- May 31, 2018
-
-
Richard Levitte authored
Just because an engine implements algorithm methods, that doesn't mean it also implements the ASN1 method. Therefore, be careful when looking for an ASN1 method among all engines, don't try to use one that doesn't exist. Fixes #6381 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6383) (cherry picked from commit 1ac3cd62) (cherry picked from commit 13b578ad)
-
Matt Caswell authored
This is probably a "should not happen" scenario, but better check anyway. Found by Coverity. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
-
Matt Caswell authored
Found by Coverity Reviewed-by:
-
Matt Caswell authored
Fix a memory leak in storeutl. Reviewed-by:
-
Matt Caswell authored
Issue found by Coverity. Reviewed-by:
-
Matt Caswell authored
This doesn't apply if we're doing DTLS, or using UNIX domain sockets. Reviewed-by:
-
Matt Caswell authored
Fix some instances where we weren't checking the error return. Reviewed-by:
-
Matt Caswell authored
Found by coverity. This is an artifact left over from the original decaf import which generated the source code for different curves. For curve 448 this is dead. Reviewed-by:
-
Matt Caswell authored
Issues found by Coverity Reviewed-by:
-
Richard Levitte authored
XN_FLAG_COMPAT has a unique property, its zero for value. This means it needs special treatment; if it has been set (which can only be determined indirectly) and set alone (*), no other flags should be set. (*) if any other nameopt flag has been set by the user, compatibility mode is blown away. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6382)
-
- May 30, 2018
-
-
Yihong Wang authored
In `aes_wrap_cipher()`, the minimal out buff length is `(inlen - 8)`. Since it calls `CRYPTO_128_unwrap_pad()` underneath, it makes sense to reduce the minimal out length in `CRYPTO_128_unwrap_pad()` to align to its caller. Signed-off-by:
Yihong Wang <yh.wang@ibm.com> Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
-
User authored
The One&Done attack, which is described in a paper to appear in the USENIX Security'18 conference, uses EM emanations to recover the values of the bits that are obtained using BN_is_bit_set while constructing the value of the window in BN_mod_exp_consttime. The EM signal changes slightly depending on the value of the bit, and since the lookup of a bit is surrounded by highly regular execution (constant-time Montgomery multiplications) the attack is able to isolate the (very brief) part of the signal that changes depending on the bit. Although the change is slight, the attack recovers it successfully >90% of the time on several phones and IoT devices (all with ARM processors with clock rates around 1GHz), so after only one RSA decryption more than 90% of the bits in d_p and d_q are recovered correctly, which enables rapid recovery of the full RSA key using an algorithm (also described in the paper) that modifies the branch-and-prune approach for a situation in which the exponents' bits are recovered with errors, i.e. where we do not know a priori which bits are correctly recovered. The mitigation for the attack is relatively simple - all the bits of the window are obtained at once, along with other bits so that an entire integer's worth of bits are obtained together using masking and shifts, without unnecessarily considering each bit in isolation. This improves performance somewhat (one call to bn_get_bits is faster than several calls to BN_is_bit_set), so the attacker now gets one signal snippet per window (rather than one per bit) in which the signal is affected by all bits in the integer (rather than just the one bit). Reviewed-by:
-
Andy Polyakov authored
32-bit vector rotate instruction was defined from beginning, it not being used from the start must be a brain-slip... Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
Goal is to exercise AEAD ciphers in TLS-like sequence, i.e. 13-byte AAD followed by payload. Update doc/man1/speed.pod accordingly. [While we are at it, address even some styling and readability issues.] Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Richard Levitte authored
Under a mingw shell, the command line path conversion either mangles file: URIs to something useless (file;C:\...) or not at all (which can't be opened by the Windows C RTL unless we're really lucky), so we simply skip testing them in that environment. Fixes #6369 Reviewed-by:
-
Mingtao Yang authored
OpenSSL 1.1.0 made the X509_LOOKUP_METHOD structure opaque, so applications that were previously able to define a custom lookup method are not able to be ported. This commit adds getters and setters for each of the current fields of X509_LOOKUP_METHOD, along with getters and setters on several associated opaque types (such as X509_LOOKUP and X509_OBJECT). Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6152)
-
Dmitry Belyavskiy authored
Reviewed-by:
-
Dmitry Belyavskiy authored
Reviewed-by:
-
Dmitry Belyavskiy authored
Reviewed-by:
-
- May 29, 2018
-
-
Todd Short authored
It's freed with OPENSSL_free() Reviewed-by:
-
Todd Short authored
Return immediately upon discovery of bad message digest. Reviewed-by:
-
Matt Caswell authored
Check all functions that do this. Reviewed-by:
-
Matt Caswell authored
Thanks to Guido Vranken and OSSFuzz for finding this issue. Reviewed-by:
-
Matt Caswell authored
Fixes #6307 Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6330)
-
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by: -
Matt Caswell authored
Reviewed-by:
-
- May 28, 2018
-
-
Dr. Matthias St. Pierre authored
amends 0396401d Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
amends 6db7fadf Reviewed-by:
-
- May 27, 2018
-
-
Dr. Matthias St. Pierre authored
In commit 6decf943 , fourteen public symbols were removed from util/libcrypto.num on the master branch and the following symbols renumbered. Unfortunately, the symbols `OCSP_resp_get0_signer` and `X509_get0_authority_key_id` were not adjusted accordingly on the OpenSSL_1_1_0-stable branch. This commit fixes the collision by doing a 'double swap'. Reviewed-by:
-
- May 26, 2018
-
-
Bernd Edlinger authored
[extended tests] Reviewed-by:
-
Nick Mathewson authored
Also, modernize the code, so that it isn't trying to store a size_t into an int, and then check the int's sign. :/ Reviewed-by:
-
Nick Mathewson authored
In previous versions of OpenSSL, the documentation for PEM_read_* said: The callback B<must> return the number of characters in the passphrase or 0 if an error occurred. But since c82c3462 , 0 is now treated as a non-error return value. Applications that want to indicate an error need to return -1 instead. Reviewed-by:
-
- May 25, 2018
-
-
Bernd Edlinger authored
Reviewed-by:
-
