summaryrefslogtreecommitdiffstats
path: root/providers
AgeCommit message (Collapse)Author
2021-06-04Move libssl related defines used by fips provider to prov_ssl.hTomas Mraz
This nicely reduces the number of files considered as fips provider sources. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15609)
2021-06-03Fix errors found by parfait static analyser.Shane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15579)
2021-06-03update checksumsPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15574)
2021-06-02ed25519 and ed448: fix incorrect OSSL_PKEY_PARAM_MAX_SIZETomas Mraz
Fixes #15552 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15566)
2021-06-02providers: remove TODOsPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15539)
2021-06-02providers/common/der/build.info: make a variable for ../include/provRichard Levitte
This is a proof of concept for GENERATE variable expansion. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15554)
2021-06-01Rename all getters to use get/get0 in nameTomas Mraz
For functions that exist in 1.1.1 provide a simple aliases via #define. Fixes #15236 Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_, EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_, EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_, EVP_MD_, and EVP_CIPHER_ prefixes are renamed. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15405)
2021-06-01Pass library context and property query into private key decodersJon Spillett
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14587)
2021-06-01Fix up encoder/decoder issues caused by not passing a library context to the ↵Jon Spillett
PKCS8 encrypt/decrypt Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14587)
2021-06-01Enhance the encoder/decoder tests to allow testing with a non-default ↵Jon Spillett
library context and configurable providers Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14587)
2021-06-01Move provider der_XXX.h.in files to the include directory.Shane Lontis
Fixes #15506 The .in and generated .h files are now in the same directory. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15544)
2021-06-01Fix param indentation in ciphercommon_hw.cShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15496)
2021-06-01Fix aes cfb1 so that it can operate in bit mode.Shane Lontis
The code to handle the cipher operation was already in the provider. It just needed a OSSL_PARAM in order to set this into the algorithm. EVP_CIPHER_CTX_set_flags() has been modified to pass the OSSL_PARAM. Issue reported by Mark Powers from Acumen. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15496)
2021-05-31Add .asn1 dependencies for files generated from providers/common/der/*.inRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15533)
2021-05-31Add the usual autowarn perl snippet in providers/common/der/*.inRichard Levitte
We have this in all other .in files, so these should have that as well. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15524)
2021-05-31Teach EVP_PKEYs to say whether they were decoded from explicit paramsMatt Caswell
Currently we explicitly downgrade an EVP_PKEY to an EC_KEY and ask the EC_KEY directly whether it was decoded from explicit parameters or not. Instead we teach EVP_PKEYs to respond to a new parameter for this purpose. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15526)
2021-05-29fips: set the library context and handle laterPauli
They need to be set once the provider will definitely be loading. If they are set earlier, a double free results on a failure. Fixes #15452 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15492)
2021-05-29make update-fips-checksumsRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15514)
2021-05-29prov: add zero strenght arguments to BN and RAND RNG callsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15513)
2021-05-29ec: Add PPC64 vector assembly version of p521 field operationsAmitay Isaacs
Only field multiplication and squaring (but not reduction) show a significant improvement. This is enabled on Power ISA >= 3.0. On a Power 9 CPU an average 10% performance improvement is seen (ECHDE: 14%, ECDSA sign: 6%, ECDSA verify 10%), compared to existing code. On an upcoming Power 10 CPU we see an average performance improvement of 26% (ECHDE: 38%, ECDSA sign: 16%, ECDSA verify 25%), compared to existing code. Signed-off-by: Amitay Isaacs <amitay@ozlabs.org> Signed-off-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15401)
2021-05-28Fix incorrect gettable OSSL_CIPHER_PARAM_TLS_MAC parameterShane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-28Fix incorrect OSSL_CIPHER_PARAM_SPEED get_ctx_paramsShane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15416)
2021-05-27Use "" for include crypto/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-27Use "" for include internal/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-27Use <> for #include openssl/xxxRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15468)
2021-05-27aes: rename new bsaes_ symbols -> ossl_bsaes_ onesPauli
bsaes_cbc_encrypt -> ossl_bsaes_cbc_encrypt bsaes_ctr32_encrypt_blocks -> ossl_bsaes_ctr32_encrypt_blocks bsaes_xts_decrypt -> ossl_bsaes_xts_decrypt bsaes_xts_encrypt -> ossl_bsaes_xts_encrypt Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15445)
