Commit 1139eeec authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Merge from 0.9.8 stable branch.

parent 1b936a5e

CHANGES

+51 −0
Original line number Diff line number Diff line
@@ -160,6 +160,57 @@ 


     [Matthew D Wood (Intel Corp)]



  *) Add the Korean symmetric 128-bit cipher SEED (see

     http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and

     add SEED ciphersuites from RFC 4162:



        TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"

        TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"

        TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"

        TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"



     To minimize changes between patchlevels in the OpenSSL 0.9.8

     series, SEED remains excluded from compilation unless OpenSSL

     is configured with 'enable-seed'.

     [KISA, Bodo Moeller]



  *) Mitigate branch prediction attacks, which can be practical if a

     single processor is shared, allowing a spy process to extract

     information.  For detailed background information, see

     http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,

     J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL

     and Necessary Software Countermeasures").  The core of the change

     are new versions BN_div_no_branch() and

     BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),

     respectively, which are slower, but avoid the security-relevant

     conditional branches.  These are automatically called by BN_div()

     and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one

     of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to

     remove a conditional branch.



     BN_FLG_CONSTTIME is the new name for the previous

     BN_FLG_EXP_CONSTTIME flag, since it now affects more than just

     modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag

     in the exponent causes BN_mod_exp_mont() to use the alternative

     implementation in BN_mod_exp_mont_consttime().)  The old name

     remains as a deprecated alias.



     Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general

     RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses

     constant-time implementations for more than just exponentiation.

     Here too the old name is kept as a deprecated alias.



     BN_BLINDING_new() will now use BN_dup() for the modulus so that

     the BN_BLINDING structure gets an independent copy of the

     modulus.  This means that the previous "BIGNUM *m" argument to

     BN_BLINDING_new() and to BN_BLINDING_create_param() now

     essentially becomes "const BIGNUM *m", although we can't actually

     change this in the header file before 0.9.9.  It allows

     RSA_setup_blinding() to use BN_with_flags() on the modulus to

     enable BN_FLG_CONSTTIME.



     [Matthew D Wood (Intel Corp)]



  *) In the SSL/TLS server implementation, be strict about session ID

     context matching (which matters if an application uses a single

     external cache for different purposes).  Previously,

Configure

+5 −4
Original line number Diff line number Diff line
@@ -614,6 +614,7 @@ my %disabled = ( # "what" => "comment" 
                 "mdc2"           => "default",

                 "rc5"            => "default",

                 "rfc3779"        => "default",

                 "seed"           => "default",

                 "shared"         => "default",

                 "zlib"           => "default",

                 "zlib-dynamic"   => "default"
@@ -624,7 +625,7 @@ my %disabled = ( # "what" => "comment" 
# For symmetry, "disable-..." is a synonym for "no-...".



# This is what $depflags will look like with the above default:

my $default_depflags = "-DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_GMP -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 ";

my $default_depflags = "-DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_GMP -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED ";





my $no_sse2=0;

Makefile.org

+1 −1
Original line number Diff line number Diff line
@@ -141,7 +141,7 @@ SHLIBDIRS= crypto ssl fips 
SDIRS=  \

	objects \

	md2 md4 md5 sha mdc2 hmac ripemd \

	des aes rc2 rc4 rc5 idea bf cast camellia \

	des aes rc2 rc4 rc5 idea bf cast camellia seed \

	bn ec rsa dsa ecdsa dh ecdh dso engine \

	buffer bio stack lhash rand err \

	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \

apps/dsa.c

+4 −0
Original line number Diff line number Diff line
@@ -87,6 +87,7 @@ 
 * -camellia128 - encrypt output if PEM format

 * -camellia192 - encrypt output if PEM format

 * -camellia256 - encrypt output if PEM format

 * -seed        - encrypt output if PEM format

 * -text	- print a text version

 * -modulus	- print the DSA public key

 */
@@ -218,6 +219,9 @@ bad: 
#ifndef OPENSSL_NO_CAMELLIA

		BIO_printf(bio_err," -camellia128, -camellia192, -camellia256\n");

		BIO_printf(bio_err,"                 encrypt PEM output with cbc camellia\n");

#endif

#ifndef OPENSSL_NO_SEED

		BIO_printf(bio_err," -seed           encrypt PEM output with cbc seed\n");

#endif

		BIO_printf(bio_err," -text           print the key in text\n");

		BIO_printf(bio_err," -noout          don't print key out\n");

apps/gendsa.c

+8 −0
Original line number Diff line number Diff line
@@ -140,6 +140,10 @@ int MAIN(int argc, char **argv) 
		else if (strcmp(*argv,"-idea") == 0)

			enc=EVP_idea_cbc();

#endif

#ifndef OPENSSL_NO_SEED

		else if (strcmp(*argv,"-seed") == 0)

			enc=EVP_seed_cbc();

#endif

#ifndef OPENSSL_NO_AES

		else if (strcmp(*argv,"-aes128") == 0)

			enc=EVP_aes_128_cbc();
@@ -178,6 +182,10 @@ bad: 
#ifndef OPENSSL_NO_IDEA

		BIO_printf(bio_err," -idea     - encrypt the generated key with IDEA in cbc mode\n");

#endif

#ifndef OPENSSL_NO_SEED

		BIO_printf(bio_err," -seed\n");

		BIO_printf(bio_err,"                 encrypt PEM output with cbc seed\n");

#endif

#ifndef OPENSSL_NO_AES

		BIO_printf(bio_err," -aes128, -aes192, -aes256\n");

		BIO_printf(bio_err,"                 encrypt PEM output with cbc aes\n");