summaryrefslogtreecommitdiffstats
path: root/crypto/bn
AgeCommit message (Collapse)Author
2023-02-07Fix Timing Oracle in RSA decryptionDmitry Belyavskiy
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. Patch written by Dmitry Belyavsky and Hubert Kario CVE-2022-4304 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-01-31Avoid duplicating symbols in legacy.a with some build optionsTomas Mraz
If no-module or no-shared is used, the symbols from libcrypto should not be duplicated in legacy.a Also the BIGNUM functions are currently not needed in legacy.a at all. Fixes #20124 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20137) (cherry picked from commit f6a6f7b6aa84dab44384780cb77050d15c5f575e)
2023-01-14Limit size of modulus for bn_mul_mont and BN_mod_exp_mont_consttimeBernd Edlinger
Otherwise the alloca can cause an exception. Issue reported by Jiayi Lin. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005) (cherry picked from commit 30667f5c306dbc11ac0e6fddc7d26fd984d546ab)
2023-01-14Revert "Limit size of modulus for BN_mod_exp_mont_consttime()"Bernd Edlinger
This reverts commit 4378e3cd2a4d73a97a2349efaa143059d8ed05e8. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005) (cherry picked from commit 92d306b32b63dd502531a89fb96c4172be0ddb49)
2023-01-09rsaz_exp_x2.c: Remove unused ALIGN64 macroTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19597) (cherry picked from commit 4b65d79d7132d6e46bfb385a76082f6502ef617b)
2023-01-09rsaz_exp_x2.c: Avoid potential undefined behavior with strict aliasingTomas Mraz
Fixes #19584 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19597) (cherry picked from commit 9506a2e274c643b94a2c265019ea9288f99a521a)
2023-01-09Revert "Fix an occasional CI failure due to unaligned access"Tomas Mraz
This reverts commit 8511520842b744d1794ea794c032ce5f78cd874b. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19597) (cherry picked from commit f83490fb9ce4dd1c09d4f94526fbcad14bd2fd85)
2023-01-04Cleanse internal BN_generate_dsa_nonce() buffers used to generate k.slontis
Fixes #9205 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19954) (cherry picked from commit 177d433bda2ffd287d676bc53b549b6c246973e6)
2022-12-01Update copyright yearTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19803)
2022-11-23crypto/*: Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY
partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - host name -> hostname - ipv6 -> IPv6 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059) (cherry picked from commit c7340583097a80a4fe42bacea745b2bbaa6d16db)
2022-11-23crypto: Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY
partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - file name -> filename - host name -> hostname Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059) (cherry picked from commit 1567a821a4616f59748fa8982724f88e542867d6)
2022-11-23Fix unrolled montgomery multiplication for POWER9Rohan McLure
In the reference C implementation in bn_asm.c, tp[num + 1] contains the carry bit for accumulations into tp[num]. tp[num + 1] is only ever assigned, never itself incremented. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18883) (cherry picked from commit 2f1112b22a826dc8854b41b60a422c987f8ddafb)
2022-11-23Revert "Revert "bn: Add fixed length (n=6), unrolled PPC Montgomery ↵Rohan McLure
Multiplication"" This reverts commit 712d9cc90e355b2c98a959d4e9398610d2269c9e. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18883) (cherry picked from commit eae70100fadbc94f18ba7a729bf065cb524a9fc9)
2022-11-23Improve FIPS RSA keygen performance.slontis
Reduce the Miller Rabin counts to the values specified by FIPS 186-5. The old code was using a fixed value of 64. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19579) (cherry picked from commit d2f6e66d2837bff1f5f7636bb2118e3a45c9df61)
2022-11-21Improve FIPS RSA keygen performance.slontis
FIPS 186-4 has 5 different algorithms for key generation, and all of them rely on testing GCD(a,n) == 1 many times. Cachegrind was showing that during a RSA keygen operation, the function BN_gcd() was taking a considerable percentage of the total cycles. The default provider uses multiprime keygen, which seemed to be much faster. This is because it uses BN_mod_inverse() instead. For a 4096 bit key, the entropy of a key that was taking a long time to generate was recorded and fed back into subsequent runs. Roughly 40% of the cycle time was BN_gcd() with most of the remainder in the prime testing. Changing to use the inverse resulted in the cycle count being 96% in the prime testing. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19578) (cherry picked from commit dd1d7bcb69994d81662e709b0ad838880b943870)
