summaryrefslogtreecommitdiffstats
path: root/crypto/bn
AgeCommit message (Collapse)Author
2017-12-08Standardize syntax of sizeof(foo)Rich Salz
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4876)
2017-12-06bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.Andy Polyakov
Credit to OSS-Fuzz for finding this. CVE-2017-3738 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-11-16bn/bn_add.c: address performance regression.Andy Polyakov
Performance regression was reported for EC key generation between 1.0.2 and 1.1.x [in GH#2891]. It naturally depends on platform, values between 6 and 9% were observed. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4743) (cherry picked from commit a78324d95bd4568ce2c3b34bfa1d6f14cddf92ef)
2017-11-02bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal.Andy Polyakov
Credit to OSS-Fuzz for finding this. CVE-2017-3736 Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-10-23Correct value for BN_security_bits()Matt Caswell
The function BN_security_bits() uses the values from SP800-57 to assign security bit values for different FF key sizes. However the value for 192 security bits is wrong. SP800-57 has it as 7680 but the code had it as 7690. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4546) (cherry picked from commit c9fe362303fc54ff19bde7511475f28663f7d554)
2017-10-11Ensure we test all parameters for BN_FLG_CONSTTIMEMatt Caswell
RSA_setup_blinding() calls BN_BLINDING_create_param() which later calls BN_mod_exp() as follows: BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx) ret->mod will have BN_FLG_CONSTTIME set, but ret->e does not. In BN_mod_exp() we only test the third param for the existence of this flag. We should test all the inputs. Thanks to Samuel Weiser (samuel.weiser@iaik.tugraz.at) for reporting this issue. This typically only happens once at key load, so this is unlikely to be exploitable in any real scenario. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4477) (cherry picked from commit e913d11f444e0b46ec1ebbf3340813693f4d869d)
2017-09-27BN_copy now propagates BN_FLG_CONSTTIMESamuel Weiser
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4377) (cherry picked from commit 9f9442918aeaed5dc2442d81ab8d29fe3e1fb906)
2017-09-27Fixed error in propagating BN_FLG_CONSTTIME flag through BN_MONT_CTX_set, ↵Samuel Weiser
which could lead to information disclosure on RSA primes p and q. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4377) (cherry picked from commit 3de81a5912041a70884cf4e52e7213f3b5dfa747)
2017-07-14Fix gcc-7 warnings about missing fall thru comments.Bernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3936)
2017-06-17Remove a pointless "#if 0" block from BN_mul.Bernd Edlinger
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3683) (cherry picked from commit 93a8b3ba793c769a3634e56642dac55a8d44023f)
2017-06-14Fix possible crash in X931 code.Bernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3675) (cherry picked from commit 5419dadd4bd1f7abbfa23326ca766d2c143f257c)
2017-05-11Remove dead code.Pauli
The second BN_is_zero test can never be true. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3434) (cherry picked from commit 3f97052392cb10fca5309212bf720685262ad4a6)
2017-04-22Numbers greater than 1 are usually non-negative.David Benjamin
BN_is_prime_fasttest_ex begins by rejecting if a <= 1. Then it goes to set A := abs(a), but a cannot be negative at this point. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3275) (cherry picked from commit 8b24f94209676bbe9933affd2879a686b1ed044d)
2017-03-30More typo fixesFdaSilvaYY
Backport of 69687aa829bc8bdcaf5468eb3dd0ada13700b7aa (Merged from #3069) Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3079)
2017-03-28Refomat a few comments on 80 colsFdaSilvaYY
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3066) (cherry picked from commit cbe952418376a25acd872db4281a0b09735001f1)
2017-03-24bn/asm/sparcv9-mont.pl: fix squaring code path.Andy Polyakov
This module is used only with odd input lengths, i.e. not used in normal PKI cases, on contemporary processors. The problem was "illuminated" by fuzzing tests. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 120a9e1a825bd0407639bedb1e8e15823cf7a545)
2017-03-03Reset executable bits on files where not needed.Bernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2838)
