- Jul 21, 2017
-
-
Andy Polyakov authored
"Optimize" is in quotes because it's rather a "salvage operation" for now. Idea is to identify processor capability flags that drive Knights Landing to suboptimial code paths and mask them. Two flags were identified, XSAVE and ADCX/ADOX. Former affects choice of AES-NI code path specific for Silvermont (Knights Landing is of Silvermont "ancestry"). And 64-bit ADCX/ADOX instructions are effectively mishandled at decode time. In both cases we are looking at ~2x improvement. AVX-512 results cover even Skylake-X :-) Hardware used for benchmarking courtesy of Atos, experiments run by Romain Dolbeau <romain.dolbeau@atos.net>. Kudos! Reviewed-by:Rich Salz <rsalz@openssl.org>
-
- Jul 20, 2017
-
-
Paul Yang authored
Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
-
Benjamin Kaduk authored
Looking at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf we see that in the CTR_DRBG_Update() algorithm (internal page number 51), the provided input data is (after truncation to seedlen) xor-d with the key and V vector (of length keylen and blocklen respectively). The comment in ctr_XOR notes that xor-ing with 0 is the identity function, so we can just ignore the case when the provided input is shorter than seedlen. The code in ctr_XOR() then proceeds to xor the key with the input, up to the amount of input present, and computes the remaining input that could be used to xor with the V vector, before accessing a full 16-byte stretch of the input vector and ignoring the calculated length. The correct behavior is to respect the supplied input length and only xor the indicated number of bytes. Reviewed-by:
-
Benjamin Kaduk authored
Reviewed-by:
-
Benjamin Kaduk authored
Reviewed-by:
-
Rich Salz authored
Replacement fix for #3975 Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Rich Salz authored
As suggested by Kurt. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3970)
-
- Jul 19, 2017
-
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Reviewed-by:
-
Dr. Stephen Henson authored
Reviewed-by:
-
Matt Caswell authored
The intention of the removed code was to check if the previous operation carried. However this does not work. The "mask" value always ends up being a constant and is all ones - thus it has no effect. This check is no longer required because of the previous commit. Reviewed-by:
-
Matt Caswell authored
In TLS mode of operation the padding value "pad" is obtained along with the maximum possible padding value "maxpad". If pad > maxpad then the data is invalid. However we must continue anyway because this is constant time code. We calculate the payload length like this: inp_len = len - (SHA_DIGEST_LENGTH + pad + 1); However if pad is invalid then inp_len ends up -ve (actually large +ve because it is a size_t). Later we do this: /* verify HMAC */ out += inp_len; len -= inp_len; This ends up with "out" pointing before the buffer which is undefined behaviour. Next we calculate "p" like this: unsigned char *p = out + len - 1 - maxpad - SHA256_DIGEST_LENGTH; Because of the "out + len" term the -ve inp_len value is cancelled out so "p" points to valid memory (although technically the pointer arithmetic is undefined behaviour again). We only ever then dereference "p" and never "out" directly so there is never an invalid read based on the bad pointer - so there is no security issue. This commit fixes the undefined behaviour by ensuring we use maxpad in place of pad, if the supplied pad is invalid. With thanks to Brian Carpenter for reporting this issue. Reviewed-by: -
Rich Salz authored
Ported from the last FIPS release, with DUAL_EC and SHA1 and the self-tests removed. Since only AES-CTR is supported, other code simplifications were done. Removed the "entropy blocklen" concept. Moved internal functions to new include/internal/rand.h. Reviewed-by:
-
- Jul 18, 2017
-
-
Matt Caswell authored
In particular add information about the effect of Nagle's algorithm on early data. Fixes #3906 Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3955)
-
Matt Caswell authored
We now allow a different protocol version when reusing a session so we can unconditionally reset the SSL_METHOD if it has changed. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
SSL_clear() does not reset the SSL_METHOD if a session already exists in the SSL object. However, TLSv1.3 does not have an externally visible version fixed method (only an internal one). The state machine assumes that we are always starting from a version flexible method for TLSv1.3. The simplest solution is to just fix SSL_clear() to always reset the method if it is using the internal TLSv1.3 version fixed method. Reviewed-by:
-
Matt Caswell authored
TLSv1.3 draft-21 requires the ticket nonce to be at least 1 byte in length. However NSS sends a zero length nonce. This is actually ok because the next draft will allow zero length nonces anyway, so we should tolerate this. Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
early_data is not allowed after an HRR. We failed to handle that correctly. Reviewed-by:
-
Emilia Kasper authored
This is an inherent weakness of the padding mode. We can't make the implementation constant time (see the comments in rsa_pk1.c), so add a warning to the docs. Reviewed-by:
-
- Jul 17, 2017
-
-
Emilia Kasper authored
Fixed in 5b8fa431 [ci skip] Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3924)
-
Bernd Edlinger authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3948)
-
Tatsuhiro Tsujikawa authored
Reviewed-by:
-
Rich Salz authored
Also fix a RANDerr call. Reviewed-by:
-
Pauli authored
Introduced by #3862 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3944)
-
- Jul 16, 2017
-
-
Rich Salz authored
Standardized the -rand flag and added a new one: -rand file... Always reads the specified files -writerand file Always writes to the file on exit For apps that use a config file, the RANDFILE config parameter reads the file at startup (to seed the RNG) and write to it on exit if the -writerand flag isn't used. Ensured that every app that took -rand also took -writerand, and made sure all of that agreed with all the documentation. Fix error reporting in write_file and -rand Reviewed-by: -
Rich Salz authored
Reviewed-by:
-
Pauli authored
This patch addresses the use of uninitialised data raised in Coverity issues 1414881 and 1414882. Reviewed-by:
-
- Jul 15, 2017
-
-
Andy Polyakov authored
New register usage pattern allows to achieve sligtly better performance. Not as much as I hoped for. Performance is believed to be limited by irreconcilable write-back conflicts, rather than lack of computational resources or data dependencies. Reviewed-by: -
Andy Polyakov authored
This gives much more freedom to rearrange instructions. This is unoptimized version, provided for reference. Basically you need to compare it to initial 29724d0e to figure out the key difference. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
If we have a local file with a name starting with 'file:', we don't want to check if the part after 'file:' is absolute. Instead, mark each possibility for absolute check if needed, and perform the absolute check later on, when checking each actual path. Reviewed-by:
-
Richard Levitte authored
These cases are performed on Linux only. They check that files with names starting with 'file:' can be processed as well. Reviewed-by:
-
Richard Levitte authored
To handle paths that contain devices (for example, C:/foo/bar.pem on Windows), try to "open" the URI using the file scheme loader first, and failing that, check if the device is really a scheme we know. The "file" scheme does the same kind of thing to pick out the path part of the URI. An exception to this special treatment is if the URI has an authority part (something that starts with "//" directly after what looks like a scheme). Such URIs will never be treated as plain file paths. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
We haven't tested plain absolute paths without making them URIs... Reviewed-by:
-
