summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-03-07Add a simple test for RSA_SSLV23_PADDINGBernd Edlinger
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit ac6fff700a9799c25902165e2594fd46826f3ee3)
2019-03-07Update documentation regarding required output buffer memory sizeBernd Edlinger
of RSA_private_decrypt/RSA_public_encrypt. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit b89fdeb2f7d4471cbfd8a579945754327a4e06a8)
2019-03-07Fix memory overrun in rsa padding check functionsBernd Edlinger
Fixes #8364 and #8357 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit d7f5e5ae6d53f1387a42d210806cf5e9ed0882d6)
2019-03-07Limit DEVRANDOM_WAIT to linuxBernd Edlinger
Fixes #8416 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8428) (cherry picked from commit 596521f48826892ddd62322726f6f2a2a52db652)
2019-03-07Add a test for underflow in ecp_nistp521.cMatt Caswell
The previous commit fixed an underflow that may occur in ecp_nistp521.c. This commit adds a test for that condition. It is heavily based on an original test harness by Billy Brumley. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8405) (cherry picked from commit 6855b496b205c067ecb276221c31c6212f4fdbae)
2019-03-07Avoid an underflow in ecp_nistp521.cMatt Caswell
The function felem_diff_128_64 in ecp_nistp521.c substracts the number |in| from |out| mod p. In order to avoid underflow it first adds 32p mod p (which is equivalent to 0 mod p) to |out|. The comments and variable naming suggest that the original author intended to add 64p mod p. In fact it has been shown that with certain unusual co-ordinates it is possible to cause an underflow in this function when only adding 32p mod p while performing a point double operation. By changing this to 64p mod p the underflow is avoided. It turns out to be quite difficult to construct points that satisfy the underflow criteria although this has been done and the underflow demonstrated. However none of these points are actually on the curve. Finding points that satisfy the underflow criteria and are also *on* the curve is considered significantly more difficult. For this reason we do not believe that this issue is currently practically exploitable and therefore no CVE has been assigned. This only impacts builds using the enable-ec_nistp_64_gcc_128 Configure option. With thanks to Bo-Yin Yang, Billy Brumley and Dr Liu for their significant help in investigating this issue. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8405) (cherry picked from commit 13fbce17fc9f02e2401fc3868f3f8e02d6647e5f)
2019-03-06Update ChaCha20-Poly1305 documentationMatt Caswell
Correctly describe the maximum IV length. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit 27d5631236325c3fd8a3bd06af282ac496aac64b)
2019-03-06Test an overlong ChaCha20-Poly1305 nonceMatt Caswell
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit a4f0b50eafb256bb802f2724fc7f7580fb0fbabc)
2019-03-06Prevent over long nonces in ChaCha20-Poly1305Matt Caswell
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. CVE-2019-1543 Fixes #8345 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit 2a3d0ee9d59156c48973592331404471aca886d6)
2019-03-05Don't write the tick_identity to the sessionMatt Caswell
Sessions must be immutable once they can be shared with multiple threads. We were breaking that rule by writing the ticket index into it during the handshake. This can lead to incorrect behaviour, including failed connections in multi-threaded environments. Reported by David Benjamin. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8383) (cherry picked from commit c96ce52ce293785b54a42d119c457aef739cc2ce)
2019-03-04openssl_strerror_r: Fix handling of GNU strerror_rVitezslav Cizek
GNU strerror_r may return either a pointer to a string that the function stores in buf, or a pointer to some (immutable) static string in which case buf is unused. In such a case we need to set buf manually. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8371) (cherry picked from commit e3b35d2b29e9446af83fcaa534e67e7b04a60d7a)
2019-03-01Fix seeding from random device w/o getrandom syscallBernd Edlinger
Use select to wait for /dev/random in readable state, but do not actually read anything from /dev/random, use /dev/urandom first. Use linux define __NR_getrandom instead of the glibc define SYS_getrandom, in case the kernel headers are more current than the glibc headers. Fixes #8215 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8251) (cherry picked from commit 38023b87f037f4b832c236dfce2a76272be08763)
2019-03-01deps: add s390 asm rules for OpenSSL-1.1.1Shigeki Ohtsu
Generate asm files with Makefile rules. From: - https://github.com/nodejs/node/commit/0d9a86c7cb3566b22becc656691282402f5026c0 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8351)
2019-02-28Configure: support a few more "make variables" defaulting from envRichard Levitte
CFLAGS, CXXFLAGS, CPPFLAGS, LDFLAGS, and LDLIBS (cherry picked from commit 8e7984e5783877c58cddc7b4e668401580ab4467) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
2019-02-28.travis.yml: change -std=c89 to -ansiRichard Levitte
