summaryrefslogtreecommitdiff
path: root/lib/libcrypto/rsa
AgeCommit message (Collapse)Author
2018-09-12Add some accessor functions:Damien Miller
RSA_meth_get_finish() RSA_meth_set1_name() EVP_CIPHER_CTX_(get|set)_iv() feedback and ok jsing@ tb@
2018-09-05use timing-safe compares for checking results in signature verificationDamien Miller
(there are no known attacks, this is just inexpensive prudence) feedback and ok tb@ jsing@
2018-08-24Add consts to EVP_PKEY_asn1_set_private()Theo Buehler
Requires adding a const to the priv_decode() member of EVP_PKEY_ASN1_METHOD and adjusting all *_priv_decode() functions. All this is already documented this way. tested in a bulk build by sthen ok jsing
2018-08-19whitespace fixTheo Buehler
2018-08-19Don't leak db on error in RSA_padding_check_PKCS1_OAEP().Theo Buehler
CID #183499. input & ok jsing, ok mestre on first version
2018-08-05In RSA_padding_add_PKCS1_OAEP, dbmask needs to be freed on failure.Brent Cook
ok tb@
2018-07-23Implement RSASSA-PKCS1-v1_5 as specified in RFC 8017.Theo Buehler
Based on an OpenSSL commit by David Benjamin. Alex Gaynor and Paul Kehrer from the pyca/cryptography Python library reported that more than 200 "expected to fail" signatures among Project Wycheproof's test vectors validated on LibreSSL. This patch makes them all fail. ok jsing commit 608a026494c1e7a14f6d6cfcc5e4994fe2728836 Author: David Benjamin <davidben@google.com> Date: Sat Aug 20 13:35:17 2016 -0400 Implement RSASSA-PKCS1-v1_5 as specified. RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode the DigestInfo struct and then compare the result against the public key operation result. This implies that one and only one encoding is legal. OpenSSL instead parses with crypto/asn1, then checks that the encoding round-trips, and allows some variations for the parameter. Sufficient laxness in this area can allow signature forgeries, as described in https://www.imperialviolet.org/2014/09/26/pkcs1.html Although there aren't known attacks against OpenSSL's current scheme, this change makes OpenSSL implement the algorithm as specified. This avoids the uncertainty and, more importantly, helps grow a healthy ecosystem. Laxness beyond the spec, particularly in implementations which enjoy wide use, risks harm to the ecosystem for all. A signature producer which only tests against OpenSSL may not notice bugs and accidentally become widely deployed. Thus implementations have a responsibility to honor the specification as tightly as is practical. In some cases, the damage is permanent and the spec deviation and security risk becomes a tax all implementors must forever pay, but not here. Both BoringSSL and Go successfully implemented and deployed RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so this change should be compatible enough to pin down in future OpenSSL releases. See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00 As a bonus, by not having to deal with sign/verify differences, this version is also somewhat clearer. It also more consistently enforces digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath wasn't quite doing this right. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1474
2018-04-14make ENGINE_finish() succeed on NULL and simplify callers as inTheo Buehler
OpenSSL commit 7c96dbcdab9 by Rich Salz. This cleans up the caller side quite a bit and reduces the number of lines enclosed in #ifndef OPENSSL_NO_ENGINE. codesearch.debian.net shows that almost nothing checks the return value of ENGINE_finish(). While there, replace a few nearby 'if (!ptr)' with 'if (ptr == NULL)'. ok jsing, tested by & ok inoguchi
2018-03-17Provide RSA_meth_{dup,free,new,set_{finish,priv_{dec,enc}}}()Theo Buehler
Note that these functions return NULL in out-of-memory situations, but contrary to OpenSSL's versions they do not set an error. ok jsing
2018-02-20Provide RSA_{clear,set,test}_flasg()Theo Buehler
ok jsing
2018-02-18Provide RSA_{g,s}et0_crt_params()Theo Buehler
ok jsing
2018-02-18Use usual order of RSA_{g,s}et0_key().Theo Buehler
ok jsing
2018-02-18Provide RSA_{g,s}et0_factors()Theo Buehler
ok jsing
2018-02-18Provide RSA_bits()Theo Buehler
ok jsing
2018-02-17Provide further parts of the OpenSSL 1.1 API: {DH,DSA}_get0_{key,pqg}(),Theo Buehler
EVP_PKEY_get0_{DH,DSA,RSA}(), RSA_{g,s}et0_key(). ok jsing
2017-08-30Bring back the RSA_SSLV23_PADDING define.Joel Sing
Several pieces of software expect this to be available unconditionally.
