2024-08-051-6/+2
| | | | | | | | | Since FIPS provider performs lower bound check by default from v3.0, the default value for new configurable item will be one. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24120)
* Add explicit indicator for PBKDF2pohsingwu2024-08-051-20/+87
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24120)
* Call key_check_passed in set_ctx_paramspohsingwu2024-08-014-28/+34
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23900)
* Restrict the length of key-derivation key used in KDFspohsingwu2024-08-014-0/+181
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23900)
* Disallow SHAKE when using PBKDF2 and X9.42 KDFPauli2024-07-302-4/+21
| | | | | | | | The operation is non-sensical. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24862)
* Restrict digest in set_ctx_paramspohsingwu2024-07-244-160/+255
| | | | | | | | In this commit, we also return different error if the digest is XOF. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23889)
* Restrict digest algorithm used in KDFspohsingwu2024-07-244-19/+294
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23889)
* that open brace { should be on the previous lineDimitri Papadopoulos2024-07-221-2/+3
| | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* Fix kbkdf bug if MAC is set to KMAC and then something elsePauli2024-07-171-1/+2
| | | | | | | | | | | A context that is set to KMAC sets the is_kmac flag and this cannot be reset. So a user that does kbkdf using KMAC and then wants to use HMAC or CMAC will experience a failure. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24883)
* Change all existing FIPS configurable checks to use FIPS indicators.slontis2024-07-111-18/+49
| | | | | | | | | | This changes the logic to always do the security checks and then decide what to do based on if this passes or not. Failure of a check causes either a failure OR the FIPS indicator callback to be triggered. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24623)
* fips: zeroization of public security parameters (PSPs)Dimitri John Ledkov2024-05-132-0/+8
| | | | | | | | | | | | | | | | | | | | | ISO 19790:2012/Cor.1:2015 7.9 requires cryptographic module to provide methods to zeroise all unproctected security sensitive parameters (which inclues both Critical/Private **and** Public security parameters). And those that are temprorarly stored are required to be zeroised after they are no longer needed at security levels 2 and higher. Comply with the above requirements by always zeroising public security parameters whenever they are freed. This is currently done under the FIPS feature, however the requirement comes from the ISO 19790:2012 which may also be needed in other jurisdictions. If not always. Note FIPS 140-3 includes ISO 19790:2012 by reference. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24355)
* hkdf: when HMAC key is all zeros, still set a valid key lengthDimitri John Ledkov2024-04-251-1/+1
| | | | | | | | | | | | | | | By itself, this is no change in any computation. However, this will unlock enforcing minimum key lengths for NIST and FIPS 140-3 requirements. Also reading RFC8448 and RFC5869, this seems to be strictly correct too. Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24204)
* Fix EVP_PKEY_CTX_add1_hkdf_info() behaviorTodd Short2024-04-091-0/+8
| | | | | | | | | | | | | | Fix #23448 `EVP_PKEY_CTX_add1_hkdf_info()` behaves like a `set1` function. Fix the setting of the parameter in the params code. Update the TLS_PRF code to also use the params code. Add tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23456)
* Copyright year updatesRichard Levitte2024-04-092-2/+2
| | | | | | | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes (cherry picked from commit 0ce7d1f355c1240653e320a3f6f8109c1f05f8c0) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24034)
* kdfs/hmacdrbg_kdf.c: Add checks for the EVP_MD_get_size()Jiasheng Jiang2024-04-011-1/+5
| | | | | | | | | | | | | Add checks for the EVP_MD_get_size() to avoid integer overflow and then explicitly cast from int to size_t. Fixes: f3090fc710 ("Implement deterministic ECDSA sign (RFC6979)") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23950)
* Add appropriate NULL checks in EVP_CIPHER apiNeil Horman2024-01-251-0/+6
| | | | | | | | | | | | | | The EVP_CIPHER api currently assumes that calls made into several APIs have already initalized the cipher in a given context via a call to EVP_CipherInit[_ex[2]]. If that hasnt been done, instead of an error, the result is typically a SIGSEGV. Correct that by adding missing NULL checks in the apropriate apis prior to using ctx->cipher Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22995)
* cleanse stack variable in kdf_pbkdf1_do_deriveNeil Horman2024-01-051-0/+1
| | | | | | | | | | | kdf_pbkdf1_do_derive stores key derivation information in a stack variable, which is left uncleansed prior to returning. Ensure that the stack information is zeroed prior to return to avoid potential leaks of key information Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23194)