2022-11-21[crypto/bn] BN_consttime_swap: remove superfluous early exitBilly Brumley
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18518) (cherry picked from commit a644cb7c1c19c78e2ca393c8ca36989e7ca61715)
2022-11-10Limit size of modulus for BN_mod_exp_mont_consttime()Tomas Mraz
Otherwise the powerbufLen can overflow. Issue reported by Jiayi Lin. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19632) (cherry picked from commit 4378e3cd2a4d73a97a2349efaa143059d8ed05e8)
2022-11-09Fix typosDimitris Apostolou
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17392) (cherry picked from commit e304aa87b35fac5ea97c405dd3c21549faa45e78)
2022-11-09Remove some unnecessary undefs in bn_asm.cBernd Edlinger
This is likely the leftover of a previous hack, and thus should be removed now. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17259) (cherry picked from commit 17cca0e85e83eac23069ddc5c5ebab6d7dd13ee1) Reviewed-by: Hugo Landau <hlandau@openssl.org>
2022-11-09Dual 1536/2048-bit exponentiation optimization for Intel IceLake CPUAndrey Matyukov
It uses AVX512_IFMA + AVX512_VL (with 256-bit wide registers) ISA to keep lower power license. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14908) (cherry picked from commit f87b4c4ea67393c9269663ed40a7ea3463cc59d3)
2022-11-09aarch64: support BTI and pointer authentication in assemblyRuss Butler
This change adds optional support for - Armv8.3-A Pointer Authentication (PAuth) and - Armv8.5-A Branch Target Identification (BTI) features to the perl scripts. Both features can be enabled with additional compiler flags. Unless any of these are enabled explicitly there is no code change at all. The extensions are briefly described below. Please read the appropriate chapters of the Arm Architecture Reference Manual for the complete specification. Scope ----- This change only affects generated assembly code. Armv8.3-A Pointer Authentication -------------------------------- Pointer Authentication extension supports the authentication of the contents of registers before they are used for indirect branching or load. PAuth provides a probabilistic method to detect corruption of register values. PAuth signing instructions generate a Pointer Authentication Code (PAC) based on the value of a register, a seed and a key. The generated PAC is inserted into the original value in the register. A PAuth authentication instruction recomputes the PAC, and if it matches the PAC in the register, restores its original value. In case of a mismatch, an architecturally unmapped address is generated instead. With PAuth, mitigation against ROP (Return-oriented Programming) attacks can be implemented. This is achieved by signing the contents of the link-register (LR) before it is pushed to stack. Once LR is popped, it is authenticated. This way a stack corruption which overwrites the LR on the stack is detectable. The PAuth extension adds several new instructions, some of which are not recognized by older hardware. To support a single codebase for both pre Armv8.3-A targets and newer ones, only NOP-space instructions are added by this patch. These instructions are treated as NOPs on hardware which does not support Armv8.3-A. Furthermore, this patch only considers cases where LR is saved to the stack and then restored before branching to its content. There are cases in the code where LR is pushed to stack but it is not used later. We do not address these cases as they are not affected by PAuth. There are two keys available to sign an instruction address: A and B. PACIASP and PACIBSP only differ in the used keys: A and B, respectively. The keys are typically managed by the operating system. To enable generating code for PAuth compile with -mbranch-protection=<mode>: - standard or pac-ret: add PACIASP and AUTIASP, also enables BTI (read below) - pac-ret+b-key: add PACIBSP and AUTIBSP Armv8.5-A Branch Target Identification -------------------------------------- Branch Target Identification features some new instructions which protect the execution of instructions on guarded pages which are not intended branch