summaryrefslogtreecommitdiffstats
path: root/providers/implementations (follow)
Commit message (Collapse)AuthorAgeFilesLines
* keymgmt: refactor fips indicator checkHEADmasterDimitri John Ledkov10 hours1-8/+4
| | | | | | | | | | | Currently direct call to ossl_ec_check_security_strength is used, instead of ossl_fips_ind_ec_key_check() like in all other places. Make keymgmt do the same check as ecdh_exch and ecdsa_sig do. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25748)
* Move some encode helpers to crypt/encode_decode/Viktor Dukhovni33 hours1-217/+37
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26487)
* Make the provider context available to encodersViktor Dukhovni36 hours1-63/+95
| | | | | | | | | | | | | | | | | | | | | | At the moment the provider context is only available to encoders that encrypt, but it is useful more generally. A similar change has already been merged to "master" on the decoder side, this is the mirror change for encoders. The only significant difference is that PEM_ASN1_write_bio needed to be "extended" (cloned) to allow it to pass the provider context down to the `k2d` function it uses to encode the data. I had to "hold my nose" and live with the random "20" added to the data size in order to accomodate encryption with padding, which may produce one more cipher block than the input length. This really should ask the EVP layer about the block length of the cipher, and allocate the right amount. This should be a separate fix for both the old PEM_ASN1_write_bio() and the new PEM_ASN1_write_bio_ctx(). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26475)
* drbg: provide requested amount of entropy, rather than self-strengthDimitri John Ledkov8 days1-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Parent DRBG can be seed source (os or jitter) and thus able to provide unlimited entropy. get_entropy is documented to provide at least the request amount of entropy. If requested amount of entropy is same as, or less than drbg->strength, everything is compliant. However, if requested entropy is more than drbg->strength (unlikely, but possible), the returned amount of entropy will be insufficient and additional repeated calls to get_entropy will be required. Reading history of refactors, it seems to me that this function call previouslly had assumptions and usecases that couldn't ever request or require more than strength amount of entropy. If entropy is set, request that amount, otherwise request drbg->strength amount. Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25850)
* Pre-ML-KEM/DSA decoder/encoder refactorViktor Dukhovni12 days3-61/+47
| | | | | | | | | Simplify some decoder/encoder internals to facilitate upcoming support for ML-KEM and ML-DSA. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26355)
* ec_kem.c: Fix ikmlen checkЗишан Мирза2024-12-301-2/+2
| | | | | | | | | | | | This makes `ikmlen` have a length of at least `Nsk`. Closes #26213 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26254)
* Fix leak of a RAND_POOL in error conditionTomas Mraz2024-12-132-2/+6
| | | | | | | | | Fixes Coverity 1636676 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26154)
* Add function to mix in an additional input into a RAND_POOLTomas Mraz2024-12-102-23/+13
| | | | | | | | | It will be just xor-ed over the existing entropy in the pool. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26128)
* jitter_generate(): Properly mix in the additional inputTomas Mraz2024-12-061-8/+8
| | | | | | | | | By adding the additional input directly to the pool we were using just the additional input. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26112)
* Code & comments changes to make them in consistentwillmafh2024-12-061-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* Change all one's complement to ones' complement for consistencywillmafh2024-12-061-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* Add handling for additional input in jitter rngjsondevers2024-12-031-0/+8
| | | | | | | | | Fixes #25917 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25966)
* providers: stop probing for getentropy(3) on recent FreeBSDKyle Evans2024-12-031-23/+28
