Skip to content
  1. Feb 01, 2013
  2. Jan 31, 2013
  3. Jan 29, 2013
  4. Jan 28, 2013
    • Ben Laurie's avatar
      Oops. Add missing file. · 014265eb
      Ben Laurie authored
      014265eb
    • Ben Laurie's avatar
      Update DTLS code to match CBC decoding in TLS. · 9f27de17
      Ben Laurie authored
      This change updates the DTLS code to match the constant-time CBC
      behaviour in the TLS.
      9f27de17
    • Ben Laurie's avatar
      Don't crash when processing a zero-length, TLS >= 1.1 record. · 6cb19b76
      Ben Laurie authored
      The previous CBC patch was bugged in that there was a path through enc()
      in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
      at the previous value which could suggest that the packet was a
      sufficient length when it wasn't.
      6cb19b76
    • Ben Laurie's avatar
      Make CBC decoding constant time. · e130841b
      Ben Laurie authored
      This patch makes the decoding of SSLv3 and TLS CBC records constant
      time. Without this, a timing side-channel can be used to build a padding
      oracle and mount Vaudenay's attack.
      
      This patch also disables the stitched AESNI+SHA mode pending a similar
      fix to that code.
      
      In order to be easy to backport, this change is implemented in ssl/,
      rather than as a generic AEAD mode. In the future this should be changed
      around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
      e130841b
    • Ben Laurie's avatar
      Add and use a constant-time memcmp. · 2ee79888
      Ben Laurie authored
      This change adds CRYPTO_memcmp, which compares two vectors of bytes in
      an amount of time that's independent of their contents. It also changes
      several MAC compares in the code to use this over the standard memcmp,
      which may leak information about the size of a matching prefix.
      2ee79888
  5. Jan 23, 2013
  6. Jan 22, 2013
  7. Jan 20, 2013
  8. Jan 19, 2013
  9. Jan 14, 2013
  10. Jan 13, 2013
  11. Jan 12, 2013
  12. Jan 07, 2013
  13. Dec 30, 2012
  14. Dec 23, 2012
  15. Dec 16, 2012
  16. Dec 14, 2012
  17. Dec 13, 2012
  18. Dec 06, 2012
  19. Dec 05, 2012
  20. Dec 04, 2012
  21. Dec 03, 2012
  22. Dec 01, 2012
  23. Nov 29, 2012
    • Dr. Stephen Henson's avatar
      PR: 2803 · f20ba1c9
      Dr. Stephen Henson authored
      Submitted by: jean-etienne.schwartz@bull.net
      
      In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.
      f20ba1c9