summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2020-04-21Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2020-04-18Add AES consttime code for no-asm configurationsBernd Edlinger
This adds optional constant time support for AES when building openssl for no-asm. Enable with: ./config no-asm -DOPENSSL_AES_CONST_TIME [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11411)
2020-04-17Windows: Add type casting in CRYPTO_atomic_add to remove warningKochise
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11337) (cherry picked from commit 7da7b27eec58d1efc7012f002c45ddbdd61a5e79)
2020-04-14BIO_do_accept: correct error return valuescott
`BIO_do_accept` was returning incorrect values when unable to bind to a port. Fixes #7717 CLA: trivial Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11505) (cherry picked from commit 0437435a960123be1ced766d18d715f939698345)
2020-04-11Add manpage entry for X509_check_purpose()Jake Maynard
Fixes #10263 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10301) (cherry picked from commit eacd30a703b52f5b3e8e70b58f99bd1128458c7c)
2020-04-09Fix AES-CTR_DRBG on 1.1.1.Pauli
The backport of the timing information leak fix uses u32 which is defined in crypto/modes/modes_local.h in 1.1.1 and include/crypto/modes.h for 3.0. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11489)
2020-04-08AES CTR-DRGB: do not leak timing informationPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11147) (cherry picked from commit 069165d10646a22000c596095cc04d43bbf1f807)
2020-04-08Integer overflow in ASN1_STRING_set.Pauli
Addressing a potential integer overflow condition. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11473) (cherry picked from commit 96218269f4c2da82f143727fb7697d572c190bc5)
2020-04-07[crypto/ec] blind coordinates in ec_wNAF_mul for robustnessBilly Brumley
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Nicola Tuveri <nicola.tuveri@ibm.com> (Merged from https://github.com/openssl/openssl/pull/11439) (cherry picked from commit c61ced5ec50fc68707c7cea79f7df1d170f03f13)
2020-04-07Fix the error handling in EC_POINTs_mulBernd Edlinger
This was pointed out by a false-positive -fsanitizer warning ;-) However from the cryptographical POV the code is wrong: A point R^0 on the wrong curve is infinity on the wrong curve. [extended tests] Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11475) (cherry picked from commit 1eb9b54af7e00fa12196411964ce742ea8677766)
2020-04-07Ensure ECDSA_size always returns >= 0William Brawner
Fixes #10484 Signed-off-by: William Brawner <me@wbrawner.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11472)
2020-04-06Set X509_V_ERR_INVALID_EXTENSION error for invalid basic constraintsTomas Mraz
If we encounter certificate with basic constraints CA:false, pathlen present and X509_V_FLAG_X509_STRICT is set we set X509_V_ERR_INVALID_EXTENSION error. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463) (cherry picked from commit fa86e2ee3533bb7fa9f3c62c38920cf960e9fec0)
2020-04-06Allow certificates with Basic Constraints CA:false, pathlen:0Tomas Mraz
Do not mark such certificates with EXFLAG_INVALID although they violate the RFC 5280, they are syntactically correct and openssl itself can produce such certificates without any errors with command such as: openssl x509 -req -signkey private.pem -in csr.pem -out cert.pem \ -extfile <(echo "basicConstraints=CA:FALSE,pathlen:0") With the commit ba4356ae4002a04e28642da60c551877eea804f7 the EXFLAG_INVALID causes openssl to not consider such certificate even as leaf self-signed certificate which is breaking existing installations. Fixes: #11456 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11463) (cherry picked from commit 428cf5ff83a48d0b51c97476586b2cbd053b6302)
2020-04-01[crypto/ec] Ladder tweaksBilly Brumley
- Convert to affine coords on ladder entry. This lets us use more efficient ladder step formulae. - Convert to affine coords on ladder exit. This prevents the current code awkwardness where conversion happens twice during serialization: first to fetch the buffer size, then again to fetch the coords. - Instead of projectively blinding the input point, blind both accumulators independently. (cherry picked from commit a4a93bbfb0e679eaa249f77c7c4e7e823ca870ef) Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11435)
2020-03-31Update copyright yearMatt Caswell
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11445)
2020-03-25Partially revert "Detect EOF while reading in libssl"Tomas Mraz
This partially reverts commit db943f43a60d1b5b1277e4b5317e8f288e7a0a3a. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11400)
2020-03-22Fix error handling in x509v3_cache_extensions and related functionsBernd Edlinger
Basically we use EXFLAG_INVALID for all kinds of out of memory and all kinds of parse errors in x509v3_cache_extensions. [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10756)
2020-03-20Coverity: fix two minor NPD issues.FdaSilvaYY
Found by Coverity. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8274) (cherry picked from commit 23dc8feba817560485da00d690d7b7b9e5b15682)
