summaryrefslogtreecommitdiff
path: root/lib/libcrypto/bn
AgeCommit message (Collapse)Author
2017-01-29Send the function codes from the error functions to the bit bucket,Bob Beck
as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
2017-01-25Construct a BN_gcd_nonct, based on BN_mod_inverse_no_branch, as suggestedBob Beck
by Alejandro Cabrera <aldaya@gmail.com> to avoid the possibility of a sidechannel timing attack during RSA private key generation. Modify BN_gcd to become not visible under LIBRESSL_INTERNAL and force the use of the _ct or _nonct versions of the function only within the library. ok jsing@
2017-01-21use BN_div_nonct where it is safe to do so.Bob Beck
ok guenther@
2017-01-21Add ct and nonct versions of BN_mod_inverse for internal useBob Beck
ok jsing@
2017-01-21Split out BN_div and BN_mod into ct and nonct versions for Internal use.Bob Beck
ok jsing@
2017-01-21Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatBob Beck
matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
2017-01-21/usr/bin/unifdef -D MONT_MUL_MOD -D MONT_EXP_WORD -D RECP_MUL_MOD -m bn_exp.cBob Beck
with some style cleanup after. no binary change ok jsing@
2017-01-04Remove superfluous datatype that is 32 by default. Clang complainsPatrick Wildt
about it and it's ok to remove it. This only came up as our clang is targeted at armv7 which enables the NEON instructions. ok kettenis@
2016-12-21Explicitly export a list of symbols from libcrypto.Joel Sing
Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
2016-11-08Reduce the ternary operator abusePhilip Guenther
ok miod@
2016-11-05Stop abusing the ternary operator to decide which function to call in aMiod Vallat
return statement. ok beck@ jsing@
2016-11-04Replace all uses of magic numbers when operating on OPENSSL_ia32_P[] byMiod Vallat
meaningful constants in a private header file, so that reviewers can actually get a chance to figure out what the code is attempting to do without knowing all cpuid bits. While there, turn it from an array of two 32-bit ints into a properly aligned 64-bit int. Use of OPENSSL_ia32_P is now restricted to the assembler parts. C code will now always use OPENSSL_cpu_caps() and check for the proper bits in the whole 64-bit word it returns. i386 tests and ok jsing@
2009-04-06import of OpenSSL 0.9.8kDamien Miller
2016-10-17If BN_div_word() fails (by returning (BN_ULONG)-1) or if the divisionPhilip Guenther
fails to reduce the input in the expected space then fail out instead of overflowing the allocated buffer. combines openssl commits 28a89639da50b1caed4ff3015508f23173bf3e49 and 3612ff6fcec0e3d1f2a598135fe12177c0419582 ok doug@ beck@
2016-09-04Less S390.Joel Sing
ok deraadt@
2016-09-04Less IA64.Joel Sing
ok deraadt@
2009-04-06import of OpenSSL 0.9.8kDamien Miller
2016-09-03switch to a constant-time gather procedure for amd64 mont5 asmBrent Cook
from OpenSSL commit 7f98aa7403a1244cf17d1aa489f5bb0f39bae431 CVE-2016-0702 ok beck@
2016-09-03add constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF.Brent Cook
Patch based on OpenSSL commit d7a854c055ff22fb7da80c3b0e7cb08d248591d0 "Performance penalty varies from platform to platform, and even key length. For rsa2048 sign it was observed to reach almost 10%." CVE-2016-0702 ok beck@
2016-09-03BN_mod_exp_mont_consttime: check for zero modulus.Brent Cook
Don't dereference d when top is zero. Original patch from OpenSSL commit d46e946d2603c64df6e1e4f9db0c70baaf1c4c03 ok jsing@
2016-09-02BN_mod_exp_mont_consttime: check for zero modulus.Brent Cook
Don't dereference d when top is zero. Original patch from OpenSSL commit d46e946d2603c64df6e1e4f9db0c70baaf1c4c03 ok jsing@
2016-08-31Avoid undefined-behavior right-shifting by a word-size # of bits.Brent Cook
Found with STACK, originally from OpenSSL, ok @beck
2016-07-18don't mix code and decls, ok tedu@Brent Cook
2016-07-17use memset to initialize the unionBrent Cook
2016-07-17Initialize buffers before use, noted by Kinichiro Inoguchi.Brent Cook
ok beck@
2016-07-05On systems where we do not have BN_ULLONG defined (most 64-bit systems),Brent Cook
BN_mod_word() can return incorrect results if the supplied modulus is too big, so we need to fall back to BN_div_word. Now that BN_mod_word may fail, handle errors properly update the man page. Thanks to Brian Smith for pointing out these fixes from BoringSSL: https://boringssl.googlesource.com/boringssl/+/67cb49d045f04973ddba0f92fe8a8ad483c7da89 https://boringssl.googlesource.com/boringssl/+/44bedc348d9491e63c7ed1438db100a4b8a830be ok beck@
2016-03-15'accomodate' -> 'accommodate' in comments.Kenneth R Westerback
Started by diff from Mical Mazurek.
