summaryrefslogtreecommitdiff
path: root/lib/libcrypto/rsa
AgeCommit message (Collapse)Author
2019-11-20Fix rsa key output formatKinichiro Inoguchi
This fixes openssl(1) rsa -text output format ok tb@
2019-11-04Reshuffle RSA_PSS_PARAMS and RSA_OAEP_PARAMS to avoid duplicate typedef.Joel Sing
Issue spotted by bcook@ ok bcook@ inoguchi@
2019-11-02Bring back some icky buffer allocation code so that pkey_rsa_print()Joel Sing
works again with the horrific API that is ASN1_bn_print(). Issue spotted by inoguchi@
2019-11-02Provide RSA_PKCS1_OpenSSL().Joel Sing
Prompted by inoguchi@
2019-11-02Make RSA_padding_{add,check}_PKCS1_OAEP_mgf1() public.Joel Sing
2019-11-02Make RSA_OAEP_PARAMs public.Joel Sing
2019-11-01Add RSA CMS support.Joel Sing
From OpenSSL 1.1.1d. ok tb@
2019-11-01Update RSA ASN.1 code to handle RSA-PSS.Joel Sing
From OpenSSL 1.1.1d. ok tb@
2019-11-01Clean up RSA_new_method().Joel Sing
Use calloc() instead of malloc() for initialisation and remove explicit zero initialisation of members. This ensures that new members always get initialised. Also use a single error return path, simplifying code. ok tb@
2019-10-31Add CMS controls for RSA.Joel Sing
2019-10-31Add support for RSA-PSS.Joel Sing
From OpenSSL 1.1.1d. ok inoguchi@
2019-10-31Move RSA min modulus to a define and increase from 256 to 512 bits.Joel Sing
From OpenSSL 1.1.1d. ok inoguchi@
2019-10-31Fix indent and indent before labels.Joel Sing
2019-10-31Use braces where a statement has both multi-line and single-line blocks.Joel Sing
Makes code more robust and reduces differences with OpenSSL. ok inoguchi@
2019-10-31Add additional validation of key size, message digest size and publicJoel Sing
exponent. From OpenSSL 1.1.1d. ok inoguchi@
2019-10-31Clean up some code.Joel Sing
Assign and test, explicitly test against NULL and use calloc() rather than malloc. ok inoguchi@
2019-10-31Avoid potentially leaking pub_exp in pkey_rsa_copy().Joel Sing
ok inoguchi@
2019-10-29Add two controls that were missed in the previous commit.Joel Sing
2019-10-29Update RSA OAEP code.Joel Sing
This syncs the RSA OAEP code with OpenSSL 1.1.1d, correctly handling OAEP padding and providing various OAEP related controls. ok inoguchi@ tb@
2019-10-25Free maskHash when RSA_PSS_PARAMS is freed.Joel Sing
ok tb@
2019-10-24Provide RSA_OAEP_PARAMS along with ASN.1 encoding/decoding.Joel Sing
For now these are internal only. From OpenSSL 1.1.1d. ok inoguchi@
2019-10-24Add RSA_PSS_PARAMS pointer to RSA struct.Joel Sing
This will be used by upcoming RSA-PSS code. ok tb@
2019-10-24Add maskHash field to RSA_PSS_PARAMS.Joel Sing
This will be soon used as an optimisation and reduces the differences between OpenSSL. ok tb@
2019-10-24Provide RSA_pkey_ctx_ctrl().Joel Sing
This is a wrapper around EVP_PKEY_CTX_ctrl() which requires the key to be either RSA or RSA-PSS. From OpenSSL 1.1.1d. ok tb@
2019-10-17Sync RSA_padding_check_PKCS1_OAEP_mgf1().Joel Sing
Update RSA_padding_check_PKCS1_OAEP_mgf1() with code from OpenSSL 1.1.1d (with some improvements/corrections to comments). This brings in code to make the padding check constant time. ok inoguchi@ tb@
2019-10-09Use EVP_MAX_MD_SIZE instead of SHA_DIGEST_LENGTH and remove OPENSSL_NO_SHA*Joel Sing
conditionals, now that this code handles arbitrary message digests. ok inoguchi@ tb@
2019-10-04Provide internal RSA_padding_{add,check}_PKCS1_OAEP_mgf1() functions.Joel Sing
These are internal only for now and will be made public at a later date. The RSA_padding_{add,check}_PKCS1_OAEP() functions become wrappers around the *_mgf1() variant. ok tb@ inoguchi@ (as part of a larger diff)
2019-10-03Move towards making RSA OAEP functions handle arbitrary message digests.Joel Sing
Based on OpenSSL 1.1.1. ok tb@, inoguchi@ (on an earlier/larger diff)
2019-09-09Provide EVP_PKEY_CTX_get_signature_md() macro and implement theJoel Sing
EVP_PKEY_CTRL_GET_MD control for DSA, EC and RSA. This is used by the upcoming RSA CMS code. ok inoguchi@ tb@
2019-06-05provide getters and setters for the RSA_METHOD interfaceGilles Chehade
ok tb@, jsing@, sthen@
2018-09-12Add some accessor functions:Damien Miller
RSA_meth_get_finish() RSA_meth_set1_name() EVP_CIPHER_CTX_(get|set)_iv() feedback and ok jsing@ tb@
2018-09-05use timing-safe compares for checking results in signature verificationDamien Miller
(there are no known attacks, this is just inexpensive prudence) feedback and ok tb@ jsing@
2018-08-24Add consts to EVP_PKEY_asn1_set_private()Theo Buehler
