aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* - New INSTALL document describing different ways to build "tunala" andGeoff Thorpe2001-07-2311-44/+354
| | | | | | | | | | | | | | | possible problems. - New file breakage.c handles (so far) missing functions. - Get rid of some signed/unsigned/const warnings thanks to solaris-cc - Add autoconf/automake input files, and helper scripts to populate missing (but auto-generated) files. This change adds a configure.in and Makefile.am to build everything using autoconf, automake, and libtool - and adds "gunk" scripts to generate the various files those things need (and clean then up again after). This means that "autogunk.sh" needs to be run first on a system with the autotools, but the resulting directory should be "configure"able and compilable on systems without those tools.
* Additional inline reference.Lutz Jänicke2001-07-231-2/+4
|
* Add missing reference.Lutz Jänicke2001-07-231-0/+1
|
* Tidy up "cvs update" output a bit.Geoff Thorpe2001-07-222-0/+4
|
* Not all platforms have the OpenBSD crypto device.Richard Levitte2001-07-211-0/+4
|
* Documentation about ephemeral key exchangeLutz Jänicke2001-07-215-5/+315
|
* Clean up EVP macros, rename DES EDE3 modes correctly, temporary support forBen Laurie2001-07-2112-20/+282
| | | | | OpenBSD /dev/crypto (this will be revamped later when the appropriate machinery is available).
* More Kerberos SSL patches from Vern Staats <staatsvr@asc.hpc.mil>.Richard Levitte2001-07-212-73/+119
| | | | | | | | | | | | | | | His comments are: This patch fixes the problem of modern Kerberos using "derived keys" to encrypt the authenticator by disabling the authenticator check for all derived keys enctypes. I think I've got all the bugfixes that Jeffrey and I discussed rolled into this. There were some problems with Jeffrey's code to convert the authenticator's Kerberos timestring into struct tm (e.g. Z, -1900; it helps to have an actual decryptable authenticator to play with). So I've shamelessly pushed in my code, while stealing some bits from Jeffrey.
* Updated explanation.Lutz Jänicke2001-07-201-3/+16
|
* Some more documentation bits.Lutz Jänicke2001-07-204-4/+56
|
* Currently, RSA code, when using no padding scheme, simply checks that inputGeoff Thorpe2001-07-201-3/+12
| | | | | | | | | | | | | | | | does not contain more bytes than the RSA modulus 'n' - it does not check that the input is strictly *less* than 'n'. Whether this should be the case or not is open to debate - however, due to security problems with returning miscalculated CRT results, the 'rsa_mod_exp' implementation in rsa_eay.c now performs a public-key exponentiation to verify the CRT result and in the event of an error will instead recalculate and return a non-CRT (more expensive) mod_exp calculation. As the mod_exp of 'I' is equivalent to the mod_exp of 'I mod n', and the verify result is automatically between 0 and n-1 inclusive, the verify only matches the input if 'I' was less than 'n', otherwise even a correct CRT calculation is only congruent to 'I' (ie. they differ by a multiple of 'n'). Rather than rejecting correct calculations and doing redundant and slower ones instead, this changes the equality check in the verification code to a congruence check.
* Missing line 0.9.6b release and IA-64 patch advertisement:-)Andy Polyakov2001-07-171-1/+7
|
* SSL_get_rfc were documented but not implemented.Richard Levitte2001-07-161-1/+1
|
* SSL_get_[rw]fd were documented but not implemented.Richard Levitte2001-07-152-0/+19
|
* Allow OCSP server to handle multiple requests.Dr. Stephen Henson2001-07-132-39/+187
| | | | Document new OCSP options.
* Initial OCSP server support, using index.txt format.Dr. Stephen Henson2001-07-124-108/+540
| | | | | | | This can process internal requests or behave like a mini responder. Todo: documentation, update usage info.
* Prevent KSSL server from requesting a client certificate.Richard Levitte2001-07-123-4/+9
| | | | Submitted by Jeffrey Altman <jaltman@columbia.edu>
* paddr may be NULL. Do not crash if it is.Richard Levitte2001-07-121-5/+10
|
* Clarify that zlib-dynamic is the default choice.Richard Levitte2001-07-121-1/+1
|
* Add the possibility to specify the use of zlib compression andRichard Levitte2001-07-123-7/+38
| | | | | decompression. It can be set up to link at link time or to load the zlib library at run-time.
* Clarify actual state.Lutz Jänicke2001-07-121-3/+3
|
* Some of the Kerberos code had dissapeared. Reapply.Richard Levitte2001-07-121-1/+6
|
* Document the recent Kerberos SSL changes.Richard Levitte2001-07-121-0/+13
|
* Delete extra ;Dr. Stephen Henson2001-07-111-1/+1
|
* In ocsp_match_issuerid() we are passed the CA that signed the responderDr. Stephen Henson2001-07-111-1/+1
| | | | | certificate so need to match its subject with the certificate IDs in the response.