2016-03-12Add error handling to the remaining calls to bn_wexpand().Brent Cook
Noticed by pascal-cuoq from Github: https://github.com/libressl-portable/openbsd/issues/56 ok beck@
2016-03-04graduate bn_expand() to a real function. the openssl version of thisTheo de Raadt
uses a macro with multiple-evaluations of arguments (different amount than the previous version..), but doug/bcook's inline version makes BIGNUM not opaque [problem spotted by naddy] ok doug
2016-03-04Revert bn_expand until there's consensus on a fix.Doug Hogan
2016-03-02Add bounds checking for BN_hex2bn/BN_dec2bn.Doug Hogan
Need to make sure i * 4 won't overflow. Based on OpenSSL: commit 99ba9fd02fd481eb971023a3a0a251a37eb87e4c input + ok bcook@ ok beck@
2015-12-24More adress -> addressMichael McConville
2015-11-06Fix gcc version preprocessor checks to cope with gcc 5.x and beyond;Miod Vallat
reported by Ruslan Babayev.
2015-10-21Reject too small bits value in BN_generate_prime_ex(), so that it does not riskMiod Vallat
becoming negative in probable_prime_dh_safe(). Reported by Franck Denis who noticed `openssl gendh 0' would segfault. Fix adapted from OpenSSL RT#2701. ok beck@ jsing@
2015-10-16actually include the prerequisite dependency for BIO instead of doing nastynessBob Beck
2015-09-28remove excessive brackets on pointer mathTheo de Raadt
2015-09-27Redo 1.25, without the NULL deref.Miod Vallat
ok sthen@ bcook@
2015-09-18Revert bn_print.c:r1.25 ("handle negative-zero in BN_bn2dec() too") forStuart Henderson
now, it has a NULL deref. Segfault reported by Mikolaj Kucharski, ok bcook
2015-09-13Handle negative-zero in BN_bn2dec() too, just like in BN_print().Theo de Raadt
ok miod
2015-09-13BN does support negative-zero -- BN_print() sets the standard here.Theo de Raadt
BN_bn2hex() had a 1-byte overflow when creating "-0\0". Reported to me a while back by unknown person -- did not have enough experience to push this through then. advice from jsing, ok miod
2015-09-12Remove workaround for old SIMICS toolchain.Miod Vallat
2015-09-12Remove horribly old and outdated `documentation' for the assembly code.Miod Vallat
2015-09-11Fixup inter-bank movq/movd operations, emit bytes for pclmulqdq again.Brent Cook
Fixes builds gcc + Apple's assembler, working on reenabling builds with older OpenBSD releases. based on OpenSSL commit: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=902b30df193afc3417a96ba72a81ed390bd50de3 ok miod@
2015-09-10Correct spelling of OPENSSL_cleanse.Joel Sing
ok miod@
2015-08-18typosMiod Vallat
2015-06-11Avoid an infinite loop that can be triggered by parsing an ASN.1Joel Sing
ECParameters structure that has a specially malformed binary polynomial field. Issue reported by Joseph Barr-Pixton and fix based on OpenSSL. Fixes CVE-2015-1788. ok doug@ miod@
2015-04-29Add missing BN_CTX_end() calls.Doug Hogan
After calling BN_CTX_start(), there must be a BN_CTX_end() before returning. There were missing BN_CTX_end() calls in error paths. One diff chunk was simply removing redundant code related to this. ok deraadt@
2015-03-21Fix indentation that incorrectly implies a different control flow.Doug Hogan
The actual control flow is intentional while the indenting is incorrect. This is intended to be a cosmetic change. Verified that each of these was part of a KNF commit that wasn't intending to change behavior. Also, double checked against the history of changes in OpenSSL and BoringSSL. Addresses Coverity CIDs: 78842, 78859, 78863. ok tedu@
2015-02-25Fix CVE-2014-3570: properly calculate the square of a BIGNUM value.Brent Cook
See https://www.openssl.org/news/secadv_20150108.txt for a more detailed discussion. Original OpenSSL patch here: https://github.com/openssl/openssl/commit/a7a44ba55cb4f884c6bc9ceac90072dea38e66d0 The regression test is modified a little for KNF. ok miod@
2015-02-19If BN_rand() or BN_pseudo_rand() are called with a NULL rnd argument,Joel Sing
BN_bin2bn() will helpfully allocate a BN which is then leaked. Avoid this by explicitly checking for NULL at the start of the bnrand() function. Fixes Coverity ID 78831. ok miod@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 10:28:36 +0000