- Jun 03, 2018
-
-
Andy Polyakov authored
Even though calls can be viewed as styling improvement, they do come with cost. It's not big cost and shows only on short inputs, but it is measurable, 2-3% on some platforms. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6312)
-
Kurt Roeckx authored
Reviewed-by:Andy Polyakov <appro@openssl.org> GH: #6405
-
Kurt Roeckx authored
Only Linux and FreeBSD provide getrandom(), but they both also provide getentropy() since the same version and we already tried to call that. Reviewed-by: -
Kurt Roeckx authored
This will actually support most OSs, and at least adds support for Solaris and OSX Fixes: #6403 Reviewed-by: -
Kurt Roeckx authored
Reviewed-by:
-
- May 31, 2018
-
-
Richard Levitte authored
Just because an engine implements algorithm methods, that doesn't mean it also implements the ASN1 method. Therefore, be careful when looking for an ASN1 method among all engines, don't try to use one that doesn't exist. Fixes #6381 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6383) (cherry picked from commit 1ac3cd62) (cherry picked from commit 13b578ad)
-
Matt Caswell authored
Found by coverity. This is an artifact left over from the original decaf import which generated the source code for different curves. For curve 448 this is dead. Reviewed-by:
-
Matt Caswell authored
Issues found by Coverity Reviewed-by:
-
- May 30, 2018
-
-
Yihong Wang authored
In `aes_wrap_cipher()`, the minimal out buff length is `(inlen - 8)`. Since it calls `CRYPTO_128_unwrap_pad()` underneath, it makes sense to reduce the minimal out length in `CRYPTO_128_unwrap_pad()` to align to its caller. Signed-off-by:
Yihong Wang <yh.wang@ibm.com> Reviewed-by:
-
User authored
The One&Done attack, which is described in a paper to appear in the USENIX Security'18 conference, uses EM emanations to recover the values of the bits that are obtained using BN_is_bit_set while constructing the value of the window in BN_mod_exp_consttime. The EM signal changes slightly depending on the value of the bit, and since the lookup of a bit is surrounded by highly regular execution (constant-time Montgomery multiplications) the attack is able to isolate the (very brief) part of the signal that changes depending on the bit. Although the change is slight, the attack recovers it successfully >90% of the time on several phones and IoT devices (all with ARM processors with clock rates around 1GHz), so after only one RSA decryption more than 90% of the bits in d_p and d_q are recovered correctly, which enables rapid recovery of the full RSA key using an algorithm (also described in the paper) that modifies the branch-and-prune approach for a situation in which the exponents' bits are recovered with errors, i.e. where we do not know a priori which bits are correctly recovered. The mitigation for the attack is relatively simple - all the bits of the window are obtained at once, along with other bits so that an entire integer's worth of bits are obtained together using masking and shifts, without unnecessarily considering each bit in isolation. This improves performance somewhat (one call to bn_get_bits is faster than several calls to BN_is_bit_set), so the attacker now gets one signal snippet per window (rather than one per bit) in which the signal is affected by all bits in the integer (rather than just the one bit). Reviewed-by:
-
Andy Polyakov authored
32-bit vector rotate instruction was defined from beginning, it not being used from the start must be a brain-slip... Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Mingtao Yang authored
OpenSSL 1.1.0 made the X509_LOOKUP_METHOD structure opaque, so applications that were previously able to define a custom lookup method are not able to be ported. This commit adds getters and setters for each of the current fields of X509_LOOKUP_METHOD, along with getters and setters on several associated opaque types (such as X509_LOOKUP and X509_OBJECT). Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6152)
-
- May 29, 2018
-
-
Todd Short authored
Return immediately upon discovery of bad message digest. Reviewed-by:
-
Matt Caswell authored
Thanks to Guido Vranken and OSSFuzz for finding this issue. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
- May 28, 2018
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
- May 24, 2018
-
-
Matt Caswell authored
This reverts commit a6f5b116 . The EVP_PKEY_sign() function is intended for pre-hashed input which is not supported by our EdDSA implementation. See the discussion in PR 5880 Reviewed-by:
-
Matt Caswell authored