2017-02-01bn: fix occurance of negative zero in BN_rshift1()Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 0a2dcb6990dacc94337f746f4f4a6dfac1fbeac4)
2017-02-01bn: fix occurances of negative zeroGeoff Thorpe
The BIGNUM behaviour is supposed to be "consistent" when going into and out of APIs, where "consistent" means 'top' is set minimally and that 'neg' (negative) is not set if the BIGNUM is zero (which is iff 'top' is zero, due to the previous point). The BN_DEBUG testing (make test) caught the cases that this patch corrects. Note, bn_correct_top() could have been used instead, but that is intended for where 'top' is expected to (sometimes) require adjustment after direct word-array manipulation, and so is heavier-weight. Here, we are just catching the negative-zero case, so we test and correct for that explicitly, in-place. Change-Id: Iddefbd3c28a13d935648932beebcc765d5b85ae7 Signed-off-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1672) (cherry picked from commit 38d1b3cc0271008b8bd130a2c4b442775b028a08)
2017-02-01bn: catch negative zero as an errorGeoff Thorpe
Change-Id: I5ab72ad0aae9069b47d5b7b7b9e25bd1b7afa251 Signed-off-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1672) (cherry picked from commit 2fc9b36a96ccd77cbd9ecfb3a3cdaa7ad2ca305e)
2017-02-01bn: fix BN_DEBUG + BN_DEBUG_RAND supportGeoff Thorpe
Couple of updates to make this code work properly again; * use OPENSSL_assert() instead of assert() (and #include <assert.h>) * the circular-dependency-avoidance uses RAND_bytes() (not pseudo) Change-Id: Iefb5a9dd73f71fd81c1268495c54a64378955354 Signed-off-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1672) (cherry picked from commit 0b50ac1a0fe907f4effcf3f2f36dac32523938c5)
2017-01-26bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqr8x_internal.Andy Polyakov
CVE-2017-3732 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-15Don't call memcpy with NULL as sourceKurt Roeckx
Calling it with lenght 0 and NULL as source is undefined behaviour. Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #2089 (cherry picked from commit eeab356c298248108b82157ef51172ba040646f7)
2016-11-15Check return value of some BN functions.Rich Salz
Factorise multiple bn_get_top(group->field) calls Add missing checks on some conditional BN_copy return value Add missing checks on some BN_copy return value Add missing checks on a few bn_wexpand return value Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1626) (cherry picked from commit 78e09b53a40729f5e99829ccc733b592bd22fea1)
2016-11-10bn/asm/x86_64-mont.pl: fix for CVE-2016-7055 (Low severity).Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2fac86d9abeaa643677d1ffd0a139239fdf9406a)
2016-11-08Missing BN_RECP_CTX field init.FdaSilvaYY
BN_RECP_CTX_new direclty use bn_init to avoid twice memset calls Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1879) (cherry picked from commit 318447bceb3aa2c50ac0081bdb4e917f8704e7da)
2016-11-08Zero stack variable with DSA nonceRich Salz
Thanks to Falko Strenzke for bringing this to our attention. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1882) (cherry picked from commit e5e71f2857275189577ab7b227608ab4ec985471)
2016-09-13bn/bn_lcl.h: improve interoperability with clang and Android NDK.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit cc2cb7bf63c62aaebd387f546a2fd673f367d9a8)
2016-09-06Misc BN fixesRich Salz
Never output -0; make "negative zero" an impossibility. Do better checking on BN_rand top/bottom requirements and #bits. Update doc. Ignoring trailing garbage in BN_asc2bn. Port this commit from boringSSL: https://boringssl.googlesource.com/boringssl/+/899b9b19a4cd3fe526aaf5047ab9234cdca19f7d%5E!/ Ensure |BN_div| never gives negative zero in the no_branch code. Have |bn_correct_top| fix |bn->neg| if the input is zero so that we don't have negative zeros lying around. Thanks to Brian Smith for noticing. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 01c09f9fde5793e0b3712d602b02e2aed4908e8d)
2016-08-31crypto/bn/*: x86[_64] division instruction doesn't handle constants, change ↵Andy Polyakov
constraint from 'g' to 'r'. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 68b4a6e91f5acd42489bb9d1c580acc5ae457cad)
2016-08-24Remove useless assignmentMatt Caswell