2017-08-28Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedJoel Sing
code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
2017-05-02use freezero() instead of memset/explicit_bzero + free. SubstantiallyTheo de Raadt
reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
2017-04-28revert previous accidental commitBob Beck
2017-04-28*** empty log message ***Bob Beck
2017-01-29Send the function codes from the error functions to the bit bucket,Bob Beck
as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
2017-01-25Construct a BN_gcd_nonct, based on BN_mod_inverse_no_branch, as suggestedBob Beck
by Alejandro Cabrera <aldaya@gmail.com> to avoid the possibility of a sidechannel timing attack during RSA private key generation. Modify BN_gcd to become not visible under LIBRESSL_INTERNAL and force the use of the _ct or _nonct versions of the function only within the library. ok jsing@
2017-01-21Add ct and nonct versions of BN_mod_inverse for internal useBob Beck
ok jsing@
2017-01-21Split out BN_div and BN_mod into ct and nonct versions for Internal use.Bob Beck
ok jsing@
2017-01-21Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatBob Beck
matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
2016-12-30Expand ASN1_ITEM_rptr macros - no change in generated assembly.Joel Sing
2016-12-21Explicitly export a list of symbols from libcrypto.Joel Sing
Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
2016-10-19unifdef OPENSSL_NO_CMSJoel Sing
2016-09-04Expand DECLARE_ASN1_.*FUNCTIONS macros.Joel Sing
No change in preprocessed output, ignoring whitespace and line numbers.
2016-09-02missing space after commaTheo Buehler
ok bcook
2016-07-07call BN_init on temporaries to avoid use-before-set warningsBrent Cook
ok beck@
2016-06-30Remove flags for disabling constant-time operations.Brent Cook
This removes support for DSA_FLAG_NO_EXP_CONSTTIME, DH_FLAG_NO_EXP_CONSTTIME, and RSA_FLAG_NO_CONSTTIME flags, making all of these operations unconditionally constant-time. Based on the original patch by César Pereid. ok beck@
2015-12-03Fix for OpenSSL CVE-2015-3194Bob Beck
ok krw@
2015-09-30Replace M_ASN1_OCTET_STRING_(free|new) with ASN1_OCTET_STRING_(free|new).Joel Sing
2015-09-10Correct spelling of OPENSSL_cleanse.Joel Sing
ok miod@
2015-07-19Drop stupid (int) casts for the arguments of malloc() and friends. This isMiod Vallat
not 16-bit MS-DOS anymore. ok bcook@ tedu@
2015-06-20Replace remaining CRYPTO_memcmp() calls with timingsafe_memcmp().Joel Sing
ok doug@ deraadt@
2015-06-20Remove obsolete MDC-2DES from libcrypto.Doug Hogan
ok deraadt@ jsing@ miod@
2015-06-13Fix bad indenting in LibreSSL.Doug Hogan
jsg@ noticed that some of the lines in libssl and libcrypto are not indented properly. At a quick glance, it looks like it has a different control flow than it really does. I checked the history in our tree and in OpenSSL to make sure these were simple mistakes. ok miod@ jsing@
2015-02-15RegenMiod Vallat
2015-02-14Check for allocation error in RSA_eay_mod_exp(). Coverity CID 25217.Miod Vallat
ok jsing@
2015-02-14Expand ASN1_CHOICE*, ASN1_SEQUENCE* and associated macros, making theJoel Sing
data structures visible and easier to review, without having to wade through layers and layers of asn1t.h macros. Change has been scripted and there is no change to the generated assembly. Discussed with beck@ miod@ tedu@
2015-02-11Guenther has plans for OPENSSL_NO_CMS, so revert this for the moment.Bob Beck
2015-02-11get rid of OPENSSL_NO_CMS code we do not use.Bob Beck
ok miod@
2015-02-11Enable building with -DOPENSSL_NO_DEPRECATED.Doug Hogan
If you didn't enable deprecated code, there were missing err.h and bn.h includes. This commit allows building with or without deprecated code. This was not derived from an OpenSSL commit. However, they recently enabled OPENSSL_NO_DEPRECATED in git and fixed these header problems in a different way. Verified with clang that this only changes line numbers in the generated asm. ok miod@
2015-02-10Expand the -IMPLEMENT_ASN1_ENCODE_FUNCTIONS_(const_)?fname macros so thatJoel Sing
the code is visible and functions can be readily located. Change has been scripted and there is no change to the generated assembly. Discussed with beck@ miod@ tedu@
2015-02-09Expand the IMPLEMENT_ASN1_FUNCTIONS macro so that the code is visible andJoel Sing
functions can be readily located. Change has been scripted and there is no change to the generated assembly. Discussed with beck@ miod@ tedu@
2015-02-09BN_CTX_get() can fail - consistently check its return value.Joel Sing
There are currently cases where the return from each call is checked, the return from only the last call is checked and cases where it is not checked at all (including code in bn, ec and engine). Checking the last return value is valid as once the function fails it will continue to return NULL. However, in order to be consistent check each call with the same idiom. This makes it easy to verify. Note there are still a handful of cases that do not follow the idiom - these will be handled separately. ok beck@ doug@
2014-10-22Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().Joel Sing
arc4random_buf() is guaranteed to always succeed - it is worth noting that a number of the replaced function calls were already missing return value checks. ok deraadt@
2014-10-18None of these need to include <openssl/rand.h>Joel Sing
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 06:27:23 +0000