We check that the curve name associated with the point is the same as that for the curve. Fixes #6302 Reviewed-by:
-
- May 23, 2018
-
-
David Benjamin authored
TlsGetValue clears the last error even on success, so that callers may distinguish it successfully returning NULL or failing. This error-mangling behavior interferes with the caller's use of GetLastError. In particular SSL_get_error queries the error queue to determine whether the caller should look at the OS's errors. To avoid destroying state, save and restore the Windows error. Fixes #6299. Reviewed-by:
-
David Benjamin authored
Reviewed-by:
-
David Benjamin authored
Per SEC 1, the curve coefficients must be padded up to size. See C.2's definition of Curve, C.1's definition of FieldElement, and 2.3.5's definition of how to encode the field elements in http://www.secg.org/sec1-v2.pdf . This comes up for P-521, where b needs a leading zero. Reviewed-by:
-
Viktor Dukhovni authored
Only check the CN against DNS name contraints if the `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` flag is not set, and either the certificate has no DNS subject alternative names or the `X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT` flag is set. Add pertinent documentation, and touch up some stale text about name checks and DANE. Reviewed-by:
-
Viktor Dukhovni authored
Don't apply DNS name constraints to the subject CN when there's a least one DNS-ID subjectAlternativeName. Don't apply DNS name constraints to subject CN's that are sufficiently unlike DNS names. Checked name must have at least two labels, with all labels non-empty, no trailing '.' and all hyphens must be internal in each label. In addition to the usual LDH characters, we also allow "_", since some sites use these for hostnames despite all the standards. Reviewed-by:
-
Richard Levitte authored
Fixes #6327 Reviewed-by:
-
- May 21, 2018
-
-
Matt Caswell authored
If the lengths of both names is 0 then don't attempt to do a memcmp. Issue reported by Simon Friedberger, Robert Merget and Juraj Somorovsky. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6291)
-
- May 20, 2018
-
-
Richard Levitte authored
A previous change of this function introduced a fragility when the destination happens to be the same as the source. Such alias isn't recommended, but could still happen, for example in this kind of code: X509_NAME *subject = X509_get_issuer_name(x); /* ... some code passes ... */ X509_set_issuer_name(x, subject); Fixes #4710 Reviewed-by:
-
- May 18, 2018
-
-
Matt Caswell authored
Using the ca application to sign certificates with EdDSA failed because it is not possible to set the digest to "null". This adds the capability and updates the documentation accordingly. Fixes #6201 Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
- May 17, 2018
-
-
Matt Caswell authored
Experiments have shown that the lookup table used by BN_GF2m_mod_arr introduces sufficient timing signal to recover the private key for an attacker with access to cache timing information on the victim's host. This only affects binary curves (which are less frequently used). No CVE is considered necessary for this issue. The fix is to replace the lookup table with an on-the-fly calculation of the value from the table instead, which can be performed in constant time. Thanks to Youngjoo Shin for reporting this issue. Reviewed-by:
-
- May 14, 2018
-
-
Richard Levitte authored
The Console UI method always set echo on after prompting without echo. However, echo might not have been on originally, so just restore the original TTY settings. Fixes #2373 Reviewed-by:
-
- May 12, 2018
-
-
Richard Levitte authored
Fixes #4716 Reviewed-by:
-
- May 11, 2018
-
-
Kurt Roeckx authored
Reviewed-by: -
Kurt Roeckx authored
Reviewed-by:
-
- May 10, 2018
-
-
Andy Polyakov authored
Reviewed-by:
-
- May 09, 2018
-
-
Billy Brumley authored
Reviewed-by:
-
Billy Brumley authored
Reviewed-by:
-
Billy Brumley authored
* EC_POINT_mul is now responsible for constant time point multiplication (for single fixed or variable point multiplication, when the scalar is in the range [0,group_order), so we need to strip the nonce padding from ECDSA. * Entry added to CHANGES * Updated EC_POINT_mul documentation - Integrate existing EC_POINT_mul and EC_POINTs_mul entries in the manpage to reflect the shift in constant-time expectations when performing a single fixed or variable point multiplication; - Add documentation to ec_method_st to reflect the updated "contract" between callers and implementations of ec_method_st.mul. Reviewed-by:
-
