summaryrefslogtreecommitdiffstats
path: root/providers
AgeCommit message (Collapse)Author
2020-09-25Modified rand_cpu_x86.c to support builtin hardware randomizer on HPE NonStop.Randall S. Becker
CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #12903 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12923)
2020-09-25Move SM2 asymmetric encryption to be available in the default providerMatt Caswell
Fixes #12908 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12913)
2020-09-25Hide ECX_KEY againRichard Levitte
ECX_KEY was not meant for public consumption, it was only to be accessed indirectly via EVP routines. However, we still need internal access for our decoders. This partially reverts 7c664b1f1b5f60bf896f5fdea5c08c401c541dfe Fixes #12880 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12956)
2020-09-24Add key length check to rsa_kem operation.Shane Lontis
This uses similiar code used by other rsa related operations. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12955)
2020-09-24Prune low-level ASN.1 parse errors from error queue in decoder_process()Dr. David von Oheimb
Fixes #12840 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12893)
2020-09-23drbg: revert renamings of the generate and reseed counterDr. Matthias St. Pierre
The original names were more intuitive: the generate_counter counts the number of generate requests, and the reseed_counter counts the number of reseedings (of the principal DRBG). reseed_gen_counter -> generate_counter reseed_prop_counter -> reseed_counter This is the anologue to commit 8380f453ec81 on the 1.1.1 stable branch. The only difference is that the second renaming has already been reverted on the master branch. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12941)
2020-09-23Fix propq in x942kdfShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12944)
2020-09-23Fix ecx so that is uses a settable propertyqueryShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12944)
2020-09-23Fix EVP_KDF_scrypt so that is uses a propq for its fetch.Shane Lontis
The parameter can be set via settable parameter OSSL_KDF_PARAM_PROPERTIES Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12944)
2020-09-23Change rsa gen so it can use the propq from OSSL_PKEY_PARAM_RSA_DIGESTShane Lontis
rsa_pss_params_30_fromdata() now uses the OSSL_PKEY_PARAM_RSA_DIGEST_PROPS parameter also. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12944)
2020-09-23Fix CID 1466710 : Resource leak in ec_kmgmt due to new call to ↵Shane Lontis
ossl_prov_is_running() Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12930)
2020-09-23Fix CID 1466712 : Resource leak in ec_kmgmt due to new callto ↵Shane Lontis
ossl_prov_is_running() Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12930)
2020-09-23Fix CID 1466713 : Dead code in encode_key2text.cShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12930)
2020-09-23Fix CID 1467068 : Null pointer dereference in self_test.cShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12930)
2020-09-23drbg: gettable parameters for cipher/digest/mac type.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12931)
2020-09-22refactor get params functionsPaul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12536)
2020-09-22support PARAM_SECURITY_BITS for SM2Paul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12536)
2020-09-22Address review commentsPaul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12536)
2020-09-22Add SM2 signature algorithm to default providerPaul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12536)
2020-09-22Add SM2 key managementPaul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12536)
2020-09-22Added FIPS DEP initialization for the NonStop platform in fips/self_test.c.Randall S. Becker
CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #12918 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12928)
2020-09-20ENCODER: Refactor our provider encoder implementationsRichard Levitte
This only refactors them for the changed API, there's not yet a separate DER to PEM encoder and therefore no chaining possibility yet. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12873)
2020-09-19Add a copy of OSSL_SELF_TEST_get_callback() to the fips module.Shane Lontis
The user can set up a self test callback that should be activated when a keygen operation (e.g ec) occurs for the fips module. The callback information is stored inside the applications library context, but this was not being triggered since the library context used for the key generation operation was the internal library context used by the fips module (which is not the same as the application's library context). During the keygen operation the OSSL_SELF_TEST_get_callback() function is used to retrieve the callback info. By having a seperate copy of OSSL_SELF_TEST_get_callback() for the fips module we can ensure that the parent library context is used instead. The core OSSL_SELF_TEST_get_callback() function pointer is passed across the boundary during the fips modules entry point such that the fips version of the function can call it after changing the libctx. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12877)
2020-09-19Add KEM (Key encapsulation mechanism) support to providersShane Lontis