| | | | | | | | | | | | | | | | | | | | | | | | FreeBSD has supported both getrandom(2) and getentropy(3) since 12.0. The last version which did *not* have these went EoL in September 2021. Use getrandom(2) unconditionally and fallback to sysctl kern.arandom if we do happen to have a FreeBSD that old. This is generally a necessary step for FreeBSD's _FORTIFY_SOURCE implementation, which needs to do some symbol renaming tricks with the getentropy declaration that would otherwise add some platform-specific hacks here to accommodate. getentropy(3) uses getrandom(2) internally on FreeBSD, so we just cut out the middleman. While we're here, it doesn't seem to make sense to ever prefer the sysctl on FreeBSD or NetBSD. For both platforms, it's limited to 256 bytes in a single request while getrandom(2) will generally use the same backend but service the entire request in one shot, even for larger amounts of entropy, modulo the EINTR possibility that presents itself with larger requests. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24903)
* Fix memleak in dsa_gen()Holger Dengler2024-11-291-1/+1
| | | | | | | | | | | | | Free the stack return value `dsa` on each early exit. Fixes #25905 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25948)
* pbkdf2: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli2024-11-281-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* hkdf: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli2024-11-281-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* fips-jitter: set provider into error state upon CRNG permanent failuresDimitri John Ledkov2024-11-251-2/+6
| | | | | | | | | | | | | | | With fips-jitter build time option, jitter can be inside FIPS boundary. Calls to jent_read_entropy() can return permanent failures for Repetitive Count Test (RTC), Adaptive Proportion Test (APT), LAG prediction test. Ensure the module enters error state upon permanent jitter failures. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25957)
* Fix potential memory leak on failure of ecx_gen_init()Niels Dossche2024-11-251-1/+1
| | | | | | | | | | When ecx_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq, leading to a memory leak. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26015)
* Fix potential memory leak on failure of dsa_gen_init()Niels Dossche2024-11-251-1/+1
| | | | | | | | | | | | | When dsa_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_PKEY_PARAM_FFC_DIGEST already in gctx->mdname, leading to a memory leak. Allocated here: https://github.com/openssl/openssl/blob/47a80fd2034cd4314d3b4958539dcd3106087109/providers/implementations/keymgmt/dsa_kmgmt.c#L524 Can return 0 here: https://github.com/openssl/openssl/blob/47a80fd2034cd4314d3b4958539dcd3106087109/providers/implementations/keymgmt/dsa_kmgmt.c#L529-L536 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26016)
* Add CTX copy function for EVP_MD to optimize the performance of ↵wangcheng2024-11-203-0/+27
| | | | | | | | | | | | | | | | | | | | | | EVP_MD_CTX_copy_ex. 1. Add OSSL_FUNC_digest_copyctx_fn function for EVP_MD, which is used to copy algctx from the old EVP_MD_CTX to the new one. 2. Add implementation of OSSL_FUNC_digest_copyctx_fn function for default providers. 3. Modify EVP_MD_CTX_copy_ex: When the fetched digest is the same in in and out contexts, use the copy function to copy the members in EVP_MD_CTX if the OSSL_FUNC_digest_copyctx_fn function exists. Otherwise, use the previous method to copy. 4. Add documentation for OSSL_FUNC_digest_copyctx function in doc/man7/provider-digest.pod. 5. Add testcase. Fixes #25703 Signed-off-by: wangcheng <bangwangnj@163.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25726)
* first cut at KEM & key management skeletonsMichael Baentsch2024-10-214-0/+634
| | | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25640)
* Avoid undefined behaviour with the <ctype.h> functions.Taylor R Campbell2024-10-102-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fix https://github.com/openssl/openssl/issues/25112 As defined in the C standard: In all cases the argument is an int, the value of which shall be representable as an unsigned char or shall equal the value of the macro EOF. If the argument has any other value, the behavior is undefined. This is because they're designed to work with the int values returned by getc or fgetc; they need extra work to handle a char value. If EOF is -1 (as it almost always is), with 8-bit bytes, the allowed inputs to the ctype.h functions are: {-1, 0, 1, 2, 3, ..., 255}. However, on platforms where char is signed, such as x86 with the usual ABI, code like char *p = ...; ... isspace(*p) ... may pass in values in the range: {-128, -127, -126, ..., -2, -1, 0, 1, ..., 127}. This has two problems: 1. Inputs in the set {-128, -127, -126, ..., -2} are forbidden. 