- 16 Jul, 2018 1 commit
-
-
Nicola Tuveri authored
for specialized Montgomery ladder implementations PR #6009 and #6070 replaced the default EC point multiplication path for prime and binary curves with a unified Montgomery ladder implementation with various timing attack defenses (for the common paths when a secret scalar is feed to the point multiplication). The newly introduced default implementation directly used EC_POINT_add/dbl in the main loop. The scaffolding introduced by this commit allows EC_METHODs to define a specialized `ladder_step` function to improve performances by taking advantage of efficient formulas for differential addition-and-doubling and different coordinate systems. - `ladder_pre` is executed before the main loop of the ladder: by default it copies the input point P into S, and doubles it into R. Specialized implementations could, e.g., use this hook to transition to different coordinate systems before copying and doubling; - `ladder_step` is the core of the Montgomery ladder loop: by default it computes `S := R+S; R := 2R;`, but specific implementations could, e.g., implement a more efficient formula for differential addition-and-doubling; - `ladder_post` is executed after the Montgomery ladder loop: by default it's a noop, but specialized implementations could, e.g., use this hook to transition back from the coordinate system used for optimizing the differential addition-and-doubling or recover the y coordinate of the result point. This commit also renames `ec_mul_consttime` to `ec_scalar_mul_ladder`, as it better corresponds to what this function does: nothing can be truly said about the constant-timeness of the overall execution of this function, given that the underlying operations are not necessarily constant-time themselves. What this implementation ensures is that the same fixed sequence of operations is executed for each scalar multiplication (for a given EC_GROUP), with no dependency on the value of the input scalar. Co-authored-by:
Sohaib ul Hassan <soh.19.hassan@gmail.com> Co-authored-by:
Billy Brumley <bbrumley@gmail.com> Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6690)
-
- 08 Jul, 2018 1 commit
-
-
Kurt Roeckx authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> GH: #6666
-
- 26 Jun, 2018 1 commit
-
-
Pauli authored
This allows operation inside a chroot environment without having the random device present. A new call, RAND_keep_random_devices_open(), has been introduced that can be used to control file descriptor use by the random seed sources. Some seed sources maintain open file descriptors by default, which allows such sources to operate in a chroot(2) jail without the associated device nodes being available. Reviewed-by:
-
- 22 Jun, 2018 2 commits
-
-
Matt Caswell authored
Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6550)
-
Andy Polyakov authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6487)
-
- 21 Jun, 2018 2 commits
-
-
Nicola Tuveri authored
Reviewed-by:
-
Matt Caswell authored
This extends the recently added ECDSA signature blinding to blind DSA too. This is based on side channel attacks demonstrated by Keegan Ryan (NCC Group) for ECDSA which are likely to be able to be applied to DSA. Normally, as in ECDSA, during signing the signer calculates: s:= k^-1 * (m + r * priv_key) mod order In ECDSA, the addition operation above provides a sufficient signal for a flush+reload attack to derive the private key given sufficient signature operations. As a mitigation (based on a suggestion from Keegan) we add blinding to the operation so that: s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order Since this attack is a localhost side channel only no CVE is assigned. This commit also tweaks the previous ECDSA blinding so that blinding is only removed at the last possible step. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6522)
-
- 19 Jun, 2018 1 commit
-
-
Sohaib ul Hassan authored
This commit implements coordinate blinding, i.e., it randomizes the representative of an elliptic curve point in its equivalence class, for prime curves implemented through EC_GFp_simple_method, EC_GFp_mont_method, and EC_GFp_nist_method. This commit is derived from the patch https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley. Coordinate blinding is a generally useful side-channel countermeasure and is (mostly) free. The function itself takes a few field multiplicationss, but is usually only necessary at the beginning of a scalar multiplication (as implemented in the patch). When used this way, it makes the values that variables take (i.e., field elements in an algorithm state) unpredictable. For instance, this mitigates chosen EC point side-channel attacks for settings such as ECDH and EC private key decryption, for the aforementioned curves. For EC_METHODs using different coordinate representations this commit does nothing, but the corresponding coordinate blinding function can be easily added in the future to extend these changes to such curves. Co-authored-by:
Nicola Tuveri <nic.tuv@gmail.com> Co-authored-by:
-
- 13 Jun, 2018 1 commit
-
-
Matt Caswell authored
