aboutsummaryrefslogtreecommitdiffstats
path: root/crypto
Commit message (Collapse)AuthorAgeFilesLines
* Check for failures, to avoid memory leakRich Salz2018-07-252-9/+9
| | | | | | | Thanks to Jiecheng Wu, Zuxing Gu for the report. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6791)
* crypto/init.c: use destructor_key even as guard in OPENSSL_thread_stop.Andy Polyakov2018-07-251-19/+35
| | | | | | | | | Problem was that Windows threads that were terminating before libcrypto was initialized were referencing uninitialized or possibly even unrelated thread local storage index. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6752)
* crypto/dllmain.c: remove unused OPENSSL_NONPIC_relocated variable.Andy Polyakov2018-07-252-16/+0
| | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6752)
* crypto/cryptlib.c: resolve possible race in OPENSSL_isservice.Andy Polyakov2018-07-251-2/+6
| | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6752)
* crypto/cryptlib.c: make OPENSS_cpuid_setup safe to use as constructor.Andy Polyakov2018-07-251-18/+81
| | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6752)
* ec/ecp_nistz256.c: fix Coverity nit.Andy Polyakov2018-07-251-2/+1
| | | | | | | |ctx| recently became unconditionally non-NULL and is already dereferenced earlier. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove zero special-case in BN_mod_exp_mont.David Benjamin2018-07-241-5/+0
| | | | | | | | A number intended to treat the base as secret should not be branching on whether it is zero. Test-wise, this is covered by existing tests in bnmod.txt. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6733)
* Update sm2_crypt.cneighbads2018-07-241-1/+1
| | | | | | | | | | | asn1_encode : x, y => 0 | x，0 | y (because of DER encoding rules when x and y have high bit set) CLA: Trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6694)
* def_load_bio(): Free |biosk| more carefullyRichard Levitte2018-07-241-2/+16
| | | | | | | | | If there's anything in the |biosk| stack, the first element is always the input BIO. It should never be freed in this function, so we must take careful steps not to do so inadvertently when freeing the stack. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6769)
* ec/ecp_nistz256.c: fix ecp_nistz256_set_from_affine.Andy Polyakov2018-07-221-22/+6
| | | | | | | | | ecp_nistz256_set_from_affine is called when application attempts to use custom generator, i.e. rarely. Even though it was wrong, it didn't affect point operations, they were just not as fast as expected. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6738)
* ec/asm/ecp_nistz256-{!x86_64}.pl: fix scatter_w7 function.Andy Polyakov2018-07-225-25/+25
| | | | | | | | | | The ecp_nistz256_scatter_w7 function is called when application attempts to use custom generator, i.e. rarely. Even though non-x86_64 versions were wrong, it didn't affect point operations, they were just not as fast as expected. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6738)
* bn/bn_intern.c: const-ify bn_set_{static}_words.Andy Polyakov2018-07-222-5/+9
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6738)
* PKCS12: change safeContentsBag from a SET OF to a SEQUENCE OFRichard Levitte2018-07-221-1/+1
| | | | | | | | | As per RFC 7292. Fixes #6665 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6708)
* crypto/*: address standard-compilance nits.Andy Polyakov2018-07-203-3/+11
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6745)
* bio/bss_dgram.c: harmonize usage of OPENSSL_USE_IPV6 with the rest.Andy Polyakov2018-07-201-1/+1
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6745)
* ec/ec_lcl.h: fix pre-C9x compilation problems.Andy Polyakov2018-07-201-9/+9
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6745)
* Validate legacy_versionMatt Caswell2018-07-201-0/+1
| | | | | | | | | | The spec says that a client MUST set legacy_version to TLSv1.2, and requires servers to verify that it isn't SSLv3. Fixes #6600 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6747)
* ec/ecdsa_ossl.c: switch to fixed-length Montgomery multiplication.Andy Polyakov2018-07-181-9/+21
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6664)
* ec/ecdsa_ossl.c: formatting and readability fixes.Andy Polyakov2018-07-181-30/+18
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6664)
* ec/ecdsa_ossl.c: revert blinding in ECDSA signature.Andy Polyakov2018-07-183-70/+69
| | | | | | | | | | | | Originally suggested solution for "Return Of the Hidden Number Problem" is arguably too expensive. While it has marginal impact on slower curves, none to ~6%, optimized implementations suffer real penalties. Most notably sign with P-256 went more than 2 times[!] slower. Instead, just implement constant-time BN_mod_add_quick. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6664)
* bn/bn_lib.c address Coverity nit in bn2binpad.Andy Polyakov2018-07-181-12/+11
| | | | | | | | It was false positive, but one can as well view it as readability issue. Switch even to unsigned indices because % BN_BYTES takes 4-6 instructions with signed dividend vs. 1 (one) with unsigned. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix typo in x25519-x86_64.plMat2018-07-171-1/+1
| | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6726)
