- Jun 21, 2018
-
-
Nick Mathewson authored
Also, modernize the code, so that it isn't trying to store a size_t into an int, and then check the int's sign. :/ Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6271) (cherry picked from commit c8c25033) (cherry picked from commit 50d06d1c)
-
Richard Levitte authored
Reviewed-by:
-
Nick Mathewson authored
In previous versions of OpenSSL, the documentation for PEM_read_* said: The callback B<must> return the number of characters in the passphrase or 0 if an error occurred. But since c82c3462 , 0 is now treated as a non-error return value. Applications that want to indicate an error need to return -1 instead. Reviewed-by:
-
Matt Caswell authored
This extends the recently added ECDSA signature blinding to blind DSA too. This is based on side channel attacks demonstrated by Keegan Ryan (NCC Group) for ECDSA which are likely to be able to be applied to DSA. Normally, as in ECDSA, during signing the signer calculates: s:= k^-1 * (m + r * priv_key) mod order In ECDSA, the addition operation above provides a sufficient signal for a flush+reload attack to derive the private key given sufficient signature operations. As a mitigation (based on a suggestion from Keegan) we add blinding to the operation so that: s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order Since this attack is a localhost side channel only no CVE is assigned. This commit also tweaks the previous ECDSA blinding so that blinding is only removed at the last possible step. Reviewed-by:
-
- Jun 19, 2018
-
-
Matt Caswell authored
Fixes #5322 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6510)
-
- Jun 18, 2018
-
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Nicola Tuveri authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6465)
-
- Jun 13, 2018
-
-
Matt Caswell authored
Keegan Ryan (NCC Group) has demonstrated a side channel attack on an ECDSA signature operation. During signing the signer calculates: s:= k^-1 * (m + r * priv_key) mod order The addition operation above provides a sufficient signal for a flush+reload attack to derive the private key given sufficient signature operations. As a mitigation (based on a suggestion from Keegan) we add blinding to the operation so that: s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order Since this attack is a localhost side channel only no CVE is assigned. Reviewed-by:
-
- Jun 12, 2018
-
-
Guido Vranken authored
CVE-2018-0732 Signed-off-by:
Guido Vranken <guidovranken@gmail.com> (cherry picked from commit 91f7361f ) Reviewed-by:
-
- Jun 09, 2018
-
-
Andy Polyakov authored
This module is used only with odd input lengths, i.e. not used in normal PKI cases, on contemporary processors. The problem was "illuminated" by fuzzing tests. Reviewed-by:
-
- Jun 02, 2018
-
-
Ken Goldman authored
ECDSA_SIG_new() returns NULL on error. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
-
- May 31, 2018
-
-
Richard Levitte authored
Just because an engine implements algorithm methods, that doesn't mean it also implements the ASN1 method. Therefore, be careful when looking for an ASN1 method among all engines, don't try to use one that doesn't exist. Fixes #6381 Reviewed-by:
-
Richard Levitte authored
XN_FLAG_COMPAT has a unique property, its zero for value. This means it needs special treatment; if it has been set (which can only be determined indirectly) and set alone (*), no other flags should be set. (*) if any other nameopt flag has been set by the user, compatibility mode is blown away. Reviewed-by:
-
- May 29, 2018
-
-
Matt Caswell authored
Thanks to Guido Vranken and OSSFuzz for finding this issue. Reviewed-by:
-
- May 23, 2018
-
-
Matt Caswell authored
The variable in question can never be used uninitialised, but we silence the compiler anyway. Fixes #6301 Reviewed-by:
-
- May 21, 2018
-
-
Matt Caswell authored
If the lengths of both names is 0 then don't attempt to do a memcmp. Issue reported by Simon Friedberger, Robert Merget and Juraj Somorovsky. Reviewed-by:
-
- May 18, 2018
-
-
Andy Polyakov authored
Configure detects if compiler can generate dependency lists for any command name, while this script didn't quite tolerate arbitrary one. Reviewed-by:
-
- May 17, 2018
