summaryrefslogtreecommitdiff
path: root/sys/crypto
AgeCommit message (Collapse)Author
2014-02-18fix IPComp interop with linux: switch Z_PARTIAL_FLUSH to Z_FINISH forMarkus Friedl
deflate(); this hurts interop with broken old openbsd releases; ok reyk@
2014-02-11- grow the decompression buffer more aggressively if we haveMarkus Friedl
a high compression ratio, e.g. for ping -s 10000 -p aa - deal with inflate returning Z_BUF_ERROR if the output buffer is full. this can happen in some edge cases with upgraded libz from 2004 ok mikeb@
2014-01-21cc_queued is not used for anything atm, remove it; ok jsing, markusMike Belopuhov
2014-01-21Respect CRYPTO_F_NOQUEUE flag when dispatching a crypto operationMike Belopuhov
ok jsing, markus
2013-11-18ansify some function definitions and tidy up this code style wise. thisBrad Smith
ancient code looked pretty crummy. ok deraadt@
2013-11-02replace rc4 with ChaCha20 here, too; ok djm, tedu, deraadtMarkus Friedl
2013-10-31convert crypto work queue to the task_add(9) api; ok dlgMike Belopuhov
2013-08-25Allocate and deallocate memory for encryption contexts within cryptosoft,Joel Sing
rather than requiring each algorithm to provide their own memory handling. This matches the interface already provided by cryptosoft for authentication algorithms and removes the need for zerokey functions. ok mikeb@
2013-06-11Replace more ovbcopy with memmove; swap the src and dst arguments tooTheo de Raadt
2013-06-05fix a bug that caused time-based rekeys to happen too frequently.Damien Miller
rename the structure internals to id32_* in anticipation of an idgen16() that might come in the future.
2013-03-27institute a hard cap on crypto devs instead of a useless wraparound checkTed Unangst
ok beck
2012-12-11Bring back a small copy optimization in the aes-gcm handling:Mike Belopuhov
with ESN AAD is 12 bytes long so it's faster to zero out 4 bytes than to copy 12. Without ESN it's either copying or zeroing out 8 bytes but we'll rely on the cache locality here.
2012-12-07RFC 4106, Section 5 states that the SPI and a 64-bit SequenceMike Belopuhov
Number are provided to the GCM as an Additional Authenticated Data. Usually an SPI and a lower 32-bit part of the ESN are contained within the same memory buffer whereas an upper part of the ESN comes from an external location. To accommodate that RFC 4303, Section 3.3.2.1 states that upper part of the ESN is hashed in the end. Unfortunately this advice is not applicable for the combined authentication/encryption modes and RFC 4106 decided not to follow that advice, effectively requiring large API changes to accommodate that poor choice. For now implement a kludge that will take an effect in case CRD_F_ESN flag is set in the crypto operation descriptor. Successfully tested against Linux 3.2 with strongSwan 4.6.4.
2012-12-07Fix one of the two issues with ESN support in the GCM case:Mike Belopuhov
supply correct AAD length to the final round of hashing. While here rename swcr_combined to swcr_authenc.
2012-12-05Remove excessive sys/cdefs.h inclusionTheo de Raadt
ok guenther millert kettenis
2012-10-28We need to allocate memory for crp_buf in the DMA accessibleMike Belopuhov
region since it's passed to the hardware directly. Tested by Yoshihisa Matsushita <y at m8a ! org>, thanks! ok kettenis miod
2012-10-04Clean up uninitialized warnings from cryptosoft and aesni.Christiano F. Haesbaert
Part of the work to remove -Wno-uninitialized. ok mikeb@
2012-06-29Add support for the Extended (64-bit) Sequence Number as definedMike Belopuhov
in RFC4302 and RFC4303. Right now only software crypto engine is capable of doing it. Replay check was rewritten to implement algorithm described in the Appendix A of RFC4303 and the window size was increased to 64. Tested against OpenBSD, Linux (strongswan) and Windows. No objection from the usual suspects.