For C, -ansi is equivalent to -std=c90 For C++, -ansi is equivalent to -std=c++98 We also place -ansi in CPPFLAGS instead of the usual command line config, to avoid getting it when linking (clang complains) (cherry picked from commit 874f785988c17991051d36a0407a87b36c463a94) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
2019-02-28Configuration: divide devteam flags into language specific setsRichard Levitte
Some of the devteam flags are not for C++ (cherry picked from commit e373c70a3e535b560f6b6bade914a724aa975c55) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
2019-02-28Do buildtests on our public header files with C++ as wellRichard Levitte
This ensures that we don't mistakenly use C++ keywords anywhere public. Related to #8313 (cherry picked from commit 9f27d4bf32c0465270e1922365b21825a0f7a42a) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
2019-02-28Configure: make --strict-warnings a regular user provided compiler optionRichard Levitte
This makes `--strict-warnings` into a compiler pseudo-option, i.e. it gets treated the same way as any other compiler option given on the configuration command line, but is retroactively replaced by actual compiler warning options, depending on what compiler is used. This makes it easier to see in what order options are given to the compiler from the configuration command line, i.e. this: ./config -Wall --strict-warnings would give the compiler flags in the same order as they're given, i.e.: -Wall -Werror -Wno-whatever ... instead of what we got previously: -Werror -Wno-whatever ... -Wall (cherry picked from commit fcee53948b7f9a5951d42f4ee321e706ea6b4b84) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8359)
2019-02-27cfi build fixes in x86-64 ghash assemblyShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8281) (cherry picked from commit 54d00677f305375eee65a0c9edb5f0980c5f020f)
2019-02-27Make the padlock engine build correctlyRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8220) (cherry picked from commit 149c12d5e41b238ce4af6d1b6b3a767b40293bd7)
2019-02-27Ensure configured module specific and application specific defines are usedRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8220) (cherry picked from commit 2fce15b58b2502a614529707eb45b6e5cac4eb15)
2019-02-27Add PADLOCK_ASM to dso_defines rather than lib_definesRichard Levitte
Since the padlock code is an engine, the assembler is for a module, not a library link to when building a program... there's a distinction. Fixes #2311 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8220) (cherry picked from commit 88780b1c5f6000fe6731fec74efe697bcf493b6c)
2019-02-27Fix the default digest algorthm of SM2Paul Yang
Currently SM2 shares the ameth with EC, so the current default digest algorithm returned is SHA256. This fixes the default digest algorithm of SM2 to SM3, which is the only valid digest algorithm for SM2 signature. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8186) (cherry picked from commit e766f4a0531bffdab8ad2038279b755928d7a40a)
2019-02-26Revert "Configure: stop forcing use of DEFINE macros in headers"Richard Levitte
Github PR #8246 provides a better solution to the problem. This reverts commit f11ffa505f8a9345145a26a05bf77b012b6941bd. [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8247) (cherry picked from commit 4089b4340701e3c13e07169e67a7d14519c98658)
2019-02-26[test] modernize ecdsatest and extend ECDSA sign KATsBilly Brumley
(cherry picked from commit 1a31d8017ee7e8df0eca76fee601b826699c9ac1) Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8314)
2019-02-26Fix trivial typo in EVP_DigestVerifyInit docNicola Tuveri
(cherry picked from commit b3883f77df33989b0d4298ca9a21d8595dd9a8c9) Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8319)
2019-02-26Prepare for 1.1.1c-devMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2019-02-26Prepare for 1.1.1b releaseOpenSSL_1_1_1bMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2019-02-26Clarify that SSL_shutdown() must not be called after a fatal errorMatt Caswell
Follow on from CVE-2019-1559 Reviewed-by: Richard Levitte <levitte@openssl.org>
2019-02-26Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8347)
2019-02-26e_devcrypto: set digest input_blocksizeEneas U de Queiroz
This restores the behavior of previous versions of the /dev/crypto engine, in alignment with the default implementation. Reported-by: Gerard Looije <lglooije@hotmail.com> Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8306)
2019-02-26eng_devcrypto: close open session on initEneas U de Queiroz
cipher_init may be called on an already initialized context, without a necessary cleanup. This separates cleanup from initialization, closing an eventual open session before creating a new one. Move the /dev/crypto session cleanup code to its own function. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8306)
2019-02-26Update NEWS for new releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8344)
2019-02-26Disable 02-test_errstr.t on msys/mingw as well as MSWin32Richard Levitte
There is too high a risk that perl and OpenSSL are linked with different C RTLs, and thereby get different messages for even the most mundane error numbers. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8343) (cherry picked from commit 565a19eef35926b4b9675f6cc3964fb290a5b380)
2019-02-26VMS: disable the shlibload test for nowRichard Levitte
