Age | Commit message (Collapse) | Author |
|
Add description of "allocate and encode" operation for ASN1 routines.
Document how versioning will for after the letter release reaches
y.
(cherry picked from commit 2527b94fec345c0bec58f4c7a810b7b8d0552b17)
|
|
The version check for DTLS1_VERSION was redundant as
DTLS1_VERSION > TLS1_1_VERSION, however we do need to
check for DTLS1_BAD_VER for compatibility.
PR:2984
(cherry picked from commit d980abb22e22661e98e5cee33d760ab0c7584ecc)
|
|
(cherry picked from commit cbf9b4aed3e209fe8a39e1d6f55aaf46d1369dc4)
|
|
(cherry picked from commit f88dbb8385c199a2a28e9525c6bba3a64bda96af)
|
|
(cherry picked from commit 3caeef94bd045608af03b061643992e3afd9c445)
|
|
(cherry picked from commit f93a41877d8d7a287debb7c63d7b646abaaf269c)
|
|
|
|
(cherry picked from commit 8545f73b8919770a5d012fe7a82d6785b69baa27)
|
|
Fix the calculation that checks there is enough room in a record
after removing padding and optional explicit IV. (by Steve)
For AEAD remove the correct number of padding bytes (by Andy)
(cherry picked from commit 32cc2479b473c49ce869e57fded7e9a77b695c0d)
|
|
MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.
(cherry picked from commit f306b87d766e6ecf30824635c7c395b67cff9dbc)
|
|
It also ensures that valgring is happy.
(cherry picked from commit 2141e6f30b1fd2906830fd23d8eae71fe72acc47)
|
|
(cherry picked from commit 529d27ea472fc2c7ba9190a15a58cb84012d4ec6)
|
|
Address CBC decrypt timing issues and reenable the AESNI+SHA1 stitch.
(cherry picked from commit 125093b59f3c2a2d33785b5563d929d0472f1721)
|
|
Kludge alert. This is arranged by passing padding length in unused
bits of SSL3_RECORD->type, so that orig_len can be reconstructed.
(cherry picked from commit 8bfd4c659f180a6ce34f21c0e62956b362067fba)
|
|
(cherry picked from commit 04e45b52ee3be81121359cc1198fd01e38096e9f)
|
|
(cherry picked from commit d5371324d978e4096bf99b9d0fe71b2cb65d9dc8)
|
|
RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.
(cherry picked from commit 36260233e7e3396feed884d3f501283e0453c04f)
|
|
Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
(cherry picked from commit cab13fc8473856a43556d41d8dac5605f4ba1f91)
|
|
(cherry picked from commit 34ab3c8c711ff79c2b768f0b17e4b2a78fd1df5d)
|
|
branches it needs to be in a "gap".
(cherry picked from commit 81ce0e14e72e8e255ad1bd9c7cfaa47a6291919c)
|
|
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.
Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
to cover any timing differences caused by removal of padding.
(cherry picked from commit b908e88ec15aa0a74805e3f2236fc4f83f2789c2)
|
|
(cherry picked from commit 014265eb02e26f35c8db58e2ccbf100b0b2f0072)
|
|
This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
(cherry picked from commit 9f27de170d1b7bef3d46d41382dc4dafde8b3900)
|
|
The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
(cherry picked from commit 6cb19b7681f600b2f165e4adc57547b097b475fd)
|
|
This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.
This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.
In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
(cherry picked from commit e130841bccfc0bb9da254dc84e23bc6a1c78a64e)
|
|
This change adds CRYPTO_memcmp, which compares two vectors of bytes in
an amount of time that's independent of their contents. It also changes
several MAC compares in the code to use this over the standard memcmp,
which may leak information about the size of a matching prefix.
(cherry picked from commit 2ee798880a246d648ecddadc5b91367bee4a5d98)
|
|
OpenSSL_1_0_2-stable
|
|
encrypted premaster secret value.
(cherry picked from commit ea34a58385058748c51037bfb2c3208ee639f5f1)
|
|
(cherry picked from commit 134c00659a1bc67ad35a1e4620e16bc4315e6e37)
|
|
PR: 2963 and a number of others
(cherry picked from commit 4568182a8b8cbfd15cbc175189029ac547bd1762)
|
|
|
|
|
|
PR: 2963 and a number of others
|
|
|
|
|
|
|
|
|
|
OpenSSL_1_0_2-stable
|
|
|
|
|
|
Submitted by: Dmitry Belyavsky, Seguei Leontiev
PR: 2821
|
|
|
|
|
|
|
|
Just a sample, real world applications would have to be cleverer.
|
|
|
|
|
|
|
|
|
|
|