summaryrefslogtreecommitdiffstats
path: root/ssl/t1_enc.c
AgeCommit message (Collapse)Author
2014-10-15Support TLS_FALLBACK_SCSV.Bodo Moeller
Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-06-28Fix compilation with -DSSL_DEBUG -DTLS_DEBUG -DKSSL_DEBUGyogesh nagarkar
PR#3141 (cherry picked from commit d183545d4589f1e7a40190400b8b99ea3d1f7f97)
2014-05-31Use correct digest when exporting keying material.Dr. Stephen Henson
PR#3319 (cherry picked from commit 84691390eae86befd33c83721dacedb539ae34e6)
2014-05-24Fix for non compilation with TLS_DEBUG definedMatt Caswell
2014-02-25ssl/t1_enc.c: check EVP_MD_CTX_copy return value.Andy Polyakov
PR: 3201 (cherry picked from commit 03da57fe14f2de5bde9d4496a2ae9a4ae8879f88)
2013-12-20Fix DTLS retransmission from previous session.Dr. Stephen Henson
For DTLS we might need to retransmit messages from the previous session so keep a copy of write context in DTLS retransmission buffers instead of replacing it after sending CCS. CVE-2013-6450.
2013-12-18Check EVP errors for handshake digests.Dr. Stephen Henson
Partial mitigation of PR#3200
2013-02-01ssl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.Andy Polyakov
2013-01-31Timing fix mitigation for FIPS mode.Dr. Stephen Henson
We have to use EVP in FIPS mode so we can only partially mitigate timing differences. Make an extra call to EVP_DigestSignUpdate to hash additonal blocks to cover any timing differences caused by removal of padding.
2013-01-28Update DTLS code to match CBC decoding in TLS.Ben Laurie
This change updates the DTLS code to match the constant-time CBC behaviour in the TLS.
2013-01-28Don't crash when processing a zero-length, TLS >= 1.1 record.Ben Laurie
The previous CBC patch was bugged in that there was a path through enc() in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left at the previous value which could suggest that the packet was a sufficient length when it wasn't.
2013-01-28Make CBC decoding constant time.Ben Laurie
This patch makes the decoding of SSLv3 and TLS CBC records constant time. Without this, a timing side-channel can be used to build a padding oracle and mount Vaudenay's attack. This patch also disables the stitched AESNI+SHA mode pending a similar fix to that code. In order to be easy to backport, this change is implemented in ssl/, rather than as a generic AEAD mode. In the future this should be changed around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
2012-09-21* ssl/t1_enc.c (tls1_change_cipher_state): Stupid bug. Fortunately inRichard Levitte
debugging code that's seldom used.
2012-05-10Sanity check record length before skipping explicit IV in TLS 1.2, 1.1 andDr. Stephen Henson
DTLS to fix DoS attack. Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic fuzzing as a service testing platform. (CVE-2012-2333)
2012-05-10oops, revert unrelated changeDr. Stephen Henson
2012-05-10Reported by: Solar Designer of OpenwallDr. Stephen Henson
Make sure tkeylen is initialised properly when encrypting CMS messages.
2012-03-13ssl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD].Andy Polyakov
2011-12-13Remove redundant TLS exporter.Ben Laurie
2011-12-13SSL export fixes (from Adam Langley).Ben Laurie
2011-12-02Fix exporter.Ben Laurie
2011-12-02Fix warnings.Ben Laurie
2011-11-25PR: 1794Dr. Stephen Henson
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Make SRP conformant to rfc 5054. Changes are: - removal of the addition state after client hello - removal of all pre-rfc srp alert ids - sending a fatal alert when there is no srp extension but when the server wants SRP - removal of unnecessary code in the client.
2011-11-21bcmp doesn't exist on all platforms, replace with memcmpDr. Stephen Henson
2011-11-15Add TLS exporter.Ben Laurie
2011-08-04Backport GCM support from HEAD.Dr. Stephen Henson
2011-07-21Back-port TLS AEAD framework [from HEAD].Andy Polyakov
2011-05-31Don't round up partitioned premaster secret length if there is only oneDr. Stephen Henson
digest in use: this caused the PRF to fail for an odd premaster secret length.
2011-05-19add FIPS support to ssl: doesn't do anything on this branch yet as there is ↵Dr. Stephen Henson
no FIPS compilation support
2011-05-11Backport TLS v1.2 support from HEAD.Dr. Stephen Henson
This includes TLS v1.2 server and client support but at present client certificate support is not implemented.
