Skip to content
  1. Feb 12, 2013
  2. Feb 11, 2013
  3. Feb 08, 2013
  4. Feb 06, 2013
    • Adam Langley's avatar
      Fix for EXP-RC2-CBC-MD5 · 32620fe9
      Adam Langley authored
      MD5 should use little endian order. Fortunately the only ciphersuite
      affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
      is a rarely used export grade ciphersuite.
      (cherry picked from commit f306b87d766e6ecf30824635c7c395b67cff9dbc)
      32620fe9
    • Andy Polyakov's avatar
      e_aes_cbc_hmac_sha1.c: cleanse temporary copy of HMAC secret. · 1041ab69
      Andy Polyakov authored
      (cherry picked from commit 529d27ea472fc2c7ba9190a15a58cb84012d4ec6)
      1041ab69
    • Andy Polyakov's avatar
      e_aes_cbc_hmac_sha1.c: address the CBC decrypt timing issues. · 9970308c
      Andy Polyakov authored
      Address CBC decrypt timing issues and reenable the AESNI+SHA1 stitch.
      (cherry picked from commit 125093b59f3c2a2d33785b5563d929d0472f1721)
      9970308c
    • Andy Polyakov's avatar
      ssl/*: remove SSL3_RECORD->orig_len to restore binary compatibility. · 2aec073a
      Andy Polyakov authored
      Kludge alert. This is arranged by passing padding length in unused
      bits of SSL3_RECORD->type, so that orig_len can be reconstructed.
      (cherry picked from commit 8bfd4c659f180a6ce34f21c0e62956b362067fba)
      2aec073a
    • Dr. Stephen Henson's avatar
      Don't access EVP_MD_CTX internals directly. · b714a1fe
      Dr. Stephen Henson authored
      (cherry picked from commit 04e45b52ee3be81121359cc1198fd01e38096e9f)
      b714a1fe
    • Andy Polyakov's avatar
      s3/s3_cbc.c: allow for compilations with NO_SHA256|512. · bbb4ee85
      Andy Polyakov authored
      (cherry picked from commit d5371324d978e4096bf99b9d0fe71b2cb65d9dc8)
      bbb4ee85
    • Andy Polyakov's avatar
      ssl/s3_cbc.c: md_state alignment portability fix. · 4af91ec0
      Andy Polyakov authored
      RISCs are picky and alignment granted by compiler for md_state can be
      insufficient for SHA512.
      (cherry picked from commit 36260233e7e3396feed884d3f501283e0453c04f)
      4af91ec0
    • Andy Polyakov's avatar
      ssl/s3_cbc.c: uint64_t portability fix. · 6b2a8439
      Andy Polyakov authored
      Break dependency on uint64_t. It's possible to declare bits as
      unsigned int, because TLS packets are limited in size and 32-bit
      value can't overflow.
      (cherry picked from commit cab13fc8473856a43556d41d8dac5605f4ba1f91)
      6b2a8439
    • Dr. Stephen Henson's avatar
      typo. · 6b1f7bee
      Dr. Stephen Henson authored
      (cherry picked from commit 34ab3c8c711ff79c2b768f0b17e4b2a78fd1df5d)
      6b1f7bee
    • Dr. Stephen Henson's avatar
      Add ordinal for CRYPTO_memcmp: since this will affect multiple · 8109e830
      Dr. Stephen Henson authored
      branches it needs to be in a "gap".
      (cherry picked from commit 81ce0e14e72e8e255ad1bd9c7cfaa47a6291919c)
      8109e830
    • Dr. Stephen Henson's avatar
      Timing fix mitigation for FIPS mode. · c4e6fb15
      Dr. Stephen Henson authored
      We have to use EVP in FIPS mode so we can only partially mitigate
      timing differences.
      
      Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
      to cover any timing differences caused by removal of padding.
      (cherry picked from commit b908e88ec15aa0a74805e3f2236fc4f83f2789c2)
      c4e6fb15
    • Ben Laurie's avatar
      Oops. Add missing file. · a693ead6
      Ben Laurie authored
      (cherry picked from commit 014265eb02e26f35c8db58e2ccbf100b0b2f0072)
      a693ead6
    • Ben Laurie's avatar
      Update DTLS code to match CBC decoding in TLS. · e33ac0e7
      Ben Laurie authored
      This change updates the DTLS code to match the constant-time CBC
      behaviour in the TLS.
      (cherry picked from commit 9f27de170d1b7bef3d46d41382dc4dafde8b3900)
      e33ac0e7
    • Ben Laurie's avatar
      Don't crash when processing a zero-length, TLS >= 1.1 record. · 93cab6b3
      Ben Laurie authored
      The previous CBC patch was bugged in that there was a path through enc()
      in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
      at the previous value which could suggest that the packet was a
      sufficient length when it wasn't.
      (cherry picked from commit 6cb19b7681f600b2f165e4adc57547b097b475fd)
      93cab6b3
    • Ben Laurie's avatar
      Make CBC decoding constant time. · 2acc020b
      Ben Laurie authored
      This patch makes the decoding of SSLv3 and TLS CBC records constant
      time. Without this, a timing side-channel can be used to build a padding
      oracle and mount Vaudenay's attack.
      
      This patch also disables the stitched AESNI+SHA mode pending a similar
      fix to that code.
      
      In order to be easy to backport, this change is implemented in ssl/,
      rather than as a generic AEAD mode. In the future this should be changed
      around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
      (cherry picked from commit e130841bccfc0bb9da254dc84e23bc6a1c78a64e)
      2acc020b
    • Ben Laurie's avatar
      Add and use a constant-time memcmp. · 7c770d57
      Ben Laurie authored
      This change adds CRYPTO_memcmp, which compares two vectors of bytes in
      an amount of time that's independent of their contents. It also changes
      several MAC compares in the code to use this over the standard memcmp,
      which may leak information about the size of a matching prefix.
      (cherry picked from commit 2ee798880a246d648ecddadc5b91367bee4a5d98)
      7c770d57
  5. Feb 04, 2013
  6. Feb 02, 2013
  7. Jan 24, 2013
  8. Jan 23, 2013
  9. Jan 22, 2013
  10. Jan 21, 2013
  11. Jan 20, 2013