2. The non-EOF byte 0xff is conflated with the value EOF = -1, so even though the input is not forbidden, it may give the wrong answer. Casting char inputs to unsigned char first works around this, by mapping the (non-EOF character) range {-128, -127, ..., -1} to {128, 129, ..., 255}, leaving no collisions with EOF. So the above fragment needs to be: char *p = ...; ... isspace((unsigned char)*p) ... This patch inserts unsigned char casts where necessary. Most of the cases I changed, I compile-tested using -Wchar-subscripts -Werror on NetBSD, which defines the ctype.h functions as macros so that they trigger the warning when the argument has type char. The exceptions are under #ifdef __VMS or #ifdef _WIN32. I left alone calls where the input is int where the cast would obviously be wrong; and I left alone calls where the input is already unsigned char so the cast is unnecessary. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25113)
* Add utility function ossl_param_is_empty()slontis2024-10-0960-97/+105
| | | | | | | | | | | | Changed all provider implementations that have a set_ctx_params() to call this function instead of just testing (params == NULL).This detects the case wherean OSSL_PARAM array contains just a terminator entry. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25499)
* fips: fix locking issuesPauli2024-10-091-13/+7
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25498)
* jitter: support an internal jitter entropy source in the FIPS providerPauli2024-10-091-0/+4
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25498)
* jitter: avoid a signed vs unsigned comparisonPauli2024-10-091-1/+1
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25498)
* Add some documentation to describe the encap/decap requirementsNeil Horman2024-10-071-0/+11
| | | | | | | | | | Document the fact that we now require unwrappedlen/wrappedlen to be set to the size of the unwrapped/wrapped buffers Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25522)
* Update rsasve_recover to properly store outlen on successNeil Horman2024-10-071-4/+39
| | | | | | | | | | | | Outlen was never validated in this function prior to use, nor is it set to the decrypted value on sucess. Add both of those operations Fixes #25509 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25522)
* Drop the aid field of the signature prov ctxlan11202024-10-074-13/+30
| | | | | | | | Signed-off-by: lan1120 <lanming@huawei.com> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23094)
* Fix rsa_sigalg_set_ctx_params() to return 1 for unknown parameters.slontis2024-10-041-4/+1
| | | | | | | | | | | This keeps the code consistent with the changes done for other algorithms that support sigalg_set_ctx_params(). set_ctx_params() should always return 1 if the parameter is unknown. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25570)
* fips: add lots of potentially missing ossl_prov_is_running checksDimitri John Ledkov2024-10-026-2/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After rudimentary analysis, it appears the below functions can potentially produce output, whilst the provider is in error state. These functions were detected using this method: ``` CFLAGS='-save-temps' ./Configure enable-fips --debug make -j10 find . -name '*.i' | xargs git add -f git grep --cached -p ossl_prov_is_running | grep libfips-lib > ossl_prov_is_running.txt git grep --cached -p 'return' | grep libfips-lib > return.txt grep '\.i=' return.txt > func-with_return.txt grep '\.i=' ossl_prov_is_running.txt > func-with-ossl_prov_is_running.txt grep --fixed-strings --line-regexp --file=func-with-ossl_prov_is_running.txt return.txt > func-without-ossl_prov_is_running.txt grep -e newctx -e initctx -e dupctx func-without-ossl_prov_is_running.txt | grep -v ossl_prov_is_running ``` And from there doing manual inspection, as the list was short at that point. As in compile with keeping pre-processed source code; and use `git grep --cached -p` to find these preprocessed files, and scan for calls to return or opssl_prov_is_running, with function name printed. And then exclude one from the other, to hopefully get a list of all the functions that do not check for ossl_prov_is_running. As number of functions without "func-without-ossl_prov_is_running" check is large, I do wonder which other functions are "interesting" to check for. I think I'm not scanning for _update functions correctly. Any tips on improving above analysis will help with maintaining such checks going forward. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25580)