2020-03-19Merge probable_prime_dh_safe with bn_probable_prime_dhBernd Edlinger
This should avoid half of the trial divisions in probable_prime_dh_safe and avoid bn_probable_prime_dh generating primes with special properties. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9387)
2020-03-19Add a parameter to probable_prime if we look for a safe primeBernd Edlinger
Currently probable_prime makes sure that p-1 does not have any prime factors from 3..17863, which is useful for safe primes, but not necessarily for the general case. Issue was initially reported here: MIRONOV, I. Factoring RSA Moduli II. https://windowsontheory.org/2012/05/17/factoring-rsa-moduli-part-ii/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9387)
2020-03-17Update copyright yearMatt Caswell
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11344)
2020-03-13Code to thread-safety in ChangeCipherStateBenjamin Kaduk
The server-side ChangeCipherState processing stores the new cipher in the SSL_SESSION object, so that the new state can be used if this session gets resumed. However, writing to the session is only thread-safe for initial handshakes, as at other times the session object may be in a shared cache and in use by another thread at the same time. Reflect this invariant in the code by only writing to s->session->cipher when it is currently NULL (we do not cache sessions with no cipher). The code prior to this change would never actually change the (non-NULL) cipher value in a session object, since our server enforces that (pre-TLS-1.3) resumptions use the exact same cipher as the initial connection, and non-abbreviated renegotiations have produced a new session object before we get to this point. Regardless, include logic to detect such a condition and abort the handshake if it occurs, to avoid any risk of inadvertently using the wrong cipher on a connection. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10943) (cherry picked from commit 2e3ec2e1578977fca830a47fd7f521e290540e6d)
2020-03-11Revert "Stop accepting certificates signed using SHA1 at security level 1"Matt Caswell
This reverts commit 68436f0a8964e911eb4f864bc8b31d7ca4d29585. The OMC did not vote in favour of backporting this to 1.1.1, so this change should be reverted. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11282)
2020-03-05crypto/ec/curve448/eddsa.c: fix EBCDIC platformsPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11229) (cherry picked from commit af7f656cd91d99d62567e2b20c61f07cb4d81d0b)
2020-03-05aes-s390x.pl: fix stg offset caused by typo in perlasmPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11234) (cherry picked from commit 7b2ce4a6e817e4385ff77fea0c6e349294c7b756)
2020-03-05This works around a gcc-9 crashBernd Edlinger
It happens when configured with ./config -ftest-coverage see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94029 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11246)
2020-02-28Fix comment placement in ecp_nistp256.ciScott Arciszewski
CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/11175) (cherry picked from commit c590be6f12d0b725863961e41bc64a81c8cf30d6)
2020-02-20Teach more BIOs how to handle BIO_CTRL_EOFMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10882)
2020-02-20Detect EOF while reading in libsslMatt Caswell
If we hit an EOF while reading in libssl then we will report an error back to the application (SSL_ERROR_SYSCALL) but errno will be 0. We add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. Contains a partial fix for #10880 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10882)
2020-02-17Do not silently truncate files on perlasm errorsDavid Benjamin
If one of the perlasm xlate drivers crashes, OpenSSL's build will currently swallow the error and silently truncate the output to however far the driver got. This will hopefully fail to build, but better to check such things. Handle this by checking for errors when closing STDOUT (which is a pipe to the xlate driver). This is the OpenSSL 1.1.1 version of https://github.com/openssl/openssl/pull/10883 and https://github.com/openssl/openssl/pull/10930. Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Paul Dale David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/10931)
2020-02-15VMS: Correct error reporting in crypto/rand/rand_vms.cRichard Levitte
The future style that's coming with OpenSSL 3.0 was used, we need to revert that back to "traditional" style. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11088)
2020-02-12Forgotten GOST2012 support in non-vital placesNikolay Morozov
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11072)
2020-02-06Avoid leak in error path of PKCS5_PBE_keyivgenkinichiro
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10816) (cherry picked from commit adc9086beb21a91ca59aaf0c619b38b82c223f9b)
2020-02-06Coverity CID 1444960: Error handling issuesPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8888) (cherry picked from commit a05bf83c7964bb3928b323fe356b9f70f105036d)
2020-02-06Fix misspelling errors and typos reported by codespellDr. Matthias St. Pierre
Fixes #10998 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11000)