2011-03-16Add SRP.Ben Laurie
2011-01-04Don't use decryption_failed alert for TLS v1.1 or later.Dr. Stephen Henson
2010-11-24use generalised mac API for SSL key generationDr. Stephen Henson
2010-11-14Only use explicit IV if cipher is in CBC mode.Dr. Stephen Henson
2010-07-18PR: 1830Dr. Stephen Henson
Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson Support for RFC5705 key extractor.
2010-06-27no need for empty fragments with TLS 1.1 and later due to explicit IVDr. Stephen Henson
2010-06-27Backport TLS v1.1 support from HEAD, ssl/ changesDr. Stephen Henson
2010-06-15Fix warnings (From HEAD, original patch by Ben).Dr. Stephen Henson
2010-05-17PR: 2259Dr. Stephen Henson
Submitted By: Artem Chuprina <ran@cryptocom.ru> Check return values of HMAC in tls_P_hash and tls1_generate_key_block. Although the previous version could in theory crash that would only happen if a digest call failed. The standard software methods can never fail and only one ENGINE currently uses digests and it is not compiled in by default.
2009-04-19PR: 1751Dr. Stephen Henson
Submitted by: David Woodhouse <dwmw2@infradead.org> Approved by: steve@openssl.org Compatibility patches for Cisco VPN client DTLS.
2009-01-11Fix warnings properly this time ;-)Dr. Stephen Henson
2009-01-11Fix sign-compare warnings.Dr. Stephen Henson
2009-01-05Fix compilation with -no-comp by adding some more #ifndef OPENSSL_NO_COMPLutz Jänicke
Some #include statements were not properly protected. This will go unnoted on most systems as openssl/comp.h tends to be installed as a system header file by default but may become visible when cross compiling.
2008-12-29If we're going to return errors (no matter how stupid), then we shouldBen Laurie
test for them!
2008-12-27Handle the unlikely event that BIO_get_mem_data() returns -ve.Ben Laurie
2008-11-12Revert the size_t modifications from HEAD that had led to moreGeoff Thorpe
knock-on work than expected - they've been extracted into a patch series that can be completed elsewhere, or in a different branch, before merging back to HEAD.
2008-11-10Make -DKSSL_DEBUG work again.Dr. Stephen Henson
2008-01-05Fix unsigned/signed warnings in ssl.Andy Polyakov
2007-10-261. Changes for s_client.c to make it return non-zero exit code in caseDr. Stephen Henson
of handshake failure 2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to make it recognize GOST certificates as EVP_PKT_SIGN|EVP_PKT_EXCH (required for s3_srvr to accept GOST client certificates). 3. Changes to EVP - adding of function EVP_PKEY_CTX_get0_peerkey - Make function EVP_PKEY_derive_set_peerkey work for context with ENCRYPT operation, because we use peerkey field in the context to pass non-ephemeral secret key to GOST encrypt operation. - added EVP_PKEY_CTRL_SET_IV control command. It is really GOST-specific, but it is used in SSL code, so it has to go in some header file, available during libssl compilation 4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data 5. Include des.h if KSSL_DEBUG is defined into some libssl files, to make debugging output which depends on constants defined there, work and other KSSL_DEBUG output fixes 6. Declaration of real GOST ciphersuites, two authentication methods SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST 7. Implementation of these methods. 8. Support for sending unsolicited serverhello extension if GOST ciphersuite is selected. It is require for interoperability with CryptoPro CSP 3.0 and 3.6 and controlled by SSL_OP_CRYPTOPRO_TLSEXT_BUG constant. This constant is added to SSL_OP_ALL, because it does nothing, if non-GOST ciphersuite is selected, and all implementation of GOST include compatibility with CryptoPro. 9. Support for CertificateVerify message without length field. It is another CryptoPro bug, but support is made unconditional, because it does no harm for draft-conforming implementation. 10. In tls1_mac extra copy of stream mac context is no more done. When I've written currently commited code I haven't read EVP_DigestSignFinal manual carefully enough and haven't noticed that it does an internal digest ctx copying. This implementation was tested against 1. CryptoPro CSP 3.6 client and server 2. Cryptopro CSP 3.0 server
2007-10-09Make DTLS1 record layer MAC calculation RFC compliant.Andy Polyakov
Submitted by: Alex Lam
2007-09-26Support for certificate status TLS extension.Dr. Stephen Henson
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-27 16:32:14 +0000