Keegan Ryan (NCC Group) has demonstrated a side channel attack on an ECDSA signature operation. During signing the signer calculates: s:= k^-1 * (m + r * priv_key) mod order The addition operation above provides a sufficient signal for a flush+reload attack to derive the private key given sufficient signature operations. As a mitigation (based on a suggestion from Keegan) we add blinding to the operation so that: s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order Since this attack is a localhost side channel only no CVE is assigned. Reviewed-by:
-
- 24 May, 2018 1 commit
-
-
Matt Caswell authored
When signing or verifying a file using pkeyutl the input is supposed to be a hash. Some algorithms sanity check the length of the input, while others don't and silently truncate. To avoid accidents we check that the length of the input looks sane. Reviewed-by:
-
- 22 May, 2018 1 commit
-
-
Kurt Roeckx authored
Because TLS 1.3 sends more non-application data records some clients run into problems because they don't expect SSL_read() to return and set SSL_ERROR_WANT_READ after processing it. This can cause problems for clients that use blocking I/O and use select() to see if data is available. It can be cleared using SSL_CTX_clear_mode(). Reviewed-by:
-
- 12 May, 2018 1 commit
-
-
Richard Levitte authored
Fixes #4716 Reviewed-by:
-
- 09 May, 2018 4 commits
-
-
Nicola Tuveri authored
Reviewed-by:
-
Billy Brumley authored
Reviewed-by:
-
Billy Brumley authored
Reviewed-by:
-
Billy Brumley authored
* EC_POINT_mul is now responsible for constant time point multiplication (for single fixed or variable point multiplication, when the scalar is in the range [0,group_order), so we need to strip the nonce padding from ECDSA. * Entry added to CHANGES * Updated EC_POINT_mul documentation - Integrate existing EC_POINT_mul and EC_POINTs_mul entries in the manpage to reflect the shift in constant-time expectations when performing a single fixed or variable point multiplication; - Add documentation to ec_method_st to reflect the updated "contract" between callers and implementations of ec_method_st.mul. Reviewed-by:
-
- 19 Apr, 2018 1 commit
-
-
A. Schulze authored
CLA: trivial Reviewed-by:
-
- 17 Apr, 2018 1 commit
-
-
Richard Levitte authored
Reviewed-by:
-
- 05 Apr, 2018 1 commit
-
-
Matt Caswell authored
When libssl is initialised it will attempt to load any config file. This ensures any system_default configuration (as per https://github.com/openssl/openssl/pull/4848 ) is used. Reviewed-by:
-
- 04 Apr, 2018 1 commit
-
-
Bernd Edlinger authored
Reviewed-by:
-
- 03 Apr, 2018 2 commits
-
-
Matt Caswell authored
Where a CMS detached signature is used with text content the text goes through a canonicalisation process first prior to signing or verifying a signature. This process strips trailing space at the end of lines, converts line terminators to CRLF and removes additional trailing line terminators at the end of a file. A bug in the canonicalisation process meant that some characters, such as form-feed, were incorrectly treated as whitespace and removed. This is contrary to the specification (RFC5485). This fix could mean that detached text data signed with an earlier version of OpenSSL 1.1.0 may fail to verify using the fixed version, or text data signed with a fixed OpenSSL may fail to verify with an earlier version of OpenSSL 1.1.0. A workaround is to only verify the canonicalised text data and use the "-binary" flag (for the "cms" command line application) or set the SMIME_BINARY/PKCS7_BINARY/CMS_BINARY flags (if using CMS_verify()). Reviewed-by:
-
Matt Caswell authored
Fix the last release version number in CHANGES Reviewed-by:
-
- 29 Mar, 2018 1 commit
-
-
Dr. Matthias St. Pierre authored
The RAND_DRBG API was added in PR #5462 and modified by PR #5547. This commit adds the corresponding documention. Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> Reviewed-by:
-
- 27 Mar, 2018 1 commit
-
-
Matt Caswell authored
Reviewed-by:
-
- 26 Mar, 2018 1 commit
-
-
Rich Salz authored
Reviewed-by:
-
- 19 Mar, 2018 1 commit
-
-
Matt Caswell authored
Reviewed-by:
-
- 14 Mar, 2018 1 commit
-
-
Matt Caswell authored
Reviewed-by:
-
- 07 Mar, 2018 1 commit
-
-
Viktor Dukhovni authored
With "-multi" the OCSP responder forks multiple child processes, and respawns them as needed. This can be used as a long-running service, not just a demo program. Therefore the index file is automatically re-read when changed. The responder also now optionally times out client requests. Reviewed-by:
-
- 05 Mar, 2018 1 commit
-
-
Matt Caswell authored
Reviewed-by:
-
- 04 Mar, 2018 1 commit
-
-
Rich Salz authored
Reviewed-by:
-
- 02 Mar, 2018 1 commit
-
-
Matt Caswell authored
Reviewed-by:
-
- 23 Feb, 2018 1 commit
-
-
Richard Levitte authored
[extended tests] Reviewed-by:
-
- 13 Feb, 2018 3 commits
-
-
Matt Caswell authored
Reviewed-by: -
Dr. Matthias St. Pierre authored
Removed mixed tabs (converted tabs to eight spaces) Reviewed-by:
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
- 12 Feb, 2018 1 commit
-
-
Matt Caswell authored
Fix a typo in INSTALL and update the link in CHANGES Reviewed-by:
-
- 07 Feb, 2018 1 commit
-
-
Matt Caswell authored
[extended tests] Reviewed-by:
-
- 29 Jan, 2018 1 commit
-
-
Richard Levitte authored
Reviewed-by:
-
- 28 Jan, 2018 1 commit
-
-
Richard Levitte authored
Reviewed-by:
-
- 23 Jan, 2018 1 commit
-
-
Pauli authored
Support added for these two digests, available only via the EVP interface. Reviewed-by:
-