Requires adding a const to the priv_decode() member of EVP_PKEY_ASN1_METHOD and adjusting all *_priv_decode() functions. All this is already documented this way. tested in a bulk build by sthen ok jsing
2018-08-19whitespace fixTheo Buehler
2018-08-19Don't leak db on error in RSA_padding_check_PKCS1_OAEP().Theo Buehler
CID #183499. input & ok jsing, ok mestre on first version
2018-08-05In RSA_padding_add_PKCS1_OAEP, dbmask needs to be freed on failure.Brent Cook
ok tb@
2018-07-23Implement RSASSA-PKCS1-v1_5 as specified in RFC 8017.Theo Buehler
Based on an OpenSSL commit by David Benjamin. Alex Gaynor and Paul Kehrer from the pyca/cryptography Python library reported that more than 200 "expected to fail" signatures among Project Wycheproof's test vectors validated on LibreSSL. This patch makes them all fail. ok jsing commit 608a026494c1e7a14f6d6cfcc5e4994fe2728836 Author: David Benjamin <davidben@google.com> Date: Sat Aug 20 13:35:17 2016 -0400 Implement RSASSA-PKCS1-v1_5 as specified. RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode the DigestInfo struct and then compare the result against the public key operation result. This implies that one and only one encoding is legal. OpenSSL instead parses with crypto/asn1, then checks that the encoding round-trips, and allows some variations for the parameter. Sufficient laxness in this area can allow signature forgeries, as described in https://www.imperialviolet.org/2014/09/26/pkcs1.html Although there aren't known attacks against OpenSSL's current scheme, this change makes OpenSSL implement the algorithm as specified. This avoids the uncertainty and, more importantly, helps grow a healthy ecosystem. Laxness beyond the spec, particularly in implementations which enjoy wide use, risks harm to the ecosystem for all. A signature producer which only tests against OpenSSL may not notice bugs and accidentally become widely deployed. Thus implementations have a responsibility to honor the specification as tightly as is practical. In some cases, the damage is permanent and the spec deviation and security risk becomes a tax all implementors must forever pay, but not here. Both BoringSSL and Go successfully implemented and deployed RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so this change should be compatible enough to pin down in future OpenSSL releases. See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00 As a bonus, by not having to deal with sign/verify differences, this version is also somewhat clearer. It also more consistently enforces digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath wasn't quite doing this right. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1474
2018-04-14make ENGINE_finish() succeed on NULL and simplify callers as inTheo Buehler
OpenSSL commit 7c96dbcdab9 by Rich Salz. This cleans up the caller side quite a bit and reduces the number of lines enclosed in #ifndef OPENSSL_NO_ENGINE. codesearch.debian.net shows that almost nothing checks the return value of ENGINE_finish(). While there, replace a few nearby 'if (!ptr)' with 'if (ptr == NULL)'. ok jsing, tested by & ok inoguchi
2018-03-17Provide RSA_meth_{dup,free,new,set_{finish,priv_{dec,enc}}}()Theo Buehler
Note that these functions return NULL in out-of-memory situations, but contrary to OpenSSL's versions they do not set an error. ok jsing
2018-02-20Provide RSA_{clear,set,test}_flasg()Theo Buehler
ok jsing
2018-02-18Provide RSA_{g,s}et0_crt_params()Theo Buehler
ok jsing
2018-02-18Use usual order of RSA_{g,s}et0_key().Theo Buehler
ok jsing
2018-02-18Provide RSA_{g,s}et0_factors()Theo Buehler
ok jsing
2018-02-18Provide RSA_bits()Theo Buehler
ok jsing
2018-02-17Provide further parts of the OpenSSL 1.1 API: {DH,DSA}_get0_{key,pqg}(),Theo Buehler
EVP_PKEY_get0_{DH,DSA,RSA}(), RSA_{g,s}et0_key(). ok jsing
2017-08-30Bring back the RSA_SSLV23_PADDING define.Joel Sing
Several pieces of software expect this to be available unconditionally.
2017-08-28Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedJoel Sing
code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
2017-05-02use freezero() instead of memset/explicit_bzero + free. SubstantiallyTheo de Raadt
reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
2017-04-28revert previous accidental commitBob Beck
2017-04-28*** empty log message ***Bob Beck
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 22:46:28 +0000