summaryrefslogtreecommitdiffstats
path: root/lib/libcrypto/rsa
AgeCommit message (Collapse)AuthorFilesLines
2020-01-17Free pss in RSA_freeinoguchi1-1/+2
ok bcook@ ok and "move it down two lines" jsing@
2019-11-20Fix rsa key output formatinoguchi1-5/+12
This fixes openssl(1) rsa -text output format ok tb@
2019-11-04Reshuffle RSA_PSS_PARAMS and RSA_OAEP_PARAMS to avoid duplicate typedef.jsing1-21/+19
Issue spotted by bcook@ ok bcook@ inoguchi@
2019-11-02Bring back some icky buffer allocation code so that pkey_rsa_print()jsing1-9/+41
works again with the horrific API that is ASN1_bn_print(). Issue spotted by inoguchi@
2019-11-02Provide RSA_PKCS1_OpenSSL().jsing2-3/+9
Prompted by inoguchi@
2019-11-02Make RSA_padding_{add,check}_PKCS1_OAEP_mgf1() public.jsing2-9/+8
2019-11-02Make RSA_OAEP_PARAMs public.jsing2-17/+17
2019-11-01Add RSA CMS support.jsing3-5/+262
From OpenSSL 1.1.1d. ok tb@
2019-11-01Update RSA ASN.1 code to handle RSA-PSS.jsing4-302/+389
From OpenSSL 1.1.1d. ok tb@
2019-11-01Clean up RSA_new_method().jsing1-40/+24
Use calloc() instead of malloc() for initialisation and remove explicit zero initialisation of members. This ensures that new members always get initialised. Also use a single error return path, simplifying code. ok tb@
2019-10-31Add CMS controls for RSA.jsing1-1/+8
2019-10-31Add support for RSA-PSS.jsing5-64/+369
From OpenSSL 1.1.1d. ok inoguchi@
2019-10-31Move RSA min modulus to a define and increase from 256 to 512 bits.jsing2-4/+6
From OpenSSL 1.1.1d. ok inoguchi@
2019-10-31Fix indent and indent before labels.jsing1-5/+5
2019-10-31Use braces where a statement has both multi-line and single-line blocks.jsing1-8/+13
Makes code more robust and reduces differences with OpenSSL. ok inoguchi@
2019-10-31Add additional validation of key size, message digest size and publicjsing1-3/+17
exponent. From OpenSSL 1.1.1d. ok inoguchi@
2019-10-31Clean up some code.jsing1-11/+13
Assign and test, explicitly test against NULL and use calloc() rather than malloc. ok inoguchi@
2019-10-31Avoid potentially leaking pub_exp in pkey_rsa_copy().jsing1-4/+4
ok inoguchi@
2019-10-29Add two controls that were missed in the previous commit.jsing1-1/+13
2019-10-29Update RSA OAEP code.jsing2-21/+124
This syncs the RSA OAEP code with OpenSSL 1.1.1d, correctly handling OAEP padding and providing various OAEP related controls. ok inoguchi@ tb@
2019-10-25Free maskHash when RSA_PSS_PARAMS is freed.jsing1-3/+23
ok tb@
2019-10-24Provide RSA_OAEP_PARAMS along with ASN.1 encoding/decoding.jsing2-2/+97
For now these are internal only. From OpenSSL 1.1.1d. ok inoguchi@
2019-10-24Add RSA_PSS_PARAMS pointer to RSA struct.jsing1-1/+8
This will be used by upcoming RSA-PSS code. ok tb@
2019-10-24Add maskHash field to RSA_PSS_PARAMS.jsing1-1/+4
This will be soon used as an optimisation and reduces the differences between OpenSSL. ok tb@
2019-10-24Provide RSA_pkey_ctx_ctrl().jsing2-2/+19
This is a wrapper around EVP_PKEY_CTX_ctrl() which requires the key to be either RSA or RSA-PSS. From OpenSSL 1.1.1d. ok tb@
2019-10-17Sync RSA_padding_check_PKCS1_OAEP_mgf1().jsing1-63/+110
Update RSA_padding_check_PKCS1_OAEP_mgf1() with code from OpenSSL 1.1.1d (with some improvements/corrections to comments). This brings in code to make the padding check constant time. ok inoguchi@ tb@
2019-10-09Use EVP_MAX_MD_SIZE instead of SHA_DIGEST_LENGTH and remove OPENSSL_NO_SHA*jsing1-7/+2
conditionals, now that this code handles arbitrary message digests. ok inoguchi@ tb@
2019-10-04Provide internal RSA_padding_{add,check}_PKCS1_OAEP_mgf1() functions.jsing2-10/+90
These are internal only for now and will be made public at a later date. The RSA_padding_{add,check}_PKCS1_OAEP() functions become wrappers around the *_mgf1() variant. ok tb@ inoguchi@ (as part of a larger diff)
2019-10-03Move towards making RSA OAEP functions handle arbitrary message digests.jsing1-51/+57
Based on OpenSSL 1.1.1. ok tb@, inoguchi@ (on an earlier/larger diff)
2019-09-09Provide EVP_PKEY_CTX_get_signature_md() macro and implement thejsing1-1/+5
EVP_PKEY_CTRL_GET_MD control for DSA, EC and RSA. This is used by the upcoming RSA CMS code. ok inoguchi@ tb@
2019-06-05provide getters and setters for the RSA_METHOD interfacegilles2-2/+220
ok tb@, jsing@, sthen@
2018-09-12Add some accessor functions:djm2-2/+22
RSA_meth_get_finish() RSA_meth_set1_name() EVP_CIPHER_CTX_(get|set)_iv() feedback and ok jsing@ tb@
2018-09-05use timing-safe compares for checking results in signature verificationdjm4-9/+10
