summaryrefslogtreecommitdiffstats
path: root/crypto/evp
AgeCommit message (Collapse)Author
2020-06-16EVP: allow empty strings to EVP_Decode* functionsRichard Levitte
This is a simple check order correction. Fixes #12143 Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12144) (cherry picked from commit 0800288e6e1d9f44d471043a970ba57743ca8f4c)
2020-05-08Remove AES bitsliced S-box implementation from Boyar and PeraltaBernd Edlinger
[extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11626)
2020-04-18Add AES consttime code for no-asm configurationsBernd Edlinger
This adds optional constant time support for AES when building openssl for no-asm. Enable with: ./config no-asm -DOPENSSL_AES_CONST_TIME [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11411)
2020-03-17Update copyright yearMatt Caswell
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11344)
2020-02-06Avoid leak in error path of PKCS5_PBE_keyivgenkinichiro
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10816) (cherry picked from commit adc9086beb21a91ca59aaf0c619b38b82c223f9b)
2020-02-06Coverity CID 1444960: Error handling issuesPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8888) (cherry picked from commit a05bf83c7964bb3928b323fe356b9f70f105036d)
2020-02-06Fix misspelling errors and typos reported by codespellDr. Matthias St. Pierre
Fixes #10998 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11000)
2019-12-16Ensure EVP_PKEY_set1_DH detects X9.42 keysMatt Caswell
OpenSSL supports both PKCS#3 and X9.42 DH keys. By default we use PKCS#3 keys. The function `EVP_PKEY_set1_DH` was assuming that the supplied DH key was a PKCS#3 key. It should detect what type of key it is and assign the correct type as appropriate. Fixes #10592 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10593) (cherry picked from commit 32c869ffaba67822602ea9fec611272ff8e8db58)
2019-12-11Fix some typosVeres Lajos
Reported-by: misspell-fixer <https://github.com/vlajos/misspell-fixer> CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10544) (cherry picked from commit 79c44b4e3044aee9dc9618850d4f1ce067757b4b)
2019-11-29EVP_*Update: ensure that input NULL with length 0 isn't passedMatt Caswell
Even with custom ciphers, the combination in == NULL && inl == 0 should not be passed down to the backend cipher function. The reason is that these are the values passed by EVP_*Final, and some of the backend cipher functions do check for these to see if a "final" call is made. An exception is made for CCM mode which has special handling for the case where inl == 0: this may mean the total plaintext or ciphertext length is 0. This is based on an original commit by Richard Levitte. Fixes #8675 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9057)
2019-11-21EVP p_lib: Add NULL check to EVP_PKEY_missing_parameters.Pauli
Check for NULL and return error if so. This can possibly be called from apps/ca.c with a NULL argument. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/10474) (cherry picked from commit ab5c77b4766e0992751d86560193ca42b49cf316)
2019-11-20Allow specifying the tag after AAD in CCM mode (2)Patrick Steuer
In addition to 67c81ec3 which introduced this behavior in CCM mode docs but only implemented it for AES-CCM. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10331) (cherry picked from commit f7382fbbd846dd3bdea6b8c03b6af22faf0ab94f) Conflicts: test/recipes/30-test_evp_data/evpciph.txt
2019-11-17Add missing EVP_PKEY_METHOD accessors for digestsign and digestverifyAnthony Hu
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10388) (cherry picked from commit 2555285fa5e4248ad4a5a0bc14ae4606443856c2)
2019-10-28Allow EVP_PKEY_get0_RSA for RSA-PSS keysTobias Nießen
RSA-PSS keys use the same internal structure as RSA keys but do not allow accessing it through EVP_PKEY_get0_RSA. This commit changes that behavior. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10217) (cherry picked from commit 465a58b117d5a85623f3998d6fbf2fe8712a5604)
2019-10-03Define AESNI_ASM if AESNI assembler is included, and use itRichard Levitte
Because we have cases where basic assembler support isn't present, but AESNI asssembler support is, we need a separate macro that indicates that, and use it. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10080)
2019-10-03Fix iOS simulator buildBernd Edlinger
Fixes #9999 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10002)
2019-09-27Reorganize local header filesDr. Matthias St. Pierre
Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9681)
2019-09-27Reorganize private crypto header filesDr. Matthias St. Pierre
Currently, there are two different directories which contain internal header files of libcrypto which are meant to be shared internally: While header files in 'include/internal' are intended to be shared between libcrypto and libssl, the files in 'crypto/include/internal' are intended to be shared inside libcrypto only. To make things complicated, the include search path is set up in such a way that the directive #include "internal/file.h" could refer to a file in either of these two directoroes. This makes it necessary in some cases to add a '_int.h' suffix to some files to resolve this ambiguity: #include "internal/file.h" # located in 'include/internal' #include "internal/file_int.h" # located in 'crypto/include/internal' This commit moves the private crypto headers from 'crypto/include/internal' to 'include/crypto' As a result, the include directives become unambiguous #include "internal/file.h" # located in 'include/internal' #include "crypto/file.h" # located in 'include/crypto' hence the superfluous '_int.h' suffixes can be stripped. The files 'store_int.h' and 'store.h' need to be treated specially; they are joined into a single file. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9681)
2019-09-10Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9847)
2019-09-07Remove x86/x86_64 BSAES and AES_ASM supportBernd Edlinger
This leaves VPAES and AESNI support. The VPAES performance is comparable but BSAES is not completely constant time. There are table lookups using secret key data in AES_set_encrypt/decrypt_key and in ctr mode short data uses the non-constant time AES_encrypt function instead of bit-slicing. Furthermore the AES_ASM is by far outperformed by recent GCC versions. Since BSAES calls back to AES_ASM for short data blocks the performance on those is also worse than the pure software implementaion. Fixes: #9640 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9675)
2019-08-18Directly return from final sha3/keccak_final if no bytes are requestedPatrick Steuer
Requesting zero bytes from shake previously led to out-of-bounds write on some platforms. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9433) (cherry picked from commit a890ef833d114da3430c2f2efd95e01714704d34)
2019-08-08Change EVP_CIPHER_CTX_iv_length() to return current ivlen for some modesShane Lontis
Note a flag needed to be added since some ssl tests fail if they output any error (even if the error is ignored). Only ciphers that handle the GET_IV_LEN control set this flag. Fixes #8330 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9499)
2019-07-01Ensure that rc5 doesn't try to use a key longer than 2040 bitsMatt Caswell
The maximum key length for rc5 is 2040 bits so we should not attempt to use keys longer than this. Issue found by OSS-Fuzz and Guido Vranken. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8834) (cherry picked from commit 792cb4ee8d82e4b063f707fc9f4992271ffd65ab)
2019-07-01Fix TyposAntoine Cœur
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9275)
2019-06-25Excise AES-XTS FIPS check.Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9255)
2019-06-24Allow AES XTS decryption using duplicate keys.Pauli
This feature is enabled by default outside of FIPS builds which ban such actions completely. Encryption is always disallowed and will generate an error. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9112) (cherry picked from commit 2c840201e57e27fa9f1b26a970270a91813e32fe)
2019-05-28Update copyright yearRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9034)
2019-05-22s390x assembly pack: allow specifying the tag after aad in aes-ccmPatrick Steuer
67c81ec311 forgot about s390x Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8971) (cherry picked from commit 887e22dd8b6f054e39b2d20fc8870eaba7fc61a8)
2019-05-21Revert "EVP_*Update: ensure that input NULL with length 0 isn't passed"Matt Caswell
This reverts commit dcb982d792d6064ed3493e79749208d8c257ff04. This change is causing extended tests to fail. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8964) (cherry picked from commit 2c23689402f1894861519d0c1ad762a3e52f4677)
2019-05-08Allow specifying the tag after AAD in CCM modeTobias Nießen