test/shlibloadtest.c needs added code for VMS shared libraries Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8342)
2019-02-25Rearrange the inclusion of curve448/curve448_lcl.hRichard Levitte
The real cause for this change is that test/ec_internal_test.c includes ec_lcl.h, and including curve448/curve448_lcl.h from there doesn't work so well with compilers who always do inclusions relative to the C file being compiled. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8334)
2019-02-25Ensure bn_cmp_words can handle the case where n == 0Matt Caswell
Thanks to David Benjamin who reported this, performed the analysis and suggested the patch. I have incorporated some of his analysis in the comments below. This issue can cause an out-of-bounds read. It is believed that this was not reachable until the recent "fixed top" changes. Analysis has so far only identified one code path that can encounter this - although it is possible that others may be found. The one code path only impacts 1.0.2 in certain builds. The fuzzer found a path in RSA where iqmp is too large. If the input is all zeros, the RSA CRT logic will multiply a padded zero by iqmp. Two mitigating factors: - Private keys which trip this are invalid (iqmp is not reduced mod p). Only systems which take untrusted private keys care. - In OpenSSL 1.1.x, there is a check which rejects the oversize iqmp, so the bug is only reproducible in 1.0.2 so far. Fortunately, the bug appears to be relatively harmless. The consequences of bn_cmp_word's misbehavior are: - OpenSSL may crash if the buffers are page-aligned and the previous page is non-existent. - OpenSSL will incorrectly treat two BN_ULONG buffers as not equal when they are equal. - Side channel concerns. The first is indeed a concern and is a DoS bug. The second is fine in this context. bn_cmp_word and bn_cmp_part_words are used to compute abs(a0 - a1) in Karatsuba. If a0 = a1, it does not matter whether we use a0 - a1 or a1 - a0. The third would be worth thinking about, but it is overshadowed by the entire Karatsuba implementation not being constant time. Due to the difficulty of tripping this and the low impact no CVE is felt necessary for this issue. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8326) (cherry picked from commit 576129cd72ae054d246221f111aabf42b9c6d76d)
2019-02-22Windows: Call TerminateProcess, not ExitProcessRichard Levitte
Ty Baen-Price explains: > Problem and Resolution: > The following lines of code make use of the Microsoft API ExitProcess: > > ``` > Apps\Speed.c line 335: ExitProcess(ret); > Ms\uplink.c line 22: ExitProcess(1); > ``` > > These function calls are made after fatal errors are detected and > program termination is desired. ExitProcess(), however causes > _orderly_ shutdown of a process and all its threads, i.e. it unloads > all dlls and runs all destructors. See MSDN for details of exactly > what happens > (https://msdn.microsoft.com/en-us/library/windows/desktop/ms682658(v=vs.85).aspx). > The MSDN page states that ExitProcess should never be called unless > it is _known to be safe_ to call it. These calls should simply be > replaced with calls to TerminateProcess(), which is what should be > called for _disorderly_ shutdown. > > An example of usage: > > ``` > TerminateProcess(GetCurrentProcess(), exitcode); > ``` > > Effect of Problem: > Because of a compilation error (wrong c++ runtime), my program > executed the uplink.c ExitProcess() call. This caused the single > OpenSSL thread to start executing the destructors of all my dlls, > and their objects. Unfortunately, about 30 other threads were > happily using those objects at that time, eventually causing a > 0xC0000005 ACCESS_VIOLATION. Obviously an ACCESS_VIOLATION is the > best case scenario, as I'm sure you can imagine at the consequences > of undiscovered memory corruption, even in a terminating process. And on the subject of `TerminateProcess()` being asynchronous: > That is technically true, but I think it's probably synchronous > "enough" for your purposes, since a call to TerminateProcess > suspends execution of all threads in the target process. This means > it's really only asynchronous if you're calling TerminateProcess one > some _other_ process. If you're calling TerminateProcess on your own > process, you'll never return from the TerminateProcess call. Fixes #2489 Was originally RT-4526 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8301) (cherry picked from commit 925795995018bddb053e863db8b5c52d2a9005d9)
2019-02-22Don't restrict the number of KeyUpdate messages we can processMatt Caswell
Prior to this commit we were keeping a count of how many KeyUpdates we have processed and failing if we had had too many. This simplistic approach is not sufficient for long running connections. Since many KeyUpdates would not be a particular good DoS route anyway, the simplest solution is to simply remove the key update count. Fixes #8068 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8299) (cherry picked from commit 3409a5ff8a44ddaf043d83ed22e657ae871be289)
2019-02-22engines/dasync: add explaining comments about AES-128-CBC-HMAC-SHA1Dr. Matthias St. Pierre
