- 02 Oct, 2018 1 commit
-
-
Sohaib ul Hassan authored
This commit implements coordinate blinding, i.e., it randomizes the representative of an elliptic curve point in its equivalence class, for prime curves implemented through EC_GFp_simple_method, EC_GFp_mont_method, and EC_GFp_nist_method. This commit is derived from the patch https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley. Coordinate blinding is a generally useful side-channel countermeasure and is (mostly) free. The function itself takes a few field multiplicationss, but is usually only necessary at the beginning of a scalar multiplication (as implemented in the patch). When used this way, it makes the values that variables take (i.e., field elements in an algorithm state) unpredictable. For instance, this mitigates chosen EC point side-channel attacks for settings such as ECDH and EC private key decryption, for the aforementioned curves. For EC_METHODs using different coordinate representations this commit does nothing, but the corresponding coordinate blinding function can be easily added in the future to extend these changes to such curves. Co-authored-by:
Nicola Tuveri <nic.tuv@gmail.com> Co-authored-by:
Billy Brumley <bbrumley@gmail.com> Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6526)
-
- 29 Sep, 2018 4 commits
-
-
Billy Brumley authored
This is a backport of #7028 to 1.1.0. It squashes the two original commits and applies changes for compatibility with 1.1.0. 1. cherry picked from commit 30c41bfb [test] ECC: make sure negative tests pass for the right reasons 2. cherry picked from commit bfb10b97 [test] throw error from wrapper function instead of an EC_METHOD specific one Given that in 1.1.0 `EC_POINT_get_affine_coordinates_GFp` and `EC_POINT_get_affine_coordinates_GF2m` have not been unified, in this backport the tests distinguish between the 2 different functions as the cause of the expected error. [extended tests] to trigger sanitizer checks and coverage analysis. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7152)
-
Billy Brumley authored
This is a backport of #6608 to 1.1.0. 1. For every named curve, two "golden" keypair positive tests. 2. Also two "golden" stock ECDH positive tests. 3. For named curves with non-trivial cofactors, additionally two "golden" ECC CDH positive tests. 4. For named curves with non-trivial cofactors, additionally two negative tests. There is some overlap with existing EVP tests, especially for the NIST curves (for example, positive testing ECC CDH KATs for NIST curves). "Golden" here means all the values are independent from OpenSSL's ECC code. I used sage to calculate them. What comes from OpenSSL is: 1. The OIDs (parsed by tooling) 2. The curve parameters (parsing ecparam output with tooling) The values inside the PEMs (private keys, public keys) and shared keys are from sage. The PEMs themselves are the output of asn1parse, with input taken from sage. (cherry picked from commit 249330de ) Reviewed-by:
-
Nicola Tuveri authored
This is a manual backport of #3472 to 1.1.0. This is a partial backport, limited only to evptests, as #3472 also affected bntests, which has a completely different form in 1.1.0. Reviewed-by:
-
Nicola Tuveri authored
This is a manual port of #3443 (and the related bugfix PR #3452) to 1.1.0. Reviewed-by:
-
- 24 Sep, 2018 2 commits
-
-
Daniel Bevenius authored
This commit documents the OPENSSL_VERSION_TEXT which is currently missing in the man page. Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7301) (cherry picked from commit 7c694957)
-
Pauli authored
Change all calls to getenv() inside libcrypto to use a new wrapper function that use secure_getenv() if available and an issetugid then getenv if not. CPU processor override flags are unchanged. Extra checks for OPENSSL_issetugid() have been removed in favour of the safe getenv. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7047) (cherry picked from commit 5c39a55d)
-
- 21 Sep, 2018 1 commit
-
-
Richard Levitte authored
This module includes bn.h via other headers, so it picks up the definition from there and doesn't need to define them locally (any more?). Worst case scenario, the redefinition may be different and cause all sorts of compile errors. Fixes #7227 Reviewed-by:
-
- 20 Sep, 2018 1 commit
-
-
Richard Levitte authored
These both indicate that the file descriptor we're trying to use as a terminal isn't, in fact, a terminal. Fixes #7271 Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7272) (cherry picked from commit 276bf862)