targets. If Armv8.5-A is supported by the hardware, execution of an instruction changes the value of PSTATE.BTYPE field. If an indirect branch lands on a guarded page the target instruction must be one of the BTI <jc> flavors, or in case of a direct call or jump it can be any other instruction. If the target instruction is not compatible with the value of PSTATE.BTYPE a Branch Target Exception is generated. In short, indirect jumps are compatible with BTI <j> and <jc> while indirect calls are compatible with BTI <c> and <jc>. Please refer to the specification for the details. Armv8.3-A PACIASP and PACIBSP are implicit branch target identification instructions which are equivalent with BTI c or BTI jc depending on system register configuration. BTI is used to mitigate JOP (Jump-oriented Programming) attacks by limiting the set of instructions which can be jumped to. BTI requires active linker support to mark the pages with BTI-enabled code as guarded. For ELF64 files BTI compatibility is recorded in the .note.gnu.property section. For a shared object or static binary it is required that all linked units support BTI. This means that even a single assembly file without the required note section turns-off BTI for the whole binary or shared object. The new BTI instructions are treated as NOPs on hardware which does not support Armv8.5-A or on pages which are not guarded. To insert this new and optional instruction compile with -mbranch-protection=standard (also enables PAuth) or +bti. When targeting a guarded page from a non-guarded page, weaker compatibility restrictions apply to maintain compatibility between legacy and new code. For detailed rules please refer to the Arm ARM. Compiler support ---------------- Compiler support requires understanding '-mbranch-protection=<mode>' and emitting the appropriate feature macros (__ARM_FEATURE_BTI_DEFAULT and __ARM_FEATURE_PAC_DEFAULT). The current state is the following: ------------------------------------------------------- | Compiler | -mbranch-protection | Feature macros | +----------+---------------------+--------------------+ | clang | 9.0.0 | 11.0.0 | +----------+---------------------+--------------------+ | gcc | 9 | expected in 10.1+ | ------------------------------------------------------- Available Platforms ------------------ Arm Fast Model and QEMU support both extensions. https://developer.arm.com/tools-and-software/simulation-models/fast-models https://www.qemu.org/ Implementation Notes -------------------- This change adds BTI landing pads even to assembly functions which are likely to be directly called only. In these cases, landing pads might be superfluous depending on what code the linker generates. Code size and performance impact for these cases would be negligible. Interaction with C code ----------------------- Pointer Authentication is a per-frame protection while Branch Target Identification can be turned on and off only for all code pages of a whole shared object or static binary. Because of these properties if C/C++ code is compiled without any of the above features but assembly files support any of them unconditionally there is no incompatibility between the two. Useful Links ------------ To fully understand the details of both PAuth and BTI it is advised to read the related chapters of the Arm Architecture Reference Manual (Arm ARM): https://developer.arm.com/documentation/ddi0487/latest/ Additional materials: "Providing protection for complex software" https://developer.arm.com/architectures/learn-the-architecture/providing-protection-for-complex-software Arm Compiler Reference Guide Version 6.14: -mbranch-protection https://developer.arm.com/documentation/101754/0614/armclang-Reference/armclang-Command-line-Options/-mbranch-protection?lang=en Arm C Language Extensions (ACLE) https://developer.arm.com/docs/101028/latest Addional Notes -------------- This patch is a copy of the work done by Tamas Petz in boringssl. It contains the changes from the following commits: aarch64: support BTI and pointer authentication in assembly Change-Id: I4335f92e2ccc8e209c7d68a0a79f1acdf3aeb791 URL: https://boringssl-review.googlesource.com/c/boringssl/+/42084 aarch64: Improve conditional compilation Change-Id: I14902a64e5f403c2b6a117bc9f5fb1a4f4611ebf URL: https://boringssl-review.googlesource.com/c/boringssl/+/43524 aarch64: Fix name of gnu property note section Change-Id: I6c432d1c852129e9c273f6469a8b60e3983671ec URL: https://boringssl-review.googlesource.com/c/boringssl/+/44024 Change-Id: I2d95ebc5e4aeb5610d3b226f9754ee80cf74a9af Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16674) (cherry picked from commit 19e277dd19f2897f6a7b7eb236abe46655e575bf)