* Use the correct length value for input saltSimo Sorce2024-10-021-1/+1
| | | | | | | | | | | | | | | | | | | In this function the salt can be either a zero buffer of exactly mdlen length, or an arbitrary salt of prevsecretlen length. Although in practice OpenSSL will always pass in a salt of mdlen size bytes in the current TLS 1.3 code, the openssl kdf command can pass in arbitrary values (I did it for testing), and a future change in the higher layer code could also result in unmatched lengths. If prevsecretlen is > mdlen this will cause incorrect salt expansion, if prevsecretlen < mdlen this could cause a crash or reading random information. Inboth case the generated output would be incorrect. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25579)
* Fix bugs in ECDH cofactor FIPS indicator.slontis2024-09-301-1/+4
| | | | | | | | | | | | | | | | | | | | | | The code was not detecting that the cofactor was set up correctly if OSSL_PKEY_PARAM_USE_COFACTOR_ECDH was set, resulting in an incorrect FIPS indicator error being triggered. Added a test for all possible combinations of a EVP_PKEY setting OSSL_PKEY_PARAM_USE_COFACTOR_ECDH and the derive context setting OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE. This only affects the B & K curves (which have a cofactor that is not 1). Bug reported by @abkarcher Testing this properly, also detected a memory leak of privk when the FIPS indicator error was triggered (in the case where mode = 0 and use_cofactor was 1). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25548)
* kdfs: implement key length check in X9.42Dimitri John Ledkov2024-09-301-6/+46
| | | | | | | | | Similar to other KDFs, the input key should be 112 bits long. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25529)
* fips: Prohibit SHA1 in DH & ECDH exchangeDimitri John Ledkov2024-09-272-6/+6
| | | | | | | | | | | | | | | | | See Section 5 Key Agreement Using Diffie-Hellman and MQV of [NIST SP 800-131Ar2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf). Strengths less than 112bits is disallowed, thus eliminating SHA1. Skip cms test case that requires use of SHA1 with X9.42 DH. Rename ossl_fips_ind_digest_check to ossl_fips_ind_digest_exch_check Add myself to Changes for fips indicator work Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25517)
* fips: continuous random bit generator testsPauli2024-09-196-204/+439
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For FIPS 140-3 the continuous tests specified in SP 800-90B need to be included on the output of any entropy source. They are implemented here as a replacement for the primary DRBG in the FIPS provider. This results in a setup that looks like this: +-------------+ | | | Seed Source | | | +------+------+ | | v +-------------+ | | | CRNG Test | | | ++----------+-+ | | | | v v +--------------+ +--------------+ | | | | | Public DRBG | | Private DRBG | | | | | +--------------+ +--------------+ An additional benefit, that of avoiding DRBG chains, is also gained. The current standards do not permit the output of one DRBG to be used as the input for a second (i.e. a chain). This also leaves open the future possibility of incorporating a seed source inside the FIPS boundary. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* rand: remove unused field in DRBG structurePauli2024-09-191-2/+0
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* drbg: Fix typoPauli2024-09-191-1/+1
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* Add Missing Error Messages for AES-OCB Tag Length Validationerbsland-dev2024-09-131-2/+10
| | | | | | | | | | | | | | | | | | | Related to #8331 Addressing found issues by adding specific error messages to improve feedback when tag length checks fail for the `EVP_CTRL_AEAD_SET_TAG` parameter in the AES-OCB algorithm. - Added PROV_R_INVALID_TAG_LENGTH error to indicate when the current tag length exceeds the maximum tag length of the algorithm. - Added `PROV_R_INVALID_TAG_LENGTH` error to indicate when the current tag length in the context does not match a custom tag length provided as a parameter. - Added `ERR_R_PASSED_INVALID_ARGUMENT` error to handle cases where an invalid pointer is passed in encryption mode. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25425)
* s390x: Add hardware acceleration for full AES-XTSHolger Dengler2024-09-134-0/+228
