wireguard-openbsd/lib/libcrypto/evp/e_aes.c, branch jd/queueboosts WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/lib/libcrypto/evp/e_aes.c?h=jd%2Fqueueboosts 2020-06-05T18:44:42Z Add a custom copy handler for AES key wrap 2020-06-05T18:44:42Z tb tb@openbsd.org 2020-06-05T18:44:42Z urn:sha1:f72711c6fb8692f12b01b3a3b7f54687729f6f9b This is necessary because ctx->cipher_data is an EVP_AES_WRAP_CTX containing a pointer to ctx->iv. EVP_CIPHER_CTX_copy() uses memcpy to copy cipher_data to the target struct. The result is that the copy contains a pointer to the wrong struct, which then leads to a use-after-free. The custom copy handler fixes things up to avoid that. Issue reported by Guido Vranken ok beck inoguchi jsing Disallow setting the AES-GCM IV length to 0 2020-04-30T18:43:11Z tb tb@openbsd.org 2020-04-30T18:43:11Z urn:sha1:9ebe8809227b3735613e85de8b05ecbe3dfa78a4 It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff) Disallow the use of zero length IVs in AES-GCM via 2020-04-27T19:31:02Z tb tb@openbsd.org 2020-04-27T19:31:02Z urn:sha1:539125b0baa78c5c019ab9e3bbeca4fa822d1bf7 EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen. Revert the other hunk of r1.36 as well: in the case of CCM, ccm.key is 2019-05-12T15:52:46Z tb tb@openbsd.org 2019-05-12T15:52:46Z urn:sha1:fc5c647f0d4755c752d546441bae83f92b9cb0a3 assigned from aesni_ccm_init_key() via CRYPTO_ccm128_init(), so it needs to be copied over... Pointed out by Guido Vranken. ok jsing Revert part of r1.36: in the case of GCM, gcm.key is assigned from 2019-05-10T18:41:17Z tb tb@openbsd.org 2019-05-10T18:41:17Z urn:sha1:9262e070b4250387ec24125a9d5446cebbe12ec8 aesni_gcm_init_key() via CRYPTO_gcm128_init(), so it needs to be copied over... Fixes cryptofuzz issue #14352 and likely also #14374. ok beck jsing Some more malloc() to calloc() conversions. 2019-04-14T17:27:42Z jsing jsing@openbsd.org 2019-04-14T17:27:42Z urn:sha1:57e7da8e489c3f2820b77f19655363f3b34fbbf6 ok tb@ Remove two pointless chunks of code. 2019-04-14T17:26:27Z jsing jsing@openbsd.org 2019-04-14T17:26:27Z urn:sha1:57ea69e171536967aa14154230a06647eed8a61f This reverts part of OpenSSL c2fd5d79, which added the same code to AES CCM, GCM and XTS. In the case of CCM and GCM nothing assigns {ccm,gcm}.key so there is never going to be anything to update (unlike XTS). ok tb@ Provide EVP_aes_{128,192,256}_wrap(). This is a compatible 2019-03-17T18:07:41Z tb tb@openbsd.org 2019-03-17T18:07:41Z urn:sha1:7bd973386a5d471a9e204c92c4974e44058a6f1f implementation based on the one in OpenSSL 1.0.2r which is still freely licensed. The functions are undocumented in OpenSSL. To use them, one needs to set the undocumented EVP_CIPHER_CTX_FLAG_WRAP_ALLOW flag on the EVP_CIPHER_CTX. resolves #505 ok jsing use freezero() instead of memset/explicit_bzero + free. Substantially 2017-05-02T03:59:44Z deraadt deraadt@openbsd.org 2017-05-02T03:59:44Z urn:sha1:7de8a6843ca16b4f1c9d2a7eab4c71e8af96a4e6 reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck LibreSSL : Truncated packet could crash via OOB read 2017-01-31T13:17:21Z inoguchi inoguchi@openbsd.org 2017-01-31T13:17:21Z urn:sha1:afe21ec45a72c7be661db3e9c80d5be3fd9f215f This patch is originally from master branch of OpenSSL. - 2198b3a crypto/evp: harden AEAD ciphers. - 8e20499 crypto/evp: harden RC4_MD5 cipher. ok tom@