(there are no known attacks, this is just inexpensive prudence) feedback and ok tb@ jsing@
2018-08-24Add consts to EVP_PKEY_asn1_set_private()tb1-2/+2
Requires adding a const to the priv_decode() member of EVP_PKEY_ASN1_METHOD and adjusting all *_priv_decode() functions. All this is already documented this way. tested in a bulk build by sthen ok jsing
2018-08-19whitespace fixtb1-2/+2
2018-08-19Don't leak db on error in RSA_padding_check_PKCS1_OAEP().tb1-7/+7
CID #183499. input & ok jsing, ok mestre on first version
2018-08-05In RSA_padding_add_PKCS1_OAEP, dbmask needs to be freed on failure.bcook1-3/+7
ok tb@
2018-07-23Implement RSASSA-PKCS1-v1_5 as specified in RFC 8017.tb1-119/+147
Based on an OpenSSL commit by David Benjamin. Alex Gaynor and Paul Kehrer from the pyca/cryptography Python library reported that more than 200 "expected to fail" signatures among Project Wycheproof's test vectors validated on LibreSSL. This patch makes them all fail. ok jsing commit 608a026494c1e7a14f6d6cfcc5e4994fe2728836 Author: David Benjamin <davidben@google.com> Date: Sat Aug 20 13:35:17 2016 -0400 Implement RSASSA-PKCS1-v1_5 as specified. RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode the DigestInfo struct and then compare the result against the public key operation result. This implies that one and only one encoding is legal. OpenSSL instead parses with crypto/asn1, then checks that the encoding round-trips, and allows some variations for the parameter. Sufficient laxness in this area can allow signature forgeries, as described in https://www.imperialviolet.org/2014/09/26/pkcs1.html Although there aren't known attacks against OpenSSL's current scheme, this change makes OpenSSL implement the algorithm as specified. This avoids the uncertainty and, more importantly, helps grow a healthy ecosystem. Laxness beyond the spec, particularly in implementations which enjoy wide use, risks harm to the ecosystem for all. A signature producer which only tests against OpenSSL may not notice bugs and accidentally become widely deployed. Thus implementations have a responsibility to honor the specification as tightly as is practical. In some cases, the damage is permanent and the spec deviation and security risk becomes a tax all implementors must forever pay, but not here. Both BoringSSL and Go successfully implemented and deployed RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so this change should be compatible enough to pin down in future OpenSSL releases. See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00 As a bonus, by not having to deal with sign/verify differences, this version is also somewhat clearer. It also more consistently enforces digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath wasn't quite doing this right. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1474
2018-04-14make ENGINE_finish() succeed on NULL and simplify callers as intb1-12/+7
OpenSSL commit 7c96dbcdab9 by Rich Salz. This cleans up the caller side quite a bit and reduces the number of lines enclosed in #ifndef OPENSSL_NO_ENGINE. codesearch.debian.net shows that almost nothing checks the return value of ENGINE_finish(). While there, replace a few nearby 'if (!ptr)' with 'if (ptr == NULL)'. ok jsing, tested by & ok inoguchi
2018-03-17Provide RSA_meth_{dup,free,new,set_{finish,priv_{dec,enc}}}()tb2-1/+96
Note that these functions return NULL in out-of-memory situations, but contrary to OpenSSL's versions they do not set an error. ok jsing
2018-02-20Provide RSA_{clear,set,test}_flasg()tb2-2/+23
ok jsing
2018-02-18Provide RSA_{g,s}et0_crt_params()tb2-2/+40
ok jsing
2018-02-18Use usual order of RSA_{g,s}et0_key().tb2-13/+14
ok jsing
2018-02-18Provide RSA_{g,s}et0_factors()tb2-2/+31
ok jsing
2018-02-18Provide RSA_bits()tb2-2/+9
ok jsing
2018-02-17Provide further parts of the OpenSSL 1.1 API: {DH,DSA}_get0_{key,pqg}(),tb2-2/+39
EVP_PKEY_get0_{DH,DSA,RSA}(), RSA_{g,s}et0_key(). ok jsing
2017-08-30Bring back the RSA_SSLV23_PADDING define.jsing1-1/+2
Several pieces of software expect this to be available unconditionally.
2017-08-28Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedjsing4-166/+3
code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
2017-05-02use freezero() instead of memset/explicit_bzero + free. Substantiallyderaadt3-35/+13
reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
2017-04-28revert previous accidental commitbeck3-21/+33
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.