-
- 16 Sep, 2018 2 commits
-
-
Pauli authored
The latter causes problems when complex.h is #included. Reviewed-by:
-
Pauli authored
coexist. Reviewed-by:
-
- 13 Sep, 2018 1 commit
-
-
Matt Caswell authored
Caused a compilation failure in some environments Fixes #7204 Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7205) (cherry picked from commit bc278f30)
-
- 12 Sep, 2018 1 commit
-
-
Viktor Szakats authored
- fix to use secure URL in generated Windows resources - fix a potentially uninitialized variable CLA: trivial Reviewed-by:
-
- 11 Sep, 2018 3 commits
-
-
Bernd Edlinger authored
Reviewed-by:
-
parasssh authored
CLA: trivial (cherry picked from commit fa332bba ) Reviewed-by:
-
Richard Levitte authored
Since the SSL code started using RSA_NO_PADDING, the CAPI engine became unusable. This change fixes that. Fixes #7131 Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7174) (cherry picked from commit 37f49287)
-
- 10 Sep, 2018 1 commit
-
-
Matt Caswell authored
Found by Coverity Reviewed-by:
-
- 06 Sep, 2018 1 commit
-
-
Shane Lontis authored
Reviewed-by:
Paul Yang <yang.yang@baishancloud.com> Reviewed-by:
-
- 05 Sep, 2018 2 commits
-
-
Nicola Tuveri authored
Reviewed-by:
-
Nicola Tuveri authored
`RSA_free()` and friends are called in case of error from `RSA_new_method(ENGINE *e)` (or the respective equivalent functions). For the rest of the description I'll talk about `RSA_*`, but the same applies for the equivalent `DSA_free()`, `DH_free()`, `EC_KEY_free()`. If `RSA_new_method()` fails because the engine does not implement the required method, when `RSA_free(RSA *r)` is called, `r->meth == NULL` and a segfault happens while checking if `r->meth->finish` is defined. This commit fixes this issue by ensuring that `r->meth` is not NULL before dereferencing it to check for `r->meth->finish`. Fixes #7102 . Reviewed-by:
-
- 04 Sep, 2018 10 commits
-
-
Pauli authored
Manual backport from master. Reviewed-by:
-
Eric Curtin authored
-subj 'subject=C = US, ST = A, L = root, O = Hewlett Packard Enterprise Company, OU = Remote Device Access, CN = Hewlett Packard Enterprise Remote Device Access Test Local CA, emailAddress = rda@hpe.com' was a valid subject in openssl 1.0. Error received in 1.1 is: problems making Certificate Request Not very informative, I only figured this out because I compiled the code and added logging. Reviewed-by:
-
Pauli authored
Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Richard Levitte authored
With the introduction of -pkeyopt, the number of bits may change without |newkey| being updated. Unfortunately, there is no API to retrieve the information from a EVP_PKEY_CTX either, so chances are that we report incorrect information. For the moment, it's better not to try to report the number of bits at all. Fixes #7086 Reviewed-by:
-
Matt Caswell authored
They did not make it clear how the memory management works for the |pctx| parameter. Fixes #7037 Reviewed-by:
-
Jakub Wilk authored
The default input format is PEM, so explicit "-inform DER" is needed to read DER-encoded CRL. CLA: trivial Reviewed-by:
-
Matt Caswell authored
Just remove that statement. It's not been true since 2005. Reviewed-by:
-
- 03 Sep, 2018 3 commits
-
-
Paul Kehrer authored
Reviewed-by:
-
Paul Kehrer authored
fixes #7081 Reviewed-by:
-
Pauli authored
Reviewed-by:
-
- 02 Sep, 2018 1 commit
-
-
Eric Brown authored
This trivial patch removes a duplicated call to ASN1_INTEGER_set. Fixes Issue #6977 Signed-off-by:
Eric Brown <browne@vmware.com> Reviewed-by:
-
- 01 Sep, 2018 1 commit
-
-
Dmitry Belyavskiy authored
Reviewed-by:
-
- 30 Aug, 2018 1 commit
-
-
Matt Caswell authored
Thanks to @fangang190 for reporting this Fixes #7061 Reviewed-by:
-
- 28 Aug, 2018 4 commits
-
-
Andy Polyakov authored
(cherry picked from commit 324b9560 ) Reviewed-by:
-
Andy Polyakov authored
(cherry picked from commit e02c519c ) Resolved conflicts: crypto/bn/bn_blind.c Reviewed-by:
-
Andy Polyakov authored
In [most common] case of p and q being of same width, it's possible to replace CRT modulo operations with Montgomery reductions. And those are even fixed-length Montgomery reductions... (cherry picked from commit 41bfd5e7 ) Resolved conflicts: crypto/rsa/rsa_ossl.c Reviewed-by:
-
Andy Polyakov authored
Add bn_mul_fixed_top, bn_from_mont_fixed_top, bn_mod_sub_fixed_top. Switch to bn_{mul|sqr}_fixed_top in bn_mul_mont_fixed_top and remove memset in bn_from_montgomery_word. (cherry picked from commit fcc4ee09 ) Reviewed-by:
-
