wireguard-openbsd/sys/crypto/cryptosoft.h, branch jd/simplify-queueing WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sys/crypto/cryptosoft.h?h=jd%2Fsimplify-queueing 2012-12-07T17:03:22Z Fix one of the two issues with ESN support in the GCM case: 2012-12-07T17:03:22Z mikeb mikeb@openbsd.org 2012-12-07T17:03:22Z urn:sha1:e3c3ea0bc045f97f62d76033d6baacf29b8cdc42 supply correct AAD length to the final round of hashing. While here rename swcr_combined to swcr_authenc. OCF support for the Galois/Counter Mode (GCM) for AES as 2010-09-22T11:54:23Z mikeb mikeb@openbsd.org 2010-09-22T11:54:23Z urn:sha1:112808b6ee76dc5b96194401fae4a712ecf06f7e described in FIPS SP 800-38D. This implementation supports 16 byte authentication tag only, splitting transformation into two parts: encryption and authentication. Encryption is handled by the existing AES-CTR implementation, while authentication requires new AES_GMAC hash function. Additional routine is added to the software crypto driver to deal with peculiarities of a combined authentication- encryption transformation. With suggestions from reyk, naddy and toby. Fix two bugs in IPsec/HMAC-SHA2: 2010-01-10T12:43:07Z markus markus@openbsd.org 2010-01-10T12:43:07Z urn:sha1:8688c78ccb8ab5d1176894bf5ae336f3ec0d0d0c (1) use correct (message) block size of 128 byte (instead of 64 bytes) for HMAC-SHA512/384 (RFC4634). (2) RFC4868 specifies that HMAC-SHA-{256,384,512} is truncated to nnn/2 bits, while we still use 96 bits. 96 bits have been specified in draft-ietf-ipsec-ciph-sha-256-00 while draft-ietf-ipsec-ciph-sha-256-01 changed it to 128 bits. WARNING: this change makes IPsec with SHA-256 (the default) incompatible with older OpenBSD versions and other IPsec-implementations that share this bug. ok+tests naddy, fries; requested by reyk/deraadt Make the hmac ipad/opad globals "const" and fixup the crypto functions 2007-09-10T22:19:42Z henric henric@openbsd.org 2007-09-10T22:19:42Z urn:sha1:3fccb9893ef1d6ab37a93fdb0c895bba0b0c7981 to match. ok deraadt@ KNF 2002-04-22T23:10:09Z deraadt deraadt@openbsd.org 2002-04-22T23:10:09Z urn:sha1:af4776c8aacd127cc88478dd4bedf0abf2259ba9 Don't keep the last blocksize-bytes of ciphertext for use as the next 2002-03-19T23:24:53Z angelos angelos@openbsd.org 2002-03-19T23:24:53Z urn:sha1:df8457d2455823d7b62ccdefb2afae649be0a4d4 plaintext's IV, in CBC mode. Use arc4random() to acquire fresh IVs per message instead (particularly useful for IPsec). This avoids the CBC oracle attack. provos@ ok export MD5/SHA1 via /dev/crypto; ok provos@, beck@ 2002-03-05T15:59:41Z markus markus@openbsd.org 2002-03-05T15:59:41Z urn:sha1:649dc2d9858d48bf78fc404b6fab58ba4e01d29c tested with cryptosoft and kern.cryptodevallowsoft=1 license repair, angelos ok 2002-02-24T00:30:00Z deraadt deraadt@openbsd.org 2002-02-24T00:30:00Z urn:sha1:6e5f36c84c0435c6e92f7e0125e6ca23ba13e81e Compression support for IPComp. Include files only. angelos@ ok. 2001-07-05T08:26:04Z jjbg jjbg@openbsd.org 2001-07-05T08:26:04Z urn:sha1:71960029fe8c5a28f3c08f7bf3e337fefc38cd27 KNF 2001-06-16T22:17:49Z deraadt deraadt@openbsd.org 2001-06-16T22:17:49Z urn:sha1:8a4e668974020daec5b93a01a340f96a253ef731