The variable assignment c1 is never read before it is overwritten. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-23Fix math in BN_bn2dec comment.David Benjamin
The bound on log(2)/3 on the second line is incorrect and has an extra zero compared to the divisions in the third line. log(2)/3 = 0.10034... which is bounded by 0.101 and not 0.1001. The divisions actually correspond to 0.101 which is fine. The third line also dropped a factor of three. The actual code appears to be fine. Just the comments are wrong. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-23Check for malloc error in bn_x931p.cMatt Caswell
Ensure BN_CTX_get() has been successful Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-22bn/asm/x86[_64]-mont*.pl: implement slightly alternative page-walking.Andy Polyakov
Original strategy for page-walking was adjust stack pointer and then touch pages in order. This kind of asks for double-fault, because if touch fails, then signal will be delivered to frame above adjusted stack pointer. But touching pages prior adjusting stack pointer would upset valgrind. As compromise let's adjust stack pointer in pages, touching top of the stack. This still asks for double-fault, but at least prevents corruption of neighbour stack if allocation is to overstep the guard page. Also omit predict-non-taken hints as they reportedly trigger illegal instructions in some VM setups. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-22Fix overflow check in BN_bn2dec()Kazuki Yamaguchi
Fix an off by one error in the overflow check added by 07bed46f332fc ("Check for errors in BN_bn2dec()"). Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-16Check for errors in BN_bn2dec()Dr. Stephen Henson
If an oversize BIGNUM is presented to BN_bn2dec() it can cause BN_div_word() to fail and not reduce the value of 't' resulting in OOB writes to the bn_data buffer and eventually crashing. Fix by checking return value of BN_div_word() and checking writes don't overflow buffer. Thanks to Shi Lei for reporting this bug. CVE-2016-2182 Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-14Never return -1 from BN_expJakub Zelenka
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1455)
2016-08-10Change callers to use the new constants.Rich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1429)
2016-08-05spelling fixes, just comments and readme.klemens
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
2016-08-02Fix some style issues...FdaSilvaYY
extra spacing and 80 cols Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1366)
2016-07-20Check for errors allocating the error strings.Kurt Roeckx
Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #1330
2016-07-20Fix a few if(, for(, while( inside code.FdaSilvaYY
Fix some indentation at the same time Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1292)
2016-07-19RT4593: Add space after comma (doc nits)Rich Salz
Update find-doc-nits to find errors in SYNOPSIS (the most common place where they were missing). Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-01Simplify INCLUDE statements in build.info filesRichard Levitte
Now that INCLUDE considers both the source and build trees, no need for the rel2abs perl fragment hacks any more. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-30Convert memset calls to OPENSSL_cleanseMatt Caswell
Ensure things really do get cleared when we intend them to. Addresses an OCAP Audit issue. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-29Whitespace cleanup in cryptoFdaSilvaYY
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1264)
2016-06-25Handle BN_mod_word failures.David Benjamin
As of 37258dadaa9e36db4b96a3aa54aa6c67136160cc and the corresponding upstream change, BN_mod_word may fail, like BN_div_word. Handle this properly. Thanks to Brian Smith for pointing this out. See BoringSSL's 44bedc348d9491e63c7ed1438db100a4b8a830be. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1251
2016-06-25Fix BN_is_prime* calls.David Benjamin
This function returns a tri-state -1 on error. See BoringSSL's 53409ee3d7595ed37da472bc73b010cd2c8a5ffd. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1251
2016-06-18Useless header include of openssl/rand.hFdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1168)
2016-06-13Add some missing return value checksMatt Caswell
Some misc return value checks Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-11 14:47:11 +0000