* EC2M Lopez-Dahab ladder: use it also for ECDSA verifyNicola Tuveri2018-07-1610-71/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | By default `ec_scalar_mul_ladder` (which uses the Lopez-Dahab ladder implementation) is used only for (k * Generator) or (k * VariablePoint). ECDSA verification uses (a * Generator + b * VariablePoint): this commit forces the use of `ec_scalar_mul_ladder` also for the ECDSA verification path, while using the default wNAF implementation for any other case. With this commit `ec_scalar_mul_ladder` loses the static attribute, and is added to ec_lcl.h so EC_METHODs can directly use it. While working on a new custom EC_POINTs_mul implementation, I realized that many checks (e.g. all the points being compatible with the given EC_GROUP, creating a temporary BN_CTX if `ctx == NULL`, check for the corner case `scalar == NULL && num == 0`) were duplicated again and again in every single implementation (and actually some implementations lacked some of the tests). I thought that it makes way more sense for those checks that are independent from the actual implementation and should always be done, to be moved in the EC_POINTs_mul wrapper: so this commit also includes these changes. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6690)
* EC2M Lopez-Dahab ladder implementationNicola Tuveri2018-07-163-60/+220
| | | | | | | | | | | | | | | | | | | | | | | | | | This commit uses the new ladder scaffold to implement a specialized ladder step based on differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. The arithmetic in `ladder_pre`, `ladder_step` and `ladder_post` is auto generated with tooling: - see, e.g., "Guide to ECC" Alg 3.40 for reference about the `ladder_pre` implementation; - see https://www.hyperelliptic.org/EFD/g12o/auto-code/shortw/xz/ladder/mladd-2003-s.op3 for the differential addition-and-doubling formulas implemented in `ladder_step`; - see, e.g., "Fast Multiplication on Elliptic Curves over GF(2**m) without Precomputation" (Lopez and Dahab, CHES 1999) Appendix Alg Mxy for the `ladder_post` implementation to recover the `(x,y)` result in affine coordinates. Co-authored-by: Billy Brumley <bbrumley@gmail.com> Co-authored-by: Sohaib ul Hassan <soh.19.hassan@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6690)
* EC point multiplication: add `ladder` scaffoldNicola Tuveri2018-07-1612-57/+190
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for specialized Montgomery ladder implementations PR #6009 and #6070 replaced the default EC point multiplication path for prime and binary curves with a unified Montgomery ladder implementation with various timing attack defenses (for the common paths when a secret scalar is feed to the point multiplication). The newly introduced default implementation directly used EC_POINT_add/dbl in the main loop. The scaffolding introduced by this commit allows EC_METHODs to define a specialized `ladder_step` function to improve performances by taking advantage of efficient formulas for differential addition-and-doubling and different coordinate systems. - `ladder_pre` is executed before the main loop of the ladder: by default it copies the input point P into S, and doubles it into R. Specialized implementations could, e.g., use this hook to transition to different coordinate systems before copying and doubling; - `ladder_step` is the core of the Montgomery ladder loop: by default it computes `S := R+S; R := 2R;`, but specific implementations could, e.g., implement a more efficient formula for differential addition-and-doubling; - `ladder_post` is executed after the Montgomery ladder loop: by default it's a noop, but specialized implementations could, e.g., use this hook to transition back from the coordinate system used for optimizing the differential addition-and-doubling or recover the y coordinate of the result point. This commit also renames `ec_mul_consttime` to `ec_scalar_mul_ladder`, as it better corresponds to what this function does: nothing can be truly said about the constant-timeness of the overall execution of this function, given that the underlying operations are not necessarily constant-time themselves. What this implementation ensures is that the same fixed sequence of operations is executed for each scalar multiplication (for a given EC_GROUP), with no dependency on the value of the input scalar. Co-authored-by: Sohaib ul Hassan <soh.19.hassan@gmail.com> Co-authored-by: Billy Brumley <bbrumley@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6690)
* Remove stale SM2 error codesNicola Tuveri2018-07-162-6/+3
| | | | | | | | | | Run `make update ERROR_REBUILD=-rebuild` to remove some stale error codes for SM2 (which is now using its own submodule for error codes, i.e., `SM2_*`). Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6690)
* ec/curve25519.c: reorganize for better accessibility.Andy Polyakov2018-07-151-143/+150
| | | | | | | | Move base 2^64 code to own #if section. It was nested in base 2^51 section, which arguably might have been tricky to follow. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6699)
* ec/asm/x25519-x86_64.pl: add CFI directives and Windows SE handler.Andy Polyakov2018-07-151-1/+296
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6699)
* ec/asm/x25519-x86_64.pl: fix base 2^64 add/sub and final reduction.Andy Polyakov2018-07-151-4/+17
| | | | | | | | | | Base 2^64 addition/subtraction and final reduction failed to treat partially reduced values correctly. Thanks to Wycheproof Project for vectors and Paul Kehrer for report. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6699)
