summaryrefslogtreecommitdiffstats
path: root/providers/implementations/ciphers
AgeCommit message (Collapse)Author
2021-09-07Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16534)
2021-08-26aes-wrap: improve error handlingPauli
The AES wrap cipher was return -1 on error from the provider rather than 0. This is fixed. There was a problem with the error handling in AES wrap which fell back to a default "final error". This adds a fix for the error and more specific errors for the different failure possibilities. Fixes #16387 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16391)
2021-08-18Fix CTS cipher decrypt so that the updated IV is returned correctly.Shane Lontis
Adding KRB5 test vector 'NextIV' values to evp_test data for AES CTS indicated that the CTS decrypt functions incorrectly returned the wrong IV. The returned IV should match the value returned by the encrypt methods. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16286)
2021-08-18Change CTS CS3 (Kerberos) so that it accepts a 16 byte input blockShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16286)
2021-08-18Add support for camellia cbc cts modeShane Lontis
Fixes #16276 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16286)
2021-08-18Refactor cipher aes_cts code so that it can be used by other 128bit ciphersShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16286)
2021-07-14Remove lower limit on GCM mode ciphersPauli
Fixes #16057 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16064)
2021-06-17Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15801)
2021-06-16Correct processing of AES-SHA stitched ciphersDmitry Belyavskiy
Fixes: #15706 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15740)
2021-06-08Add a gettable for provider ciphers to return the EVP_CIPH_RAND_KEY flagShane Lontis
Fixes #15531 DES and TDES set this flag which could possibly be used by applications. The gettable cipher param OSSL_CIPHER_PARAM_HAS_RAND_KEY has been added. Note that EVP_CIPHER_CTX_rand_key() uses this flag. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15606)
2021-06-08Fix CipherInit on s390x.Juergen Christ
Various different initialization sequences led to bugs on s390x due to caching and processing during key setting. Since, e.g., the direction does not necessarily have to be correct during initialization, this produced bugs in s390x which were not present on other architectures. Fix this by recomputing the function codes on the fly during updates and final operations. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15521)
2021-06-04Move libssl related defines used by fips provider to prov_ssl.hTomas Mraz
This nicely reduces the number of files considered as fips provider sources. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15609)
2021-06-01Fix param indentation in ciphercommon_hw.cShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15496)
2021-06-01Fix aes cfb1 so that it can operate in bit mode.Shane Lontis
The code to handle the cipher operation was already in the provider. It just needed a OSSL_PARAM in order to set this into the algorithm. EVP_CIPHER_CTX_set_flags() has been modified to pass the OSSL_PARAM. Issue reported by Mark Powers from Acumen. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15496)
2021-05-29prov: add zero strenght arguments to BN and RAND RNG callsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-28Fix incorrect gettable OSSL_CIPHER_PARAM_TLS_MAC parameterShane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28Fix incorrect OSSL_CIPHER_PARAM_SPEED get_ctx_paramsShane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-27Use <> for #include openssl/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-27aes: rename new bsaes_ symbols -> ossl_bsaes_ onesPauli
bsaes_cbc_encrypt -> ossl_bsaes_cbc_encrypt bsaes_ctr32_encrypt_blocks -> ossl_bsaes_ctr32_encrypt_blocks bsaes_xts_decrypt -> ossl_bsaes_xts_decrypt bsaes_xts_encrypt -> ossl_bsaes_xts_encrypt Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15445)
2021-05-08Crypto: Add deprecation compatibility declarations for SHA* message digest ↵Dr. David von Oheimb
functions Also add hints to SHA256_Init.pod and CHANGES.md how to replace SHA256() etc. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14741)
2021-05-07Fixes #15070. Allow custom algorithm ID ASN.1 encoding for provided ciphersJon Spillett
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15130)
2021-05-07Drop libimplementations.aRichard Levitte
libimplementations.a was a nice idea, but had a few flaws: 1. The idea to have common code in libimplementations.a and FIPS sensitive helper functions in libfips.a / libnonfips.a didn't catch on, and we saw full implementation ending up in them instead and not appearing in libimplementations.a at all. 2. Because more or less ALL algorithm implementations were included in libimplementations.a (the idea being that the appropriate objects from it would be selected automatically by the linker when building the shared libraries), it's very hard to find only the implementation source that should go into the FIPS module, with the result that the FIPS checksum mechanism include source files that it shouldn't To mitigate, we drop libimplementations.a, but retain the idea of collecting implementations in static libraries. With that, we not have: libfips.a Includes all implementations that should become part of the FIPS provider. liblegacy.a Includes all implementations that should become part of the legacy provider. libdefault.a Includes all implementations that should become part of the default and base providers. With this, libnonfips.a becomes irrelevant and is dropped. libcommon.a is retained to include common provider code that can be used uniformly by all providers. Fixes #15157 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15171)
