summaryrefslogtreecommitdiffstats
path: root/lib/libcrypto/evp
AgeCommit message (Collapse)AuthorFilesLines
2021-03-31Provide EVP_PKEY_new_CMAC_key(3)tb1-5/+1
ok bcook inoguchi jsing
2021-03-29Prepare to provide EVP_PKEY_new_CMAC_key()tb4-20/+84
sebastia ran into this when attempting to update security/hcxtools. This will be tested via wycheproof.go once the symbol is public. ok jsing, tested by sebastia
2021-02-18Pull in fix for EVP_CipherUpdate() overflow from OpenSSL.tb1-1/+23
ok inoguchi commit 6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 Author: Matt Caswell <matt@openssl.org> Date: Tue Feb 2 17:17:23 2021 +0000 Don't overflow the output length in EVP_CipherUpdate calls CVE-2021-23840 Reviewed-by: Paul Dale <pauli@openssl.org>
2020-06-05Add a custom copy handler for AES key wraptb1-5/+31
This is necessary because ctx->cipher_data is an EVP_AES_WRAP_CTX containing a pointer to ctx->iv. EVP_CIPHER_CTX_copy() uses memcpy to copy cipher_data to the target struct. The result is that the copy contains a pointer to the wrong struct, which then leads to a use-after-free. The custom copy handler fixes things up to avoid that. Issue reported by Guido Vranken ok beck inoguchi jsing
2020-06-05Allow GOST R 34.11-2012 in PBE/PBKDF2/PKCS#5.jsing1-1/+3
Diff from Dmitry Baryshkov <dbaryshkov@gmail.com> Sponsored by ROSA Linux ok inoguchi@ tb@
2020-04-30Disallow setting the AES-GCM IV length to 0tb1-1/+5
It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)
2020-04-27Disallow the use of zero length IVs in AES-GCM viatb3-3/+15
EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen.
2020-03-04Check high bit for base64 decodeinoguchi1-2/+10
Referred to this OpenSSL commit and adopted to the codebase. b785504a10310cb2872270eb409b70971be5e76e suggest and ok tb@
2020-03-03Fix base64 processing of long linesinoguchi1-99/+66
Fix the problem that long unbroken line of base64 text is not decoded. Referred to this OpenSSL commit and adapted to the codebase. 3cdd1e94b1d71f2ce3002738f9506da91fe2af45 Reported by john.a.passaro <at> gmail.com to the LibreSSL ML. ok tb@
2020-01-26typotb1-2/+2
2020-01-26Improve the comment explaining why the previous change matches OpenSSL'stb1-8/+15
behavior. ok jsing
2020-01-26Adjust EVP_chacha20()'s behavior to match OpenSSL's semantics:tb1-7/+14
The new IV is 128 bit long and is actually the 64 bit counter followed by 64 the bit initialization vector. This is needed by an upcoming change in OpenSSH and is a breaking change for all current callers. There are language bindings for Node.js, Rust and Erlang, but none of our ports use them. Note that EVP_chacha20() was first introduced in LibreSSL on May 1, 2014 while the entirely incompatible version in OpenSSL was committed on Dec 9, 2015. Initial diff from djm and myself, further refinements by djm. Ports grepping by sthen ok jsing
2020-01-12Avoid leak in error path of PKCS5_PBE_keyivgeninoguchi1-1/+2
ok jsing@ tb@
2019-11-01Wire up PKEY methods for RSA-PSS.jsing1-2/+6
ok tb@
2019-10-29Provide EVP_PKEY_CTX_md().jsing2-8/+18
This handles controls with a message digest by name, looks up the message digest and then proxies the control through with the EVP_MD *. This is internal only for now and will be used in upcoming RSA related changes. Based on OpenSSL 1.1.1d. ok inoguchi@ tb@
2019-10-24Add EVP_PKEY_RSA_PSS.jsing1-1/+2
ok tb@
2019-09-09Provide EVP_PKEY_CTX_get_signature_md() macro and implement thejsing1-4/+10
EVP_PKEY_CTRL_GET_MD control for DSA, EC and RSA. This is used by the upcoming RSA CMS code. ok inoguchi@ tb@
2019-08-11Provide ASN1_PKEY_CTRL_CMS_RI_TYPE.jsing1-1/+2
2019-05-14Correct missing test to determine if length is in bytes or in bits.beck1-1/+3
Issue found by Guido Vranken <guidovranken@gmail.com> ok tedu@ tb@
2019-05-12Revert the other hunk of r1.36 as well: in the case of CCM, ccm.key istb1-1/+11
assigned from aesni_ccm_init_key() via CRYPTO_ccm128_init(), so it needs to be copied over... Pointed out by Guido Vranken. ok jsing
2019-05-10Revert part of r1.36: in the case of GCM, gcm.key is assigned fromtb1-1/+7
aesni_gcm_init_key() via CRYPTO_gcm128_init(), so it needs to be copied over... Fixes cryptofuzz issue #14352 and likely also #14374. ok beck jsing
2019-04-19Allocate md_data with calloc to avoid use of uninitialised memory.jsing1-6/+6
Found by Guido Vranken when fuzzing and trying to use GOST with HMAC. Fix confirmed by Guido; ok tb@
2019-04-14Some more malloc() to calloc() conversions.jsing1-7/+5
ok tb@
2019-04-14Remove two pointless chunks of code.jsing1-16/+1
This reverts part of OpenSSL c2fd5d79, which added the same code to AES CCM, GCM and XTS. In the case of CCM and GCM nothing assigns {ccm,gcm}.key so there is never going to be anything to update (unlike XTS). ok tb@
2019-04-14Use calloc() when allocating cipher_data.jsing1-5/+5
Avoids use of uninitialised memory. ok tb@
2019-04-14Annotate a future improvement.jsing1-1/+2
2019-04-14Avoid potential double-frees following EVP_CIPHER_CTX_copy().jsing1-4/+17
In the case of a cipher with a custom copy control, if that control fails we may still have pointers that we do not own in the previously copied cipher data. Avoid potential double-frees by zeroing and freeing the copied cipher data in this case. Issue reported by Guido Vranken. ok tb@
2019-04-03Avoid some out of bound accesses in aesni_cbc_hmac_sha1_cipher().tb1-7/+13
The plen variable can be NO_PAYLOAD_LENGTH == (size_t)-1, so doing tls_aad[plen-4] is no good. Also check that the length of the AAD set via the control interface is equal to 13 since the whole file is written with that case in mind. Note that we no longer use this code in LibreSSL/OpenBSD. We eliminated the use of these control interfaces and stitched cipher modes in libssl a while ago. Problem found by Guido Vranken with his cryptofuzz - thanks! input & ok beck, jsing
2019-03-27Cast nonce bytes to avoid undefined behaviour when left shifting.jsing1-3/+3
Reported by oss-fuzz, really fixes issue #13805. ok beck@ tb@
2019-03-24Cast nonce bytes to avoid undefined behaviour when left shifting.jsing1-3/+3
Reported by oss-fuzz, fixes issue #13805. ok beck@ tb@
2019-03-18Expand the ERR_PACK() macro to ERR_REASON() for consistency.tb1-2/+2
No binary change.