2022-10-13Fix an occasional CI failure due to unaligned accessBernd Edlinger
This happens rarely, but only because very few CI runs use the exotic CPU type that is necessary to execute anything within rsaz_exp_x2.c and enable UBSAN at the same time. crypto/bn/rsaz_exp_x2.c:562:20: runtime error: load of misaligned address 0x612000022cc6 for type 'uint64_t' (aka 'unsigned long'), which requires 8 byte alignment 0x612000022cc6: note: pointer points here 84 a3 78 e0 8e 8d 4a a5 51 9c 57 d0 d6 41 f3 26 d1 4e e1 98 42 b5 3a 9f 04 f1 73 d2 1d bf 73 44 ^ SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior crypto/bn/rsaz_exp_x2.c:562:20 in ../../util/wrap.pl ../../fuzz/server-test ../../fuzz/corpora/server => 1 not ok 2 - Fuzzing server Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19412)
2022-10-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19382)
2022-10-05Fix LLVM vs Apple LLVM version numbering confusion, for $avx512ifmaRichard Levitte
Apple LLVM has a different version numbering scheme than upstream LLVM. That makes for quite a bit of confusion. https://en.wikipedia.org/wiki/Xcode#Toolchain_versions to the rescue, they have collected quite a lot of useful data. This change is concentrated around the `$avx512ifma` flag Fixes #16670 for OpenSSL 3.0 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19352)
2022-10-04Fix error propagatation in BN_check_prime()Kazuki Yamaguchi
BN_check_prime() is supposed to return 0 for a composite number and -1 on error. Properly translate the return value of the internal function ossl_bn_miller_rabin_is_prime(), where 0 means an error. The confusion prevented BN_GENCB callbacks from aborting the primality test or key generation routines utilizing this. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19314) (cherry picked from commit 0b3867634f74f6cb7b60b3a0adde396421207214)
2022-08-17Fix memory leak in BN_rand_range()valdaarhun
The patch enables BN_rand_range() to exit immediately if BIGNUM *rnd is NULL. CLA: trivial Fixes: #18951 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18982) (cherry picked from commit 70f589ae41928edda18470ba1c3df82af02a92b3)
2022-07-05Update copyright yearRichard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> Release: yes
2022-07-05Fix bn_gcd code to check return value when calling BN_one()slontis
BN_one() uses the expand function which calls malloc which may fail. All other places that reference BN_one() check the return value. The issue is triggered by a memory allocation failure. Detected by PR #18355 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18697) (cherry picked from commit 7fe7cc57af3db1e497877f0329ba17609b2efc8b)
2022-06-23rsa: fix bn_reduce_once_in_place call for rsaz_mod_exp_avx512_x2Xi Ruoyao
bn_reduce_once_in_place expects the number of BN_ULONG, but factor_size is moduli bit size. Fixes #18625. Signed-off-by: Xi Ruoyao <xry111@xry111.site> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18626) (cherry picked from commit 4d8a88c134df634ba610ff8db1eb8478ac5fd345)
2022-06-21Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2022-06-16Add an extra reduction step to RSAZ mod_exp implementationsTomas Mraz
Inspired by BoringSSL fix by David Benjamin. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18510) (cherry picked from commit 6d702cebfce3ffd9d8c0cb2af80a987d3288e7a3)
2022-06-16Always end BN_mod_exp_mont_consttime with normal Montgomery reduction.Tomas Mraz
This partially fixes a bug where, on x86_64, BN_mod_exp_mont_consttime would sometimes return m, the modulus, when it should have returned zero. Thanks to Guido Vranken for reporting it. It is only a partial fix because the same bug also exists in the "rsaz" codepath. The bug only affects zero outputs (with non-zero inputs), so we believe it has no security impact on our cryptographic functions. The fx is to delete lowercase bn_from_montgomery altogether, and have the mont5 path use the same BN_from_montgomery ending as the non-mont5 path. This only impacts the final step of the whole exponentiation and has no measurable perf impact. See the original BoringSSL commit https://boringssl.googlesource.com/boringssl/+/13c9d5c69d04485a7a8840c12185c832026c8315 for further analysis. Original-author: David Benjamin <davidben@google.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18510) (cherry picked from commit 0ae365e1f80648f4c52aa3ac9bbc279b6192b23e)