2021-04-19Do IV reset also for DES and 3DES implementationsTomas Mraz
Fixes #14704 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14882)
2021-04-12Always reset IV for CBC, OFB, and CFB mode on cipher context reinitTomas Mraz
This is necessary to keep compatibility with 1.1.1 implementation of the CBC, OFB, and CFB mode ciphers. Fixes #14704 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14811)
2021-04-08Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
2021-04-08Revert "Fix AES-CBC perf test failure issue"Pauli
This reverts commit bec9289143c955b330a8f9ad32f26f3da76e2685. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14796)
2021-04-07Fix AES-CBC perf test failure issueFangming.Fang
As ossl_cipher_generic dosen't support to set key length, and "openssl speed aes-(128|192|256)-cbc" tests fail. A small fix by adding OSSL_CIPHER_PARAM_KEYLEN params. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14777)
2021-03-18Add ossl_provider symbolsShane Lontis
Partial fix for #12964 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14473)
2021-03-18Add ossl_ symbols for sm3 and sm4Shane Lontis
Partial fix for #12964 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14473)
2021-03-18Add ossl_siv symbolsShane Lontis
Partial fix for #12964 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14473)
2021-03-18Add ossl_aria symbolsShane Lontis
Partial fix for #12964 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14473)
2021-03-12support params argument to AES cipher init callsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-12prov: support params argument to common cipher init callsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-12prov: support param argument to DES cipher init callsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-12prov: support param argument to null cipher init callsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-12prov: support params argument to CHACHA20 ciphersPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-12prov: support params argument to RCx ciphersPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14512)
2021-02-26prov: upport modified gettable/settable ctx calls for ciphersPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14240)
2021-02-18Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
2021-02-18Fix external symbols in the provider cipher implementations.Shane Lontis
Partial fix for #12964 This add ossl_ names for the following symbols. chacha20_dinit, chacha20_einit, chacha20_initctx, ccm_cipher, ccm_dinit, ccm_einit, ccm_generic_auth_decrypt, ccm_generic_auth_encrypt, ccm_generic_gettag, ccm_generic_setaad, ccm_generic_setiv, ccm_get_ctx_params, ccm_initctx, ccm_set_ctx_params, ccm_stream_final, ccm_stream_update gcm_aad_update, gcm_cipher, gcm_cipher_final, gcm_cipher_update gcm_dinit, gcm_einit, gcm_get_ctx_params, gcm_initctx, gcm_one_shot gcm_set_ctx_params, gcm_setiv, gcm_stream_final, gcm_stream_update tdes_dinit, tdes_dupctx, tdes_einit, tdes_freectx tdes_get_ctx_params, tdes_gettable_ctx_params, tdes_newctx PROV_CIPHER_HW_des_*, padblock, unpadblock, tlsunpadblock, fillblock, trailingdata Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14209)
2021-02-11Various cleanup of PROV_R_ reason codesTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14086)
2021-02-11Move the PROV_R reason codes to a public headerTomas Mraz
The PROV_R codes can be returned to applications so it is useful to have some common set of provider reason codes for the applications or third party providers. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14086)
2021-02-10Replace provider cipher flags with separate param fieldsShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-01-28Fix cipher reinit on s390x if no key is specifiedJuergen Christ
If key==null on EVP_CipherInit_ex, the init functions for the hardware implementation is not called. The s390x implementation of OFB and CFB mode used the init function to copy the IV into the hardware causing test failures on cipher reinit. Fix this by moving the copy operation into the cipher operation. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/13984)
2021-01-28Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
2021-01-18Rename EVP_CIPHER_CTX_get_iv and EVP_CIPHER_CTX_get_iv_state for clarityTomas Mraz
To clarify the purpose of these two calls rename them to EVP_CIPHER_CTX_get_original_iv and EVP_CIPHER_CTX_get_updated_iv. Also rename the OSSL_CIPHER_PARAM_IV_STATE to OSSL_CIPHER_PARAM_UPDATED_IV to better align with the function name. Fixes #13411 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13870)
2021-01-13chacha20: Properly reinitialize the cipher context with NULL keyTomas Mraz
Same for chacha20-poly1305. The test_cipher_reinit and test_cipher_reinit_partialupdate is modified to test this case of cipher context reinitialization. Fixes #13064 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13850)
2021-01-13Fix enable-weak-ssl-ciphersMatt Caswell
Commit e260bee broke the enable-weak-ssl-ciphers option. The stitched rc4-hmac-md5 cipher implementation did not recognise the tls_version parameter, and therefore was being incorrectly handled. Fixes #13795 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/13803)
2021-01-07Update copyright yearMatt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13800)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-16 07:36:59 +0000