2019-03-17Provide EVP_PKEY_get0_hmac(). From OpenSSL 1.1.1 which is stilltb3-3/+22
freely licensed. From jsing
2019-03-17Provide EVP_aes_{128,192,256}_wrap(). This is a compatibletb5-6/+171
implementation based on the one in OpenSSL 1.0.2r which is still freely licensed. The functions are undocumented in OpenSSL. To use them, one needs to set the undocumented EVP_CIPHER_CTX_FLAG_WRAP_ALLOW flag on the EVP_CIPHER_CTX. resolves #505 ok jsing
2019-03-17Add the SM4 block cipher from the Chinese standard GB/T 32907-2016.tb3-2/+134
This is an ISC licensed version based on the sources by Ribose Inc that were ported to OpenSSL in 2017. Patch from Daniel Wyatt with minor tweaks. ok inoguchi, jsing
2019-01-22add support for xchacha20 and xchacha20-poly1305dlg2-2/+125
xchacha is a chacha stream that allows for an extended nonce, which in turn makes it feasible to use random nonces. ok tb@
2019-01-19provide EVP_ENCODE_CTX_{new,free}().tb2-2/+16
ok jsing
2018-12-26Make AES CCM available in tables.tb1-1/+4
Omission reported by reyk and Alice Wonder. ok bcook jsing
2018-11-24zap 10 tab leading whitespace before 'struct evp_pkey_ctx_st {'tb1-2/+2
2018-11-11Add EVP_sm3() to OpenSSL_add_all_digests_internal().tb1-1/+4
ok beck inoguchi
2018-11-11Add Ribose Inc's implementation of the SM3 hashing function withtb2-1/+77
tweaks from jsing and myself. The SM2/SM3/SM4 algorithms are mandatory for legal use of cryptography within China and [are] widely applied in the country, covering identification/financial cards, contactless, TPM 2.0 and PKI. ok beck inoguchi jsing
2018-09-12Add some accessor functions:djm2-2/+44
RSA_meth_get_finish() RSA_meth_set1_name() EVP_CIPHER_CTX_(get|set)_iv() feedback and ok jsing@ tb@
2018-08-24Add const to EVP_PKCS82PKEY().tb1-2/+2
tested in a bulk by sthen ok jsing
2018-08-24Add consts to EVP_PKEY_asn1_set_private()tb1-2/+2
Requires adding a const to the priv_decode() member of EVP_PKEY_ASN1_METHOD and adjusting all *_priv_decode() functions. All this is already documented this way. tested in a bulk build by sthen ok jsing
2018-08-24After removing support for broken PKCS#8 formats (it was high time),tb1-2/+2
we can add const to PKCS8_pkey_get0(). In order for this to work, we need to sprinkle a few consts here and there. tested in a bulk by sthen ok jsing
2018-08-24Remove EVP_PKEY2PKCS8_broken() and PKCS8_set_broken()tb1-30/+2
Provide PKCS8_pkey_add1_attr_by_NID() and PKCS8_pkey_get0_attrs(). Remove the whole broken code and simplify pkcs8_priv_key_info_st accordingly. Based on OpenSSL commit 54dbf42398e23349b59f258a3dd60387bbc5ba13 plus some const that was added later. tested in a bulk build by sthen ok jsing
2018-08-24Check return value of EVP_EncodeUpdate() in b64_write().tb1-3/+4
ok jsing
2018-08-24Convert EVP_EncodeUpdate() to return an int to allow for errortb2-8/+10
checking. Matches our documented behavior. Based on OpenSSL commit c5ebfcab713a82a1d46a51c8c2668c419425b387 tested in a bulk by sthen ok jsing
2018-08-24Provide EVP_CIPHER_CTX_encrypting().tb2-2/+9
tested in a bulk by sthen ok jsing
2018-08-24Return an int in BIO_set_cipher() to be able to report errors.tb2-13/+22
tested in a bulk by sthen ok jsing
2018-08-14Add a comment that explains what the check is doing and why len >= 1.tb1-1/+2
Prompted by a remark by jsing
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.