Fixes #7950 It was reported that there might be a null pointer dereference in the implementation of the dasync_aes_128_cbc_hmac_sha1() cipher, because EVP_aes_128_cbc_hmac_sha1() can return a null pointer if AES-NI is not available. It took some analysis to find out that this is not an issue in practice, and these comments explain the reason to comfort further NPD hunters. Detected by GitHub user @wurongxin1987 using the Sourcebrella Pinpoint static analyzer. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8305) (cherry picked from commit a4a0a1eb43cfccd128d085932a567e0482fbfe47)
2019-02-22Fix a grammar nit in CRYPTO_get_ex_new_index.podPaul Yang
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8303) (cherry picked from commit 84712024da5e5485e8397afc763555355bddf960)
2019-02-21Fix dasync engineMatt Caswell
The aes128_cbc_hmac_sha1 cipher in the dasync engine is broken. Probably by commit e38c2e8535 which removed use of the "enc" variable...but not completely. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8291) (cherry picked from commit 695dd3a332fdd54b873fd0d08f9ae720141f24cd)
2019-02-21SSL_CONF_cmd: fix doc for NoRenegotiationHubert Kario
The option is a flag for Options, not a standalone setting. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8292) (cherry picked from commit 4ac5e43da6d9ee828240e6d347c48c8fae6573a2)
2019-02-20Clear BN_FLG_CONSTTIME on BN_CTX_get()Nicola Tuveri
(cherry picked from commit c8147d37ccaaf28c430d3fb45a14af36597e48b8) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8253)
2019-02-20Test for constant-time flag leakage in BN_CTXNicola Tuveri
This commit adds a simple unit test to make sure that the constant-time flag does not "leak" among BN_CTX frames: - test_ctx_consttime_flag() initializes (and later frees before returning) a BN_CTX object, then it calls in sequence test_ctx_set_ct_flag() and test_ctx_check_ct_flag() using the same BN_CTX object. The process is run twice, once with a "normal" BN_CTX_new() object, then with a BN_CTX_secure_new() one. - test_ctx_set_ct_flag() starts a frame in the given BN_CTX and sets the BN_FLG_CONSTTIME flag on some of the BIGNUMs obtained from the frame before ending it. - test_ctx_check_ct_flag() then starts a new frame and gets a number of BIGNUMs from it. In absence of leaks, none of the BIGNUMs in the new frame should have BN_FLG_CONSTTIME set. In actual BN_CTX usage inside libcrypto the leak could happen at any depth level in the BN_CTX stack, with varying results depending on the patterns of sibling trees of nested function calls sharing the same BN_CTX object, and the effect of unintended BN_FLG_CONSTTIME on the called BN_* functions. This simple unit test abstracts away this complexity and verifies that the leak does not happen between two sibling functions sharing the same BN_CTX object at the same level of nesting. (cherry picked from commit fe16ae5f95fa86ddb049a8d1e2caee0b80b32282) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8253)
2019-02-20[test] unit test for field_inv function pointer in EC_METHODBilly Brumley
(cherry picked from commit 8f58ede09572dcc6a7e6c01280dd348240199568) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8262)
2019-02-20SCA hardening for mod. field inversion in EC_GROUPBilly Brumley
This commit adds a dedicated function in `EC_METHOD` to access a modular field inversion implementation suitable for the specifics of the implemented curve, featuring SCA countermeasures. The new pointer is defined as: `int (*field_inv)(const EC_GROUP*, BIGNUM *r, const BIGNUM *a, BN_CTX*)` and computes the multiplicative inverse of `a` in the underlying field, storing the result in `r`. Three implementations are included, each including specific SCA countermeasures: - `ec_GFp_simple_field_inv()`, featuring SCA hardening through blinding. - `ec_GFp_mont_field_inv()`, featuring SCA hardening through Fermat's Little Theorem (FLT) inversion. - `ec_GF2m_simple_field_inv()`, that uses `BN_GF2m_mod_inv()` which already features SCA hardening through blinding. From a security point of view, this also helps addressing a leakage previously affecting conversions from projective to affine coordinates. This commit also adds a new error reason code (i.e., `EC_R_CANNOT_INVERT`) to improve consistency between the three implementations as all of them could fail for the same reason but through different code paths resulting in inconsistent error stack states. Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com> (cherry picked from commit e0033efc30b0f00476bba8f0fa5512be5dc8a3f1) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8262)
2019-02-19Don't set SNI by default if hostname is not dNS nameIonut Mihalcea
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8175) (cherry picked from commit 8e981051ceecd10754f8f6d1291414a7453c8fac)
2019-02-19Fix reference to symbol 'main'.Matthias Kraft
The AIX binder needs to be instructed that the output will have no entry point (see AIX' ld manual: -e in the Flags section; autoexp and noentry in the Binder section). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8282) (cherry picked from commit c1b3846242fc1a7791beca42f548c325c35e269b)
2019-02-19Add a test for interleaving app data with handshake data in TLSv1.3Matt Caswell
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/8191) (cherry picked from commit 73e62d40eb53f2bad98dea0083c217dbfad1a335)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-10 20:06:38 +0000