-
-
Matt Caswell authored
Experiments have shown that the lookup table used by BN_GF2m_mod_arr introduces sufficient timing signal to recover the private key for an attacker with access to cache timing information on the victim's host. This only affects binary curves (which are less frequently used). No CVE is considered necessary for this issue. The fix is to replace the lookup table with an on-the-fly calculation of the value from the table instead, which can be performed in constant time. Thanks to Youngjoo Shin for reporting this issue. Reviewed-by:
-
- May 14, 2018
-
-
Richard Levitte authored
Fixes #6241 Reviewed-by:
-
Richard Levitte authored
The Console UI method always set echo on after prompting without echo. However, echo might not have been on originally, so just restore the original TTY settings. Fixes #2373 Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6158)
-
- May 12, 2018
-
-
Pavel Kopyl authored
(cherry picked from commit aebd0e5c ) Reviewed-by:
-
Matt Caswell authored
In DTLS if we have buffered a fragment for a zero length message (e.g. ServerHelloDone) then, when we unbuffered the fragment, we were attempting to memcpy the contents of the fragment which is zero length and a NULL pointer. This is undefined behaviour. We should check first whether we have a zero length fragment. Fixes a travis issue. [extended tests] Reviewed-by:
-
Richard Levitte authored
Fixes #4716 Reviewed-by:
-
- May 11, 2018
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
-
- May 05, 2018
-
-
Emilia Kasper authored
- Reject fractional seconds - Reject offsets - Check that the date/time digits are in valid range. - Add documentation for X509_cmp_time GH issue 2620 Backported from 80770da3 Reviewed-by:
-
- May 04, 2018
-
-
Richard Levitte authored
When the input length is zero, just return zero early. Otherwise, there's a small chance that memory allocation is engaged, fails and returns -1, which is a bit confusing when nothing should be written. Fixes #4782 #4827 Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/6175) (cherry picked from commit 0d94212a)
-
Andy Polyakov authored
Montgomery multiplication post-conditions in some of code paths were formally non-constant time. Cache access pattern was result-neutral, but a little bit asymmetric, which might have produced a signal [if processor reordered load and stores at run-time]. Reviewed-by:
-
- May 03, 2018
-
-
Dr. Matthias St. Pierre authored
Fixes #6121 Thanks to Mingtao Yang for reporting this bug. Reviewed-by:
-
Todd Short authored
Earlier Apple Xcode compilers, e.g. one targeting Mac OS X 10.7, don't support dependency generation and one still has to use makedepend. It's unclear when it was fixed, but all clang-based Apple compilers seem to support -M options. Reviewed-by:
-
- May 02, 2018
-
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
The ciphers field in a session contains the stack of ciphers offered by the client. Reviewed-by:
-
Matt Caswell authored
The function SSL_get_shared_ciphers() is supposed to return ciphers shared by the client and the server. However it only ever returned the client ciphers. Fixes #5317 Reviewed-by:
-
Dr. Matthias St. Pierre authored
which is used for ASN1_STRING_print_ex*() and X509_NAME_print_ex*(). Reviewed-by:
-
- May 01, 2018
-
-
Matt Caswell authored
Specifically this is not supported with an even modulus and BN_FLG_CONSTTIME. Fixes #5082 Reviewed-by:
-
Matt Caswell authored
Fixes #5063 Reviewed-by:
-
- Apr 27, 2018
-
-
Matt Caswell authored
Make it clear that you should not attempt to get the version before the first handshake is complete. Fixes #2893 Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Billy Brumley authored
Reviewed-by:
-
Cristian Stoica authored
This patch fixes the following two warnings when OpenSSL is built with no-dh option: s_server.c: In function 's_server_main': s_server.c:1105:25: warning: variable 'no_dhe' set but not used [-Wunused-but-set-variable] int no_tmp_rsa = 0, no_dhe = 0, no_ecdhe = 0, nocert = 0; ^ s_server.c:1101:11: warning: variable 'dhfile' set but not used [-Wunused-but-set-variable] char *dhfile = NULL; ^ CLA: trivial Signed-off-by:Cristian Stoica <cristian.stoica@nxp.com> Reviewed-by:
-
