summaryrefslogtreecommitdiffstats
path: root/providers
AgeCommit message (Collapse)Author
2024-01-30make updateMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-01-30Copyright year updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-01-12Fix the encoding of SM2 keysRichard Levitte
OpenSSL's encoding of SM2 keys used the SM2 OID for the algorithm OID where an AlgorithmIdentifier is encoded (for encoding into the structures PrivateKeyInfo and SubjectPublicKeyInfo). Such keys should be encoded as ECC keys. Fixes #22184 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22529) (cherry picked from commit 1d490694dfa790d8e47f8f2ea62ea1d9b1251179)
2024-01-12Fix partial block encryption in cfb and ofb for s390xHolger Dengler
Use the number of processed bytes information (num) from the generic cipher context for the partial block handling in cfb and ofb, instead of keep this information in the s390x-specific part of the cipher context. The information in the generic context is reset properly, even if the context is re-initialized without resetting the key or iv. Fixes: #23175 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23201) (cherry picked from commit 576a3572bebf6115df1c03527114cbf74d06f861)
2024-01-08Add missing sm4_ccm_dupctx() and sm4_gcm_dupctx()Tomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23217)
2024-01-05cleanse stack variable in kdf_pbkdf1_do_deriveNeil Horman
kdf_pbkdf1_do_derive stores key derivation information in a stack variable, which is left uncleansed prior to returning. Ensure that the stack information is zeroed prior to return to avoid potential leaks of key information Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23194) (cherry picked from commit 5963aa8c196d7c5a940a979299a07418527932af)
2024-01-05Fix a key repointing in various ciphersNeil Horman
In the dupctx fixups I missed a pointer that needed to be repointed to the surrounding structures AES_KEY structure for the sm4/aes/aria ccm/gcm variants. This caused a colliding use of the key and possible use after free issues. Fixes #22076 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23102) (cherry picked from commit 0398bc20080de037a8433fe81cfdef3ba0ec9d4c)
2024-01-05Add dupctx support to rc4_hmac_md5 algoNeil Horman
Pretty straightforward, just clone the requested context, no pointers to fixup Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23102) (cherry picked from commit f9163efe96e218adeae2a0dc6a4cbef568f395ee)
2024-01-05implement dupctx for chacha20_poly1305Neil Horman
Same as chacha20 in the last commit, just clone the ctx and its underlying tlsmac array if its allocated Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23102) (cherry picked from commit e7ef50c3e3b670a476aa0e864da5b5cc874b3528)
2024-01-05implement dupctx for aes_WRAP methodsNeil Horman
create a dupctx method for aes_WRAP implementations of all sizes Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23102) (cherry picked from commit a5bea0a8d423c7e52052d903b99f75034e78cecf)
2024-01-05Add dupctx support to aead ciphersNeil Horman
Add dupctx method support to to ciphers implemented with IMPLEMENT_aead_cipher This includes: aes-<kbits>-gcm aria-<kbits>-ccm aria-<kbits>-gcm Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23102) (cherry picked from commit 879a853a1dc968fb010e5bf17d2e8888acc70742)
2024-01-03cleanse stack variable in blake2[b|s] finalizationNeil Horman
If the output of a blake2[b|s] digest isn't a multipl of 8, then a stack buffer is used to compute the final output, which is left un-zeroed prior to return, allowing the potential leak of key data. Ensure that, if the stack variable is used, it gets cleared prior to return. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23173) (cherry picked from commit 8b9cf1bc2c3085b6e9493a057209ffd0bddf48a6)
2024-01-03validate requested key length in kdf_pbkdf1_do_deriveNeil Horman
When using pbkdf1 key deriviation, it is possible to request a key length larger than the maximum digest size a given digest can produce, leading to a read of random stack memory. fix it by returning an error if the requested key size n is larger than the EVP_MD_size of the digest Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23174) (cherry picked from commit 8d89050f0f676b429043fd5445e5a570d54ad225)
2023-12-29Add missing settable entry OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS for RSA asymslontis
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20319) (cherry picked from commit 26183614ed1dc03f509f26839b8a465684ca0f84)
2023-12-01evp-cmac: do not seg-fault when getting mac-size before initJames Muir
Add null check to cmac_size(). This avoids a seg-fault encountered with cmac when EVP_MAC_CTX_get_mac_size() is called before init. Extend mac testing in evp_test.c to check that the sizes returned by EVP_MAC_CTX_get_mac_size() before and after init make sense (this also ensures that we no longer seg-fault). Fixes #22842 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22858) (cherry picked from commit ff181969e28c1503b077b47a9ded3683524b3fd8)
2023-11-30Initialize dstctx->mgf1_md to NULL in rsa_dupctx functionlan1120
Signed-off-by: lan1120 <lanming@huawei.com> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22795) (cherry picked from commit f95e3a09173b13dcfae668be6103e64c02222f08)
2023-11-23update/final: Return error if key is not setTomas Mraz
Also make sure the key is not set if the key length is changed on the context after the key was set previously. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 3a95d1e41abf2e8eb0f6f07003bac844950bfaae) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22613)