* validate requested key length in kdf_pbkdf1_do_deriveNeil Horman2024-01-031-0/+5
| | | | | | | | | | | | | When using pbkdf1 key deriviation, it is possible to request a key length larger than the maximum digest size a given digest can produce, leading to a read of random stack memory. fix it by returning an error if the requested key size n is larger than the EVP_MD_size of the digest Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23174)
* Accept longer context for TLS 1.2 exportersDaiki Ueno2023-10-261-16/+32
| | | | | | | | | | | | | | | While RFC 5705 implies that the maximum length of context for exporters to be 65535 bytes as the length is embedded in uint16, the current implementation enforces much smaller limit, which is less than 1024 bytes. This removes the restriction by dynamically allocating memory. Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22465)
* Blake2b: Use OSSL_DIGEST_PARAM_SIZE as settable instead of XOFLENTomas Mraz2023-10-251-5/+5
| | | | | | | | | | | | | | | | | BLAKE2 is not really an extensible output function unlike SHAKE as the digest size must be set during the context initialization. Thus it makes no sense to use OSSL_DIGEST_PARAM_XOFLEN. We also need to adjust EVP_DigestFinal_ex() to query the OSSL_DIGEST_PARAM_SIZE as gettable ctx param for the size. Fixes #22488 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22491)
* Remove use of _Static_assertMatt Caswell2023-09-151-8/+3
| | | | | | | | | | | | | | We had some use of the C11 _Static_assert feature which can cause some problems on some platforms. Everywhere we were using it, it is not really required so remove it. Fixes #22017 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22091)
* Copyright year updatesMatt Caswell2023-09-0714-14/+14
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* Fix typos found by codespellDimitri Papadopoulos2023-06-151-1/+1
| | | | | | | | Typos in doc/man* will be fixed in a different commit. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20910)
* Update hkdf.c to avoid potentially vulnerable code patternNicky Mouha2023-05-191-1/+1
| | | | | | | | | | | | | | | | | | | | | The expression "if (a+b>c) a=c-b" is incorrect if "a+b" overflows. It should be replaced by "if (a>c-b) a=c-b", which avoids the potential overflow and is much easier to understand. This pattern is the root cause of CVE-2022-37454, a buffer overflow vulnerability in the "official" SHA-3 implementation. It has been confirmed that the addition in https://github.com/openssl/openssl/blob/master/providers/implementations/kdfs/hkdf.c#L534 cannot overflow. So this is only a minor change proposal to avoid a potentially vulnerable code pattern and to improve readability. More information: https://github.com/github/codeql/pull/12036#issuecomment-1466056959 CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20990)
* Update KDFs to use shared functions.Pauli2023-04-263-109/+42
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20724)
* Replaced '{ 0, NULL }' with OSSL_DISPATCH_END in OSSL_DISPATCH arraysIrak Rigia2023-04-2114-18/+18
| | | | | | | | | Fixes #20710 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20745)
* Minor refactoring of the Argon2 derive functionTomas Mraz2023-04-211-48/+30
| | | | | | | | | Cache the fetched MAC and MD implementation until propq changes. No need to keep the output stored in the context. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20534)
* providers/implementations/kdfs/argon2.c: Don't use UINT64_CRichard Levitte2023-03-211-1/+1
| | | | | | | | | | | | With less than C99 compilers, this macro isn't guaranteed to exist, and the value passed to it is 32 bits, so explicitly ending it with 'UL' is correct in all cases. We simply leave it to the compiler to extend it appropriately for uint64_t. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20547)
* Avoid freeing context on errorPauli2023-03-201-2/+0
| | | | | | | | Freeing the allocated KDF context seems wrong when derive errors. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20528)
* Coverity 1522032: use after freePauli2023-03-201-2/+2
| | | | | | | | Fix use after free error. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20528)
* providers/implementations/kdfs/argon2.c: Include openssl/e_os2.h instead of ↵Richard Levitte2023-03-171-4/+3
| | | | | | | | | | | | | | stdint.h <stdint.h> may not exist with pre-C99 compilers. <openssl/e_os2.h> deals with that, so include it instead. Similarly, include "internal/numbers.h" rather than <limits.h>, to deal with things that may be lacking in the latter. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20537)
* providers: add Argon2 KDFČestmír Kalina2023-03-172-0/+1588
| | | | | | | | | | https://datatracker.ietf.org/doc/rfc9106/ Signed-off-by: Čestmír Kalina <ckalina@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12256)
* Add option to FIPS module to enforce EMS check during KDF TLS1_PRF.slontis2023-03-071-0/+26
| | | | | | | | Fixes #19989 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20241)
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-01 15:24:18 +0100