summaryrefslogtreecommitdiffstats
path: root/sys/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add support for the Extended (64-bit) Sequence Number as definedmikeb2012-06-292-9/+36
| | | | | | | | | | | | in RFC4302 and RFC4303. Right now only software crypto engine is capable of doing it. Replay check was rewritten to implement algorithm described in the Appendix A of RFC4303 and the window size was increased to 64. Tested against OpenBSD, Linux (strongswan) and Windows. No objection from the usual suspects.
* Use explicit_bzero() for clearing key material.matthew2012-04-251-4/+5
| | | | | Pointed out by Michael W. Bombardieri on tech@. ok deraadt
* Add struct proc * argument to FRELE() and FILE_SET_MATURE() inguenther2012-04-221-2/+2
| | | | | | anticipation of further changes to closef(). No binary change. ok krw@ miod@ deraadt@
* Hold struct filedesc's fd_lock when writing to the fd_ofiles, fd_ofileflags,guenther2012-02-151-1/+4
| | | | | | | | or fd_{lo,hi}maps members, or when doing a read for a write. Fixes hangs when an rthreaded processes sleeps while copying the fd table for fork() and catches another thread with the lock. ok jsing@ tedu@
* empty files should be deletedtedu2011-07-072-0/+0
|
* Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzderaadt2011-07-074-233/+183
| | | | | | | | | | | | code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
* cleanup aes-ctr keystream after use; ok deraadtmikeb2011-01-121-1/+2
|
* fix encryption for uio_iovcnt > 1 by passing the absolute offset 'count'markus2011-01-111-3/+16
| | | | | | to cuio_copydata() and make sure we don't loop forever if the end of an iov matches the cipher block boundary. ok mikeb, deraadt
* key lengths are counted in bitsderaadt2011-01-111-3/+3
|
* add explicit_bzero() calls before free()ing key materialderaadt2011-01-112-10/+17
| | | | ok mikeb
* in SHA1Final(), explicitly clear the local bufferderaadt2011-01-111-2/+2
| | | | ok mikeb
* accidental commit of a pending diff relating to something elsederaadt2011-01-111-21/+8
|
* in AES_GMAC_Final(), explicitly clear the local bufferderaadt2011-01-111-1/+2
| | | | ok mikeb
* for key material that is being being discarded, convert bzero() toderaadt2011-01-119-39/+52
| | | | | explicit_bzero() where required ok markus mikeb
* use the do {} while construct in the copying macrosderaadt2010-12-221-9/+15
| | | | ok mikeb
* remove dead code (ivp did always point to iv in the decrypt path).markus2010-12-211-38/+14
| | | | | instead save one bcopy() per block by alternating between two iv buffers; ok mikeb@
* move CRYPTO_VIAC3_MAX out of cryptodev.h and into the onlyjsg2010-12-161-3/+1
| | | | | | file it will be used from. requested by/ok mikeb@
* The VIA ciphers are added to an array of CRYPTO_ALGORITHM_MAX lengthjsg2010-12-161-1/+3
| | | | | | | which should have been declared as CRYPTO_ALGORITHM_MAX + 1, fix this and reserve enough space for the VIA additions as well. ok/comments from mikeb & deraadt
* disable access to the crypto(4) device from userland; ok deraadtmikeb2010-12-141-3/+3
|
* use a well established define instead of rolling our own; no binary changemikeb2010-11-081-7/+5
|
* Retire Skipjackmikeb2010-10-067-349/+5
| | | | | | | | | | | There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
* zero out auth hash context before freeing it; ok matthew millertmikeb2010-10-061-2/+4
|
* OCF support for the Galois/Counter Mode (GCM) for AES asmikeb2010-09-227-16/+506
| | | | | | | | | | | | | | | | described in FIPS SP 800-38D. This implementation supports 16 byte authentication tag only, splitting transformation into two parts: encryption and authentication. Encryption is handled by the existing AES-CTR implementation, while authentication requires new AES_GMAC hash function. Additional routine is added to the software crypto driver to deal with peculiarities of a combined authentication- encryption transformation. With suggestions from reyk, naddy and toby.
* Reintroduce most crypto/crypto.c r1.55:jsing2010-09-081-12/+8
| | | | | | | | | | | Move pool initialization to init_crypto and zap the crypto_pool_initialized variable. This way we don't have to check if the pool are initialized every time we do a crypto_getreq(). However, also perform the crypto initialisation earlier in init_main so that the crypto pools are initialised before they are used. ok mikeb@ thib@ deraadt@
* Backout r1.55 since this breaks anything which does crypto ops prior tojsing2010-08-081-6/+11
| | | | | | | | | init_crypto() being called from late in init_main(). In particular, this breaks softraid crypto volumes that are assembled at boot. No cookies for thib/mikeb! "Back it out, right now" deraadt@
* No need for read/write functions, just use enodev like all the otherderaadt2010-07-211-19/+1
| | | | | things things do ok nicm
* Switch some obvious network stack MAC comparisons from bcmp() tomatthew2010-07-201-2/+2
| | | | | | timingsafe_bcmp(). ok deraadt@; committed over WPA.
* Mark a DMA accessible malloc for later correction. This ismatthew2010-07-201-2/+2
| | | | | potentially up to 64KB, so we'll need something fancier than dma_alloc().
* Revert part of previous.thib2010-07-081-4/+6
| | | | | | | The splvm protection is needed after all, as we are walking the list of registered crypto drivers and doing that unprotected is unwise. Pointed out by kettenis@
* Move pool initialization to init_crypto and zap the crypto_pool_initializedthib2010-07-081-16/+9
| | | | | | | | | | | | | variable. This way we don't have to check if the pool are initialized every time we do a crypto_getreq(). Move splvm lower as it isnt need all through crypto_newsession(). tiny KNF nit. From mikeb OK deraadt@
* m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsblambert2010-07-021-3/+3
| | | | | | | | | are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
* Zap a dead prototype, crypto_thread(); Leftover since crypto wasthib2010-06-231-2/+1
| | | | | | moved from a special kthread to workqs. OK dlg@
* Remove the CRYPTO_ALGORITHM_ALL define, fixup accordinglythib2010-06-092-14/+12
| | | | | | | | and make the loop invartiants <= CRYPTO_ALGORITHM_MAX Do this also for the CRK_ALGORITHM_MAX this also fixes the a bug that caused us to skip CRK_DH_COMPUTE_KEY. ok deraadt@
* remove proc.h include from uvm_map.h. This has far reaching effects, astedu2010-04-203-6/+3
| | | | | | sysctl.h was reliant on this particular include, and many drivers included sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed. ok deraadt
* Fix two bugs in IPsec/HMAC-SHA2:markus2010-01-105