* bn/bn_lcl.h,bn_nist.c: addres strict warnings with -DBN_DEBUG.Andy Polyakov2018-07-142-6/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* rsa/*: switch to BN_bn2binpad.Andy Polyakov2018-07-144-59/+64
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5254)
* bn/bn_lib.c: make BN_bn2binpad computationally constant-time.Andy Polyakov2018-07-141-8/+15
| | | | | | | | | | | "Computationally constant-time" means that it might still leak information about input's length, but only in cases when input is missing complete BN_ULONG limbs. But even then leak is possible only if attacker can observe memory access pattern with limb granularity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5254)
* Fix undefined behavior in s390x aes-gcm/ccmPatrick Steuer2018-07-121-19/+21
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org>
* bn/bn_{mont|exp}.c: switch to zero-padded intermediate vectors.Andy Polyakov2018-07-124-33/+74
| | | | | | | | | | | | | Note that exported functions maintain original behaviour, so that external callers won't observe difference. While internally we can now perform Montogomery multiplication on fixed-length vectors, fixed at modulus size. The new functions, bn_to_mont_fixed_top and bn_mul_mont_fixed_top, are declared in bn_int.h, because one can use them even outside bn, e.g. in RSA, DSA, ECDSA... Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6662)
* bn/bn_lib.c: add BN_FLG_FIXED_TOP flag.Andy Polyakov2018-07-124-14/+29
| | | | | | | | | | | | | | | | | The new flag marks vectors that were not treated with bn_correct_top, in other words such vectors are permitted to be zero padded. For now it's BN_DEBUG-only flag, as initial use case for zero-padded vectors would be controlled Montgomery multiplication/exponentiation, not general purpose. For general purpose use another type might be more appropriate. Advantage of this suggestion is that it's possible to back-port it... bn/bn_div.c: fix memory sanitizer problem. bn/bn_sqr.c: harmonize with BN_mul. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6662)
* bn/bn_mont.c: improve readability of post-condition code.Andy Polyakov2018-07-121-6/+5
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6662)
* bn/bn_mont.c: move boundary condition check closer to caller.Andy Polyakov2018-07-121-3/+4
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6662)
* bn/bn_lib.c: remove bn_check_top from bn_expand2.Andy Polyakov2018-07-121-5/+0
| | | | | | | | | | Trouble is that addition is postponing expansion till carry is calculated, and if addition carries, top word can be zero, which triggers assertion in bn_check_top. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: David Benjamin <davidben@google.com> (Merged from https://github.com/openssl/openssl/pull/6662)
* NCONF_get_number refix.Pauli2018-07-113-12/+34
| | | | | | | | | | | | Fix the NULL check lack in a different way that is more compatible with non-NULL branch. Refer #6632 Also mark and pop the error stack instead of clearing all errors when something goes awry in CONF_get_number. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6643)
* poly1305/asm/poly1305-x86_64.pl: fix solaris64-x86_64-cc build.Andy Polyakov2018-07-101-39/+38
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6676)
* Correctly check for cryptodev hash supportConrad Meyer2018-07-091-5/+5
| | | | | | | | | | | The sense of the check for build-time support for most hashes was inverted. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6673)
* modes/ocb128.c: readability and formatting improvements.Andy Polyakov2018-07-091-15/+5
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6669)
* modes/ocb128.c: improve the calculation of double maskDesWurstes2018-07-091-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6667)
* Remove a memsetMatt Caswell2018-07-071-2/+0
| | | | | | | | | Also avoids calling EVP_MD_size() and a missing negative result check. Issue found by Coverity. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
* Check a return value for success in ec_field_size()Matt Caswell2018-07-071-1/+2
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
* Fix some Coverity issues in sm2_encrypt()Matt Caswell2018-07-071-9/+10
| | | | | | | | Check for a negative EVP_MD_size(). Don't dereference group until we've checked if it is NULL. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
* Check md_size isn't negative before we use itMatt Caswell2018-07-071-5/+6
| | | | | | | Issue found by Coverity Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
* evp/e_chacha20_poly1305.c: further improve small-fragment TLS performance.Andy Polyakov2018-07-062-8/+150
| | | | | | | | | | Improvement coefficients vary with TLS fragment length and platform, on most Intel processors maximum improvement is ~50%, while on Ryzen - 80%. The "secret" is new dedicated ChaCha20_128 code path and vectorized xor helpers. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6638)
* [crypto/ec] disable SCA mitigations for curves with incomplete parametersBilly Brumley2018-07-041-22/+24
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6648)
* chacha/asm/chacha-x86_64.pl: add dedicated path for 128-byte inputs.Andy Polyakov2018-07-031-74/+221
| | | | | | | | The 128-byte vectors are extensively used in chacha20_poly1305_tls_cipher and dedicated code path is ~30-50% faster on most platforms. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6626)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 23:12:31 +0000