This change allows to pass the authentication tag after specifying the AAD in CCM mode. This is already true for the other two supported AEAD modes (GCM and OCB) and it seems appropriate to match the behavior. GCM and OCB also support to set the tag at any point before the call to `EVP_*Final`, but this won't work for CCM due to a restriction imposed by section 2.6 of RFC3610: The tag must be set before actually decrypting data. This commit also adds a test case for setting the tag after supplying plaintext length and AAD. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7243) (cherry picked from commit 67c81ec311d696464bdbf4c6d6f8a887a3ddf9f8)
2019-04-10EVP_*Update: ensure that input NULL with length 0 isn't passedRichard Levitte
Even with custome ciphers, the combination in == NULL && inl == 0 should not be passed down to the backend cipher function. The reason is that these are the values passed by EVP_*Final, and some of the backend cipher functions do check for these to see if a "final" call is made. Fixes #8675 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8676) (cherry picked from commit dcb982d792d6064ed3493e79749208d8c257ff04)
2019-04-06Fix the allocation size in EVP_OpenInit and PEM_SignFinalBernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8620) (cherry picked from commit 8cf85d489978c384a3f193fb7cb25469e0559f27)
2019-03-27Fix a memory leak in ARIA GCMMatt Caswell
Fixes #8567 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8586) (cherry picked from commit 183f52e29af27285ea4ed7c947b71c83618f8702)
2019-03-27Tolerate 0 byte input length for Update functionsMatt Caswell
We treat that as automatic success. Other EVP_*Update functions already do this (e.g. EVP_EncryptUpdate, EVP_DecryptUpdate etc). EVP_EncodeUpdate is a bit of an anomoly. That treats 0 byte input length as an error. Fixes #8576 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8587) (cherry picked from commit a8274ea351988aa754cb9983b27d7059613ee11e)
2019-03-21Providing missing accessor to EVP_PKEY.engineDmitry Belyavskiy
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8526)
2019-03-06Prevent over long nonces in ChaCha20-Poly1305Matt Caswell
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. CVE-2019-1543 Fixes #8345 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit 2a3d0ee9d59156c48973592331404471aca886d6)
2018-12-23EVP_PKEY_size declared to take a const parameterShreya Bhandare
CLA: trivial Function EVP_PKEY_size has been modified to take a const parameter Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7892) (cherry picked from commit 47ec2367ebf6082abb103e66e609feb5c128d358)
2018-12-10make updateRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7852) (cherry picked from commit f2f734d4f9e34643a1d3e5b79d2447cd643519f8)
2018-12-10Prevent calling decryption in an encryption context and vice versaRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7852) (cherry picked from commit a8bf2f8f24bda57c860e4356f31264fff63fe8b9)
2018-11-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7669)
2018-10-02Fix some Coverity warningsMatt Caswell
Check some return values on some functions. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7335) (cherry picked from commit 434893af2bd4c1fa72655f8e5262c8a432713968)
2018-09-21typo-fixes: miscellaneous typo fixesagnosticdev
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7277) (cherry picked from commit 46d085096c6ead624c61e4b8b301421301511e64)
2018-09-13Make some return checks consistent with othersPaul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7209)
2018-09-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7176)
2018-09-07Allow EVP_MD_CTX_set_pkey_ctx to accept NULL pctxPaul Yang
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7113)
2018-09-07Update document for SM2 stuffsPaul Yang
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7113)
2018-09-07Support setting SM2 IDPaul Yang
zero-length ID is allowed, but it's not allowed to skip the ID. Fixes: #6534 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7113)
2018-09-07Support pmeth->digest_customPaul Yang
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7113)
2018-09-07Introduce EVP_MD_CTX_set_pkey_ctxPaul Yang
Thus users can use this function to set customized EVP_PKEY_CTX to EVP_MD_CTX structure. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7113)
2018-09-07Avoid SEGV when giving X509_sign a NULL private key.Pauli
Put a NULL check back in to avoid dereferencing the NULL pointer. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7146)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-24 19:04:06 +0000