Skip to content
  1. Jan 31, 2013
    • Dr. Stephen Henson's avatar
      Timing fix mitigation for FIPS mode. · b908e88e
      Dr. Stephen Henson authored
      We have to use EVP in FIPS mode so we can only partially mitigate
      timing differences.
      
      Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
      to cover any timing differences caused by removal of padding.
      b908e88e
  2. Jan 28, 2013
    • Ben Laurie's avatar
      Oops. Add missing file. · 014265eb
      Ben Laurie authored
      014265eb
    • Ben Laurie's avatar
      Update DTLS code to match CBC decoding in TLS. · 9f27de17
      Ben Laurie authored
      This change updates the DTLS code to match the constant-time CBC
      behaviour in the TLS.
      9f27de17
    • Ben Laurie's avatar
      Don't crash when processing a zero-length, TLS >= 1.1 record. · 6cb19b76
      Ben Laurie authored
      The previous CBC patch was bugged in that there was a path through enc()
      in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
      at the previous value which could suggest that the packet was a
      sufficient length when it wasn't.
      6cb19b76
    • Ben Laurie's avatar
      Make CBC decoding constant time. · e130841b
      Ben Laurie authored
      This patch makes the decoding of SSLv3 and TLS CBC records constant
      time. Without this, a timing side-channel can be used to build a padding
      oracle and mount Vaudenay's attack.
      
      This patch also disables the stitched AESNI+SHA mode pending a similar
      fix to that code.
      
      In order to be easy to backport, this change is implemented in ssl/,
      rather than as a generic AEAD mode. In the future this should be changed
      around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
      e130841b
    • Ben Laurie's avatar
      Add and use a constant-time memcmp. · 2ee79888
      Ben Laurie authored
      This change adds CRYPTO_memcmp, which compares two vectors of bytes in
      an amount of time that's independent of their contents. It also changes
      several MAC compares in the code to use this over the standard memcmp,
      which may leak information about the size of a matching prefix.
      2ee79888
  3. Jan 23, 2013
  4. Jan 22, 2013
  5. Jan 20, 2013
  6. Jan 19, 2013
  7. Jan 14, 2013
  8. Jan 13, 2013
  9. Jan 12, 2013
  10. Jan 07, 2013
  11. Dec 30, 2012
  12. Dec 23, 2012
  13. Dec 16, 2012
  14. Dec 14, 2012
  15. Dec 13, 2012
  16. Dec 06, 2012
  17. Dec 05, 2012
  18. Dec 04, 2012
  19. Dec 03, 2012
  20. Dec 01, 2012
  21. Nov 29, 2012
    • Dr. Stephen Henson's avatar
      PR: 2803 · f20ba1c9
      Dr. Stephen Henson authored
      Submitted by: jean-etienne.schwartz@bull.net
      
      In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.
      f20ba1c9
  22. Nov 22, 2012
  23. Nov 21, 2012
    • Dr. Stephen Henson's avatar
      PR: 2908 · eb3a3911
      Dr. Stephen Henson authored
      Submitted by: Dmitry Belyavsky <beldmit@gmail.com>
      
      Fix DH double free if parameter generation fails.
      eb3a3911
  24. Nov 20, 2012
  25. Nov 19, 2012
  26. Nov 18, 2012
    • Dr. Stephen Henson's avatar
      PR: 2880 · e7b85bc4
      Dr. Stephen Henson authored
      Submitted by: "Florian Rüchel" <florian.ruechel@ruhr-uni-bochum.de>
      
      Correctly handle local machine keys in the capi ENGINE.
      e7b85bc4
  27. Nov 15, 2012