2012-04-25Use explicit_bzero() for clearing key material.Matthew Dempsky
Pointed out by Michael W. Bombardieri on tech@. ok deraadt
2012-04-22Add struct proc * argument to FRELE() and FILE_SET_MATURE() inPhilip Guenthe
anticipation of further changes to closef(). No binary change. ok krw@ miod@ deraadt@
2012-02-15Hold struct filedesc's fd_lock when writing to the fd_ofiles, fd_ofileflags,Philip Guenthe
or fd_{lo,hi}maps members, or when doing a read for a write. Fixes hangs when an rthreaded processes sleeps while copying the fd table for fork() and catches another thread with the lock. ok jsing@ tedu@
2011-07-07empty files should be deletedTed Unangst
2011-07-07Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzTheo de Raadt
code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
2011-01-12cleanup aes-ctr keystream after use; ok deraadtMike Belopuhov
2011-01-11fix encryption for uio_iovcnt > 1 by passing the absolute offset 'count'Markus Friedl
to cuio_copydata() and make sure we don't loop forever if the end of an iov matches the cipher block boundary. ok mikeb, deraadt
2011-01-11key lengths are counted in bitsTheo de Raadt
2011-01-11add explicit_bzero() calls before free()ing key materialTheo de Raadt
ok mikeb
2011-01-11in SHA1Final(), explicitly clear the local bufferTheo de Raadt
ok mikeb
2011-01-11accidental commit of a pending diff relating to something elseTheo de Raadt
2011-01-11in AES_GMAC_Final(), explicitly clear the local bufferTheo de Raadt
ok mikeb
2011-01-11for key material that is being being discarded, convert bzero() toTheo de Raadt
explicit_bzero() where required ok markus mikeb
2010-12-22use the do {} while construct in the copying macrosTheo de Raadt
ok mikeb
2010-12-21remove dead code (ivp did always point to iv in the decrypt path).Markus Friedl
instead save one bcopy() per block by alternating between two iv buffers; ok mikeb@
2010-12-16move CRYPTO_VIAC3_MAX out of cryptodev.h and into the onlyJonathan Gray
file it will be used from. requested by/ok mikeb@
2010-12-16The VIA ciphers are added to an array of CRYPTO_ALGORITHM_MAX lengthJonathan Gray
which should have been declared as CRYPTO_ALGORITHM_MAX + 1, fix this and reserve enough space for the VIA additions as well. ok/comments from mikeb & deraadt
2010-12-14disable access to the crypto(4) device from userland; ok deraadtMike Belopuhov
2010-11-08use a well established define instead of rolling our own; no binary changeMike Belopuhov
2010-10-06Retire SkipjackMike Belopuhov
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-10-06zero out auth hash context before freeing it; ok matthew millertMike Belopuhov
2010-09-22OCF support for the Galois/Counter Mode (GCM) for AES asMike Belopuhov
described in FIPS SP 800-38D. This implementation supports 16 byte authentication tag only, splitting transformation into two parts: encryption and authentication. Encryption is handled by the existing AES-CTR implementation, while authentication requires new AES_GMAC hash function. Additional routine is added to the software crypto driver to deal with peculiarities of a combined authentication- encryption transformation. With suggestions from reyk, naddy and toby.
2010-09-08Reintroduce most crypto/crypto.c r1.55:Joel Sing
Move pool initialization to init_crypto and zap the crypto_pool_initialized variable. This way we don't have to check if the pool are initialized every time we do a crypto_getreq(). However, also perform the crypto initialisation earlier in init_main so that the crypto pools are initialised before they are used. ok mikeb@ thib@ deraadt@
2010-08-08Backout r1.55 since this breaks anything which does crypto ops prior toJoel Sing
init_crypto() being called from late in init_main(). In particular, this breaks softraid crypto volumes that are assembled at boot. No cookies for thib/mikeb! "Back it out, right now" deraadt@
2010-07-21No need for read/write functions, just use enodev like all the otherTheo de Raadt
things things do ok nicm
2010-07-20Switch some obvious network stack MAC comparisons from bcmp() toMatthew Dempsky
timingsafe_bcmp(). ok deraadt@; committed over WPA.
2010-07-20Mark a DMA accessible malloc for later correction. This isMatthew Dempsky
potentially up to 64KB, so we'll need something fancier than dma_alloc().
2010-07-08Revert part of previous.Thordur I. Bjornsson
The splvm protection is needed after all, as we are walking the list of registered crypto drivers and doing that unprotected is unwise. Pointed out by kettenis@
2010-07-08Move pool initialization to init_crypto and zap the crypto_pool_initializedThordur I. Bjornsson
variable. This way we don't have to check if the pool are initialized every time we do a crypto_getreq(). Move splvm lower as it isnt need all through crypto_newsession(). tiny KNF nit. From mikeb OK deraadt@
2010-07-02m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsBret Lambert
are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
2010-06-23Zap a dead prototype, crypto_thread(); Leftover since crypto wasThordur I. Bjornsson
moved from a special kthread to workqs. OK dlg@
2010-06-09Remove the CRYPTO_ALGORITHM_ALL define, fixup accordinglyThordur I. Bjornsson
and make the loop invartiants <= CRYPTO_ALGORITHM_MAX Do this also for the CRK_ALGORITHM_MAX this also fixes the a bug that caused us to skip CRK_DH_COMPUTE_KEY. ok deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 04:39:49 +0000