2021-05-26Rework how providers/fipsmodule.cnf is producedRichard Levitte
First of all, we have concluded that we can calculate the integrity checksum with a simple perl script. Second, having the production of providers/fipsmodule.cnf as a dependency for run_tests wasn't quite right. What we really want is to generate it as soon as a new providers/fips.so is produced. That required a small bit of fiddling with how diverse dependencies are made. Fixes #15166 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15436)
2021-05-26err: rename err_load_xxx_strings_int functionsPauli
The new names are ossl_err_load_xxx_strings. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15446)
2021-05-25regenerate FIPS checksumsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15365)
2021-05-25mac: add a getter for the MAC block size.Pauli
Fixes #12342 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15427)
2021-05-25Add fipsinstall option to run self test KATS on module loadShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15149)
2021-05-24Added PKCS5_PBE_keyivgen_ex() to allow PBKDF1 algorithms to be fetched for a ↵Jon Spillett
specific library context Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14326)
2021-05-24Add PBKDF1 to the legacy providerJon Spillett
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14326)
2021-05-24fips: default to running self tests when starting the fips providerPauli
Also add a C++ constructor as per note 7 of IG 9.10 if no DEP is available and C++ is being used. Fixes #15322 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15324)
2021-05-21PROV: Relegate most of the FIPS provider code to libfips.aRichard Levitte
provider/fips/fipsprov.c contains a number of symbols that get used by anything that's included in libfips.a, at least on Unix. Unfortunately, there are platforms that do not support resolving symbols to things that are already included in the end product (module in this case) being built; they only support resolving symbols with what comes next in the linking process. The offending symbols in this case are FIPS_security_check_enabled, c_thread_start and ossl_fips_intern_provider_init. We resolve this by placing provider/fips/fipsprov.c in libfips.a along with everything else there. That takes care of the offending symbols. What remains is to ensure that there is an entry point in an object file used directly when linking the module, providers/fips/fips_entry.c Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15370)
2021-05-20VMS: Copy __DECC_INCLUDE_{PROLOGUE,EPILOGUE}.H to more placesRichard Levitte
Every inclusion directory related to a library we build need these two files. That signals to any other module using anything from these libraries what to expect in terms of case sensitivity as well as how long symbol names are dealt with. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15341)
2021-05-20make updateMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-05-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15381)
2021-05-19Make sure to include "crypto/ctype.h" to get ossl_isdigit()Richard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15319)
2021-05-18keymgmt: fix coverity 1484886 unchecked return valuePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15300)
2021-05-13Implement pem_read_key directly through OSSL_DECODERTomas Mraz
Using OSSL_STORE is too heavy and breaks things. There were also needed various fixes mainly for missing proper handling of the SM2 keys in the OSSL_DECODER. Fixes #14788 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15045)
2021-05-13Makefile: Make sure providers/fipsmodule.cnf is re-built also for run_testsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14901)
2021-05-13fipsprov: Missing teardown on fips_get_params_from_core() errorTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15229)
2021-05-13Export/import flags for FFC params changed to seperate fields.Shane Lontis
An extra field got added to the ffc flags related to FIPS-186-2 key validation, but this field was not handled by the export/import since the flags were done as string combinations. To keep this consistent with other object flags they are now passed as seperate OSSL_PARAM fields. Fixes 'no-cached-fetch' build which uses export/import. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15210)
2021-05-12A few cleanups of the provider build.infosTomas Mraz
Remove a TODO that is no longer relevant and drop some more non-fips sources from the fips checksums. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/15191)
2021-05-12Allow arbitrary digests with ECDSA and DSATomas Mraz
Unless the FIPS security check is enabled we allow arbitrary digests with ECDSA and DSA. Fixes #14696 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15220)
2021-05-12Checksum updatePauli
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2021-05-12Checksum updatePauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu>
2021-05-11Update FIPS checksumsMatt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Modify the legacy provider to use OSSL_LIB_CTX_new_child()Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-11 18:00:19 +0000