2020-02-05Stop accepting certificates signed using SHA1 at security level 1Kurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #10786 (cherry picked from commit b744f915ca8bb37631909728dd2529289bda8438)
2020-01-21Remove remaining references to crypto/includeBernd Edlinger
Configure creates an empty crypto/include which gets not cleaned up with make distclean. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10893)
2020-01-20Fix unwind info in crypto/rc4/asm/rc4-x86_64.plH.J. Lu
Move .cfi_startproc to the right place for RC4. Add missing .cfi_startproc and .cfi_endproc to RC4_options. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10872) (cherry picked from commit 967ef73013becef2aec3439f8c45204b24121018)
2020-01-17For all assembler scripts where it matters, recognise clang > 9.xRichard Levitte
Fixes #10853 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10857)
2020-01-14Avoid leak in error path of asn1_parse2kinichiro
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10794) (cherry picked from commit 6a165fab239ec5b00b3cd68169a63b509207177d)
2020-01-07Revert "Move random-related defines from e_os.h to rand_unix.c"Dr. Matthias St. Pierre
This reverts commit 7b18d1a53f932391bbc599a4717d6f98a597849c, which moved the DEVRANDOM and DEVRANDOM_EGD defines into rand_unix.c. That change introduced the regression that the compiler complains about missing declarations in apps/version.c when OpenSSL is configured using `--with-rand-seed=devrandom` (resp. `--with-rand-seed=egd`): apps/version.c:173:42: error: 'DEVRANDOM' undeclared static const char *dev[] = { DEVRANDOM, NULL }; ^~~~~~~~~ Fixes #10759 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10764)
2020-01-07Don't store an HMAC key for longer than we needMatt Caswell
The HMAC_CTX structure stores the original key in case the ctx is reused without changing the key. However, HMAC_Init_ex() checks its parameters such that the only code path where the stored key is ever used is in the case where HMAC_Init_ex is called with a NULL key and an explicit md is provided which is the same as the md that was provided previously. But in that case we can actually reuse the pre-digested key that we calculated last time, so we can refactor the code not to use the stored key at all. With that refactor done it is no longer necessary to store the key in the ctx at all. This means that long running ctx's will not keep the key in memory for any longer than required. Note though that the digested key *is* still kept in memory for the duration of the life of the ctx. Fixes #10743 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10763)
2020-01-05Fix incorrect return code on ECDSA key verificationAndrew Hoang
ECDSA_do_verify() is a function that verifies a ECDSA signature given a hash and a public EC key. The function is supposed to return 1 on valid signature, 0 on invalid signature and -1 on error. Previously, we returned 0 if the key did not have a verify_sig method. This is actually an error case and not an invalid signature. Consequently, this patch updates the return code to -1. Fixes #8766 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10693) (cherry picked from commit 26583f6aa8dc28e3598e61db66e54e2fdf8b195f)
2020-01-05Fix side channel in ecp_nistz256-armv8.plFangming.Fang
This change addresses a potential side-channel vulnerability in the internals of nistz256 low level operations for armv8. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit f5a659b6dfcc735a62c712dcca64d116d2289b97)
2020-01-05Fix side channel in the ecp_nistz256.c reference implementationBernd Edlinger
This is only used if configured with ./config -DECP_NISTZ256_REFERENCE_IMPLEMENTATION Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit 7d4716648e8348dea862e198b9395478fae01907)
2020-01-05Improve side channel fix in ecp_nistz256-x86_64.plBernd Edlinger
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit e9fe87950db2e6169029b2ecf3ed09d64265bc9c)
2020-01-05Fix side channel in ecp_nistz256-armv4.plBernd Edlinger
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit 3d139746ca72f0906c036d0a4a3e176c7b61ed1b)
2020-01-05Fix side channel in ecp_nistz256-x86.plBernd Edlinger
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit 0de3399b691f025153c8001045d5eeb0909dfd7a)
2020-01-05Avoid leaking intermediate states in point doubling special case.David Benjamin
Cherry picked from https://github.com/google/boringssl/commit/12d9ed670da3edd64ce8175cfe0e091982989c18 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit 2baea7c7e0896658b74956cac6084dd7e82e8c1b)
2020-01-05Fix potential SCA vulnerability in some EC_METHODsNicola Tuveri
This commit addresses a potential side-channel vulnerability in the internals of some elliptic curve low level operations. The side-channel leakage appears to be tiny, so the severity of this issue is rather low. The issue was reported by David Schrammel and Samuel Weiser. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9239) (cherry picked from commit 3cb914c463ed1c9e32cfb773d816139a61b6ad5f)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-11 13:32:47 +0000