SP800-56Br2 requires support for the RSA primitives for RSASVE generate and recover. As these are simple KEM operations another operation type has been added that can support future extensions. Added public functions EVP_PKEY_encapsulate_init(), EVP_PKEY_encapsulate(), EVP_PKEY_decapsulate_init() and EVP_PKEY_decapsulate() Added EVP_KEM_* functions. Added OSSL_FUNC_kem_* dispatch functions Added EVP_PKEY_CTX_set_kem_op() so that different types of KEM can be added in the future. This value must currently be set to "RSASVE" after EVP_PKEY_encapsulate_init() & EVP_PKEY_decapsulate_init() as there is no default value. This allows the existing RSA key types, keymanagers, and encoders to be used with the encapsulation operations. The design of the public API's resulted from contributions from @romen & @levitte. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12750)
2020-09-18Teach EdDSA signature algorithms about AlgorithmIdentifiersMatt Caswell
The other signature algorithms know how to create their own AlgorithmIdentifiers, but the EdDSA algorithms missed this. Fixes #11875 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12884)
2020-09-18Add option to fipsinstall to disable fips security checks at run time.Shane Lontis
Changes merged from a patch by @richsalz. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add 'fips-securitychecks' option and plumb this into the actual fips checksShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18fix provider exchange operationsShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18fix provider signaturesShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Separate fips and non fips code for key operationsShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add missing 'ossl_unused' tags to some gettable and settable methods.Shane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add fips checks for ecdh key agreementShane Lontis
For key agreement only NIST curves that have a security strength of 112 bits or more are allowed. Fixed tests so they obey these restrictions when testing in fips mode. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add fips checks for rsa encryptionShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add fips checks for dh key agreementShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add fips checks for ecdsa signaturesShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add fips checks for dsa signaturesShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add fips checks for rsa signatures.Shane Lontis
In fips mode SHA1 should not be allowed for signing, but may be present for verifying. Add keysize check. Add missing 'ossl_unused' to gettable and settable methods. Update fips related tests that have these restrictions. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
2020-09-18Add selftest callback to CRNG output testShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12795)
2020-09-18Fix AES_XTS on x86-64 platforms with BSAES and VPAES support.Shane Lontis
Fixes #11622 Fixes #12378 Due to a missing else it was setting up the stream for BSAES and then using this incorrect stream with VPAES. The correct behaviour is not to use VPAES at all in this case. Also note that the original code in e_aes could set up VPAES and then would overwrite it with the generic implementation. On a machine that supported both BSAES and VPAES the code was changed locally to force it to run both cases to verify both paths produce the correct known answers. Debugged using mageia 7.1, but is also highly likely to fix FreeBSD also. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12887)
2020-09-17Make KDFs fail if requesting a zero-length key.Jon Spillett
Also add more test cases Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12826)
2020-09-17Allow zero-length secret for EVP_KDF APIJon Spillett
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12826)
2020-09-17Update AES GCM IV max length to be 1024 bits (was 512)Shane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12875)
2020-09-16Add self tests for rsa encryptionShane Lontis
SP800-56br2 requires seperate KAT's (fips self tests) to be tested for both encryption and decryption using the RSA primitive (i.e. no padding). This is specified in FIPS140-2 IG D.9 A copy of the methods EVP_PKEY_encrypt_init(), EVP_PKEY_encrypt(), EVP_PKEY_decrypt_init(), EVP_PKEY_decrypt() are now in the fips module. Removed the #ifdef FIPS_MODULE in evp_pkey_ctx_free_old_ops(). Added corruption test Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12835)
2020-09-14prov/drbg: cleanup some RAND_DRBG leftoversDr. Matthias St. Pierre
These are leftovers from the RAND_DRBG removal (#12509). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12866)
2020-09-14prov/drbg: fix misspelling of '#ifdef FIPS_MODULE'Dr. Matthias St. Pierre
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12866)
2020-09-13Fix safestack issues in x509.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-12keygen: add FIPS error state management to conditional self testsShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12801)
2020-09-12CRNGT: enter FIPS error state if the test failsPauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12801)
2020-09-12FIPS: error mode is set from failed self tests and produced a limited number ↵Pauli
of errors when algorithm accesses are attempted Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12801)
2020-09-12ciphers: add FIPS error state handlingPauli
The functions that check for the provider being runnable are: new, init, final and dupctx. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12801)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-23 00:17:24 +0000