wireguard-openbsd/lib/libcrypto/evp, branch master

Provide EVP_PKEY_new_CMAC_key(3)

2021-03-31T16:47:00Z

ok bcook inoguchi jsing

Prepare to provide EVP_PKEY_new_CMAC_key()

2021-03-29T15:57:23Z

sebastia ran into this when attempting to update security/hcxtools. This will be tested via wycheproof.go once the symbol is public. ok jsing, tested by sebastia

Pull in fix for EVP_CipherUpdate() overflow from OpenSSL.

2021-02-18T19:12:29Z

ok inoguchi commit 6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 Author: Matt Caswell Date: Tue Feb 2 17:17:23 2021 +0000 Don't overflow the output length in EVP_CipherUpdate calls CVE-2021-23840 Reviewed-by: Paul Dale

Add a custom copy handler for AES key wrap

2020-06-05T18:44:42Z

This is necessary because ctx->cipher_data is an EVP_AES_WRAP_CTX containing a pointer to ctx->iv. EVP_CIPHER_CTX_copy() uses memcpy to copy cipher_data to the target struct. The result is that the copy contains a pointer to the wrong struct, which then leads to a use-after-free. The custom copy handler fixes things up to avoid that. Issue reported by Guido Vranken ok beck inoguchi jsing

Allow GOST R 34.11-2012 in PBE/PBKDF2/PKCS#5.

2020-06-05T17:30:41Z

Diff from Dmitry Baryshkov Sponsored by ROSA Linux ok inoguchi@ tb@

Disallow setting the AES-GCM IV length to 0

2020-04-30T18:43:11Z

It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)

Disallow the use of zero length IVs in AES-GCM via

2020-04-27T19:31:02Z

EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen.

Check high bit for base64 decode

2020-03-04T11:53:21Z

Referred to this OpenSSL commit and adopted to the codebase. b785504a10310cb2872270eb409b70971be5e76e suggest and ok tb@

Fix base64 processing of long lines

2020-03-03T15:03:14Z

Fix the problem that long unbroken line of base64 text is not decoded. Referred to this OpenSSL commit and adapted to the codebase. 3cdd1e94b1d71f2ce3002738f9506da91fe2af45 Reported by john.a.passaro gmail.com to the LibreSSL ML. ok tb@

typo

2020-01-26T07:47:26Z