* make updateRichard Levitte2001-07-112-29/+22
| | | | | | | | Note that since some private kssl functions were exported, the simplest way to rebuild the number table was to toss everything that was new since OpenSSL 0.9.6b. This is safe, since those functions have not yet been exported in an OpenSSL release. Beware, people who trust intermediary snapshots!
* Include kssl_lcl.h where needed.Richard Levitte2001-07-114-2/+4
|
* Private functions do not belong in an exported header file, so moveRichard Levitte2001-07-112-14/+87
| | | | them to one that won't get exported.
* Changes to the Kerberos SSL code by Jeffrey Altman <jaltman@columbia.edu>Richard Levitte2001-07-114-6/+213
| | | | | | | | | | | His comments are: . adds use of replay cache to protect against replay attacks . adds functions kssl_tgt_is_available() and kssl_keytab_is_available() which are used within s3_lib.c and ssl_lib.c to determine at runtime whether or not KRB5 ciphers can be supported during the current session.
* openssl speed is quite useful for testing hardware support (among otherGeoff Thorpe2001-07-113-4/+76
| | | | | | | things), especially as the RSA keys are fixed. However, DSA only fixes the DSA parameters and then generates the public and private components on the fly each time - this commit hard-codes some sampled key values so that this is no longer the case.
* Code to avoid the use of non-standard strptime(). ByRichard Levitte2001-07-111-7/+38
| | | | | | | | Jeffrey Altman <jaltman@columbia.edu> (Really, the time that's being parsed is a GeneralizedTime, so if ASN1_GENERALIZEDTIME_get() ever gets implemented, it should be used instead)
* Typo...Lutz Jänicke2001-07-111-1/+1
|
* Changes to the Kerberos SSL code by Jeffrey Altman <jaltman@columbia.edu>Richard Levitte2001-07-111-54/+123
| | | | | | | | | | | | | | | | His comments are: . Fixed all of the Windows dynamic loading functions, prototypes, etc. . Corrected all of the unsigned/signed comparison warnings . Replaced the references to krb5_cksumarray[] for two reasons. First, it was an internal variable that should not have been referenced outside the library; nor could it have been with a shared library with restricted exports. Second, the variable is no longer used in current Kerberos implementations. I replaced the code with equivalent functionality using functions that are exported from the library.
* What is an '-engine' version?Lutz Jänicke2001-07-111-0/+7
|
* The implementation of the TKTBODY ASN.1 functions was missing.Richard Levitte2001-07-111-0/+3
|
* make updateRichard Levitte2001-07-111-0/+66
|
* Make sure crypto/krb5/krb5_asn.h is copied to the directory ofRichard Levitte2001-07-111-0/+1
| | | | exported header files.
* Make sure crypto/krb5/krb5_asn.h becomes part of libeay.num.Richard Levitte2001-07-111-0/+1
|
* Clarify! (based on recent mailing-list discussions)Lutz Jänicke2001-07-112-0/+9
|
* One forgotten function.Richard Levitte2001-07-111-0/+8
|
* make updateRichard Levitte2001-07-108-757/+1049
|
* EVP_Digest() takes one more parameter.Richard Levitte2001-07-101-4/+4
|
* For consistency with the terminology used in my SAC2001 paper, avoidBodo Möller2001-07-101-5/+5
| | | | | | the term "simultaneous multiplication" (which -- acording to the paper, at least -- applies only to certain methods which we don't use here)
* comment changeBodo Möller2001-07-101-3/+3
|
* Fix PRNG.Bodo Möller2001-07-104-33/+68
|
* In version numbers, there is just one "M" nybble.Bodo Möller2001-07-101-1/+1
|
* Precomputation will not necessarily be LIm-Lee precomputation.Bodo Möller2001-07-102-2/+2
|
* If I define _XOPEN_SOURCE before including *any* system header file,Richard Levitte2001-07-091-1/+1
| | | | things will work much more smoothly.
* Patches from Vern Staats <staatsvr@asc.hpc.mil> to get Kerberos 5 inRichard Levitte2001-07-0914-173/+1641
| | | | | | | | | | | | | | | | SSL according to RFC 2712. His comment is: This is a patch to openssl-SNAP-20010702 to support Kerberized SSL authentication. I'm expecting to have the full kssl-0.5 kit up on sourceforge by the end of the week. The full kit includes patches for mod-ssl, apache, and a few text clients. The sourceforge URL is http://sourceforge.net/projects/kssl/ . Thanks to a note from Simon Wilkinson I've replaced my KRB5 AP_REQ message with a real KerberosWrapper struct. I think this is fully RFC 2712 compliant now, including support for the optional authenticator field. I also added openssl-style ASN.1 macros for a few Kerberos structs; see crypto/krb5/ if you're interested.
* A better compromise between encrypt and decrypt (but why isn't it as fastBen Laurie2001-07-093-48/+39
| | | | for encrypt?).
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-29 00:32:44 +0000