2022-06-15Revert "bn: Add fixed length (n=6), unrolled PPC Montgomery Multiplication"Tomas Mraz
This reverts commit 0d40ca47bd86e74a95c3a2f5fb6c67cdbee93c79. It was found that the computation produces incorrect results in some cases. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18512) (cherry picked from commit 712d9cc90e355b2c98a959d4e9398610d2269c9e)
2022-06-13RSA keygen update: Raise an error if no prime candidate q is found.slontis
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18429) (cherry picked from commit d2399d8cd29f56e6614f0b3db4e7e563a745902a)
2022-06-13RSA keygen fixesslontis
Fixes #18321 Increase the iteration factor used when 'Computing a Probable Prime Factor Based on Auxiliary Primes' from 5 to 20. This matches the algorithm update made in FIPS 186-5. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18429) (cherry picked from commit ad7e0fd550a9eb2946edf38003ebc6d5b988dac7)
2022-05-24Rename x86-32 assembly files from .s to .S.Sebastian Andrzej Siewior
Rename x86-32 assembly files from .s to .S. While processing the .S file gcc will use the pre-processor whic will evaluate macros and ifdef. This is turn will be used to enable the endbr32 opcode based on the __CET__ define. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18353) (cherry picked from commit 9968c77539d6f7c5b1dcf0162fd4b57c144318c7)
2022-05-10bn_nist: fix strict aliasing problemPauli
As of clang-14 the strict aliasing is causing code to magically disappear. By explicitly inlining the code, the aliasing problem evaporates. Fixes #18225 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18258) (cherry picked from commit 8712db5e4e0c508de10e887aebf639384dc20710)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-04-07Fix failure to check result of bn_rshift_fixed_topHugo Landau
Fixes #18010. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18034) (cherry picked from commit bc6bac8561ead83d6135f376ffcbbb0b657e64fe)
2022-03-23Fix Coverity 1201763 uninitialised pointer readPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17890) (cherry picked from commit a0238b7ed87998c48b1c92bad7fa82dcbba507f9)
2022-03-15Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-03-15Fix possible infinite loop in BN_mod_sqrt()Tomas Mraz
The calculation in some cases does not finish for non-prime p. This fixes CVE-2022-0778. Based on patch by David Benjamin <davidben@google.com>. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 9eafb53614bf65797db25f467946e735e1b43dc9)
2022-03-03Fix NULL pointer dereference for BN_mod_exp2_montHugo Landau
This fixes a bug whereby BN_mod_exp2_mont can dereference a NULL pointer if BIGNUM argument m represents zero. Regression test added. Fixes #17648. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17783) (cherry picked from commit 43135a5d2274c24e97f50e16ce492c22eb717ab2)
2022-01-17bn_ppc.c: Fix build failure on AIX with XLC/XLCLANGTomas Mraz
These compilers define _ARCH_PPC64 for 32 bit builds so we cannot depend solely on this define to identify 32 bit build. Fixes #17087 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17497) (cherry picked from commit cfbb5fcf4424395a1a23751556ea12c56b80b57e)
2022-01-06Fix copyright year issuesBernd Edlinger
Fixes: #13765 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17427) (cherry picked from commit fd84b9c3e94be1771d1b34ad857081f7693318aa)
2022-01-03Update troublesome copyright years of auto-generated files to 2022Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17398) (cherry picked from commit 0088ef48c3e7d9c68e5b3c75cb077da601d22f37)
2021-12-23Add static check in BN_hex2bnKan
Fixes #17298 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17299) (cherry picked from commit 7c78bd4be810ddceb8f13585a921946cc98f5fbd)
2021-12-21rsa exp: move declarations before code (3.0)Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17305)
2021-12-20Fix the null pointer dereferenceKan
Fixes #17296 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17297) (cherry picked from commit f050745fe69a538952f3e12af3718d19ef2df2e2)
2021-12-14Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-14 18:43:31 +0000