2023-11-23When changing IV length invalidate previously set IVTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit eddbb78f4e5196eee33b2fd3d6adeabb69d52eb7) Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22613)
2023-11-23Fix a possible memory leak in SM2 providerHuiyue Xu
ctx->propq that strdup from input parameter propq in sm2sig_newctx, is not released. It should be released in sm2sig_freectx and copied to dstctx in sm2sig_dupctx. And dstctx->id and dstctx->propq should be set NULL to avoid releasing id/propq of srcctx when err occurs. Signed-off-by: Huiyue Xu <xuhuiyue@huawei.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22796) (cherry picked from commit e7d34d7ae32f16abbd79a49072cff580bee32269)
2023-10-24make updateMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-10-24Copyright year updatesMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-10-24rand: fix seeding from a weak entropy sourceMatthias St. Pierre
The 'rand_generate' method is not well suited for being used with weak entropy sources in the 'get_entropy' callback, because the caller needs to provide a preallocated buffer without knowing how much bytes are actually needed to collect the required entropy. Instead we use the 'rand_get_seed' and 'rand_clear_seed' methods which were exactly designed for this purpose: it's the callee who allocates and fills the buffer, and finally cleans it up again. The 'rand_get_seed' and 'rand_clear_seed' methods are currently optional for a provided random generator. We could fall back to using 'rand_generate' if those methods are not implemented. However, imo it would be better to simply make them an officially documented requirement for seed sources. Fixes #22332 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22394) (cherry picked from commit 7998e7dc07d8f1f516af32887f2490c03cd8c594)
2023-10-20rand: add callbacks to cleanup the user entropy resp. nonceMatthias St. Pierre
The `get_user_{entropy,nonce}` callbacks were add recently to the dispatch table in commit 4cde7585ce8e. Instead of adding corresponding `cleanup_user_{entropy,nonce}` callbacks, the `cleanup_{entropy,nonce}` callbacks were reused. This can cause a problem in the case where the seed source is replaced by a provider: the buffer gets allocated by the provider but cleared by the core. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22423) (cherry picked from commit 5516d20226c496c2b22fa741698b4d48dad0428f)
2023-10-11DH_check_pub_key() should not fail when setting result codeTomas Mraz
The semantics of ossl_ffc_validate_public_key() and ossl_ffc_validate_public_key_partial() needs to be changed to not return error on non-fatal problems. Fixes #22287 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22291) (cherry picked from commit eaee1765a49c6a8ba728e3e2d18bb67bff8aaa55)
2023-10-09Avoid divide-by-zero in kmac_prov.c's bytepad()Klavishnik
This would happen if EVP_MD_get_block_size() returned 0 so we return an error instead. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21698) (cherry picked from commit 91895e39b10033178e662fc7427a09d7562cf8e1)
2023-10-04Restore the meaning of EVP_PKEY_print_private()Richard Levitte
With pre-3.0 OpenSSL, EVP_PKEY_print_private() calls the EVP_PKEY_ASN1_METHOD function "priv_print", effectively asking the backend to print whatever it regards as private key components. In all backends that were built into libcrypto, this function printed what was included in the private key structure, which usually includes the public key components as well. With OpenSSL 3.0, some of the corresponding key2text encoders got a slightly different behavior, where the presence of the selector OSSL_KEYMGMT_SELECT_PRIVATE_KEY without the presence of the selector OSSL_KEYMGMT_SELECT_PUBLIC_KEY would only get what would intuitively be regarded as private key components printed. This isn't entirely consistent, though, as the RSA key2text encoder will still print the public key components regardless. To compensate for the changed backend behavior, EVP_PKEY_print_private() was made to ask the encoder to print the keypair rather than just the private key, thereby moving the backend semantics to the application API. Unfortunately, this causes confusion for providers where the key2text encoder really should print the private key only. This change restores the built-in 1.1.1 backend behavior in the encoders that OpenSSL provides, and renders EVP_PKEY_print_private() more true to its documented behavior, leaving it to the backend to decide what it regards as "private key components". Fixes #22233 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22237) (cherry picked from commit 1296c2ec7866a4f2f4d210432c771142e8de33a0)
2023-10-03Coverity 1545174: calling risky functionPauli
Remove the call to rand() and replace with an xor-shift RNG. There are no security implications to worry about here. This RNG is used during testing only. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22211) (cherry picked from commit eaf08794398ac3caaadffcfd670854bf51f610fa)
2023-10-03Fix a mem leak when the FIPS provider is used in a different threadMatt Caswell
We were neglecting to register the main thread to receive thread stop notifications. This is important if the thread that starts the FIPS provider is not the same one that is used when OPENSSL_cleanup() is called. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03fips: use seed source requestedPauli
Fixes #21909 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03fips selftest: avoid relying on a real RNG for self testsPauli