| | | | | | | | | | | | | | The CPACF instruction KM provides support for accelerating the full AES-XTS algorithm on newer machines for AES_XTS_128 and AES_XTS_256. Preliminary measurements showed performance improvements of up to 50%, dependent on the message size. Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25414)
* Don't restrict the ECDSA settable ctx params unnecessarilyMatt Caswell2024-09-091-9/+0
| | | | | | | | | | | | | We just allow all possible settables all the time. Some things like the digest name can't actually be changed in some circumstances - but we already have checks for those things. It's still possible to pass a digest of the same name to one that's already been set for example. Fixes #25012 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25057)
* Complain about a missing digest when doing deterministic ECDSAMatt Caswell2024-09-091-1/+5
| | | | | | | | | | | We need a digest for the none when doing deterministic ECDSA. Give a better error message if one hasn't been supplied. See openssl/openssl#25012 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25057)
* s390x: Fix s390x_shake_squeeze() when MSA 12 is availableIngo Franzki2024-09-061-1/+4
| | | | | | | | | | | | | | | | | | | | On the first squeeze call, when finishing the absorb process, also set the NIP flag, if we are still in XOF_STATE_INIT state. When MSA 12 is available, the state buffer A has not been zeroed during initialization, thus we must also pass the NIP flag here. This situation can happen when a squeeze is performed without a preceding absorb (i.e. a SHAKE of the empty message). Add a test that performs a squeeze without a preceding absorb and check if the result is correct. Fixes: https://github.com/openssl/openssl/commit/25f5d7b85f6657cd2f9f1ab7ae87f319d9bafe54 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25388)
* s390x: Fix s390x_sha3_absorb() when no data is processed by KIMDIngo Franzki2024-09-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | If the data to absorb is less than a block, then the KIMD instruction is called with zero bytes. This is superfluous, and causes incorrect hash output later on if this is the very first absorb call, i.e. when the xof_state is still XOF_STATE_INIT and MSA 12 is available. In this case the NIP flag is set in the function code for KIMD, but KIMD ignores the NIP flag when it is called with zero bytes to process. Skip any KIMD calls for zero length data. Also do not set the xof_state to XOF_STATE_ABSORB until the first call to KIMD with data. That way, the next KIMD (with non-zero length data) or KLMD call will get the NIP flag set and will then honor it to produce correct output. Fixes: https://github.com/openssl/openssl/commit/25f5d7b85f6657cd2f9f1ab7ae87f319d9bafe54 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25388)
* argon2: Fixed an thread availability error stringPIums2024-09-051-2/+2
| | | | | | | | | | | | Correctly display the number of requested threads and the number of available threads. CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25375)
* Copyright year updatesTomas Mraz2024-09-0547-47/+47
| | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
* s390x: Fix prehash-by-caller handling for ED25519 and ED448Ingo Franzki2024-09-031-14/+30
| | | | | | | | | | | | | In case of prehash or prehash-by-caller is set skip the s390x specific acceleration an fallback to the non-accelerated code path. Fixes: 66966827740a04249300b0b25735e9d4c9bcab26 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25351)
* fix: ossl_digest_get_approved_nid() returns NID_undef on invalid digestRichard Levitte2024-08-303-3/+3
| | | | | | | | | | | We checked using 'md_nid < 0', which is faulty. Impact: DSA and ECDSA signature provider implementations Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24992)
* Refactor OpenSSL 'ECDSA' EVP_SIGNATURE to also include ECDSA+hash compositesRichard Levitte2024-08-303-156/+556
| | | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24992)
* Refactor OpenSSL 'DSA' EVP_SIGNATURE to also include DSA+hash compositesRichard Levitte2024-08-303-93/+487
| | | | | | | | | | | (in the code, "sigalg" is used to refer to these composite algorithms, which is a nod to libcrypto and libssl, where that term is commonly used for composite algorithms) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24992)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-22 19:07:40 +0100