Rather than instantiate the private and primary DRBGs during the selftest, instead use a test RNG. This leaves the DRBG setup pristine and permits later replacement of the seed source despite the very early running power up self tests. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-10-03remove redundant free of NULLPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22210)
2023-09-19make updateRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-19Copyright year updatesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-13Revert "Add dupctx support to aead ciphers"Tomas Mraz
This reverts commit a982016c56f8c631e0906b0a33f4feaf3d20a2ff. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "implement dupctx for aes_WRAP methods"Tomas Mraz
This reverts commit 819ae76bb76540a4321e548851e23099ddf71e8e. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "implement dupctx for chacha20_poly1305"Tomas Mraz
This reverts commit 603b4c332f817cfc14a0d8b30d1e5a198f575644. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Revert "Add dupctx support to rc4_hmac_md5 algo"Tomas Mraz
This reverts commit d9f84aef6033804e4c7ebf28ee88fcd2c63161d6. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22081)
2023-09-13Fix a memleak in prepare_rsa_paramsBernd Edlinger
This affects only RSA-PSS keys with params using negative salt legth, or in case of out of memory. This fixes a memory leak reported in #22049. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22061) (cherry picked from commit 46def829afa4d8bed8f53d484bdf842d65f0e176)
2023-09-12Add dupctx support to rc4_hmac_md5 algoNeil Horman
Pretty straightforward, just clone the requested context, no pointers to fixup Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 123c85864fa7fe97d8ae3a09989d410501d957a5)
2023-09-12implement dupctx for chacha20_poly1305Neil Horman
Same as chacha20 in the last commit, just clone the ctx and its underlying tlsmac array if its allocated Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit df93b3c9e72571876bd01e5a50a5ba8368c6c77f)
2023-09-12implement dupctx for aes_WRAP methodsNeil Horman
create a dupctx method for aes_WRAP implementations of all sizes Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 2c021e7d11f03ede2330398c4fd8e8c7bd8768ee)
2023-09-12Add dupctx support to aead ciphersNeil Horman
Add dupctx method support to to ciphers implemented with IMPLEMENT_aead_cipher This includes: aes-<kbits>-gcm aria-<kbits>-ccm aria-<kbits>-gcm sm4-<kibs>-gcm Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21933) (cherry picked from commit 0239fb3db77e9de2031c5054854cba8e417c1b72)
2023-09-04Implement dupctx for chacha20 cipherNeil Horman
Implement the dupctx method for the chacha20 cipher, so that EVP_PKEY_CTX_copy works Its pretty straightforward, its basically just a memdup. Checking the pointers that might need fixing up: in PROV_CHACHA20_CTX all members are statically declared, so memduping should be fine in PROV_CHACHA20_CTX->base (PROV_CIPHER_CTX): Non statically declared members: *tlsmac needs to get memduped to avoid double free conditions, but only if base.alloced is set *hw pointer is always assigned to the chacha20_hw global variable, so can be left alone *libctx can be left alone as provctx is always NULL in chacha20_newctx *ks appears unused by chacha20, so can be ignored Fixes #20978 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21878) (cherry picked from commit 61cfc22b60e33bc77b1e1944759af48c8e58f0d2)
2023-08-04When exporting/importing decoded keys do not use 0 as selectionTomas Mraz
When decoding 0 as the selection means to decode anything you get. However when exporting and then importing the key data 0 as selection is not meaningful. So we set it to OSSL_KEYMGMT_SELECT_ALL to make the export/import function export/import everything that we have decoded. Fixes #21493 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21519) (cherry picked from commit 2acb0d363c0032b5b97c4f6596609f40bd7d842f)
2023-08-04Avoid exporting bogus (empty) data if empty selection is usedTomas Mraz
This is already correct in the rsa_kmgmt.c but other implementations are wrong. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21519) (cherry picked from commit 1ae4678cebaa13604c0f31bdf2c64cd28bdaf287)
2023-08-01Don't add the msblob/pvk decoders if they're not suitableMatt Caswell
msblob only decodes public/private keys (not just params). pvk only decodes private keys. If the requested selection doesn't intersect with the above then don't consider those decoders. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21603) (cherry picked from commit 6207f2b657b5ba1823681b49c7c34c619da0dd00)
2023-08-01make updateMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-08-01Copyright year updatesMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-07-14Do not ignore empty associated data with AES-SIV modeTomas Mraz
The AES-SIV mode allows for multiple associated data items authenticated separately with any of these being 0 length. The provided implementation ignores such empty associated data which is incorrect in regards to the RFC 5297 and is also a security issue because such empty associated data then become unauthenticated if an application expects to authenticate them. Fixes CVE-2023-2975 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21384) (cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9)
2023-06-30Do not use stitched AES-GCM implementation on PPC32Tomas Mraz
The implementation is not usable there at all. Fixes #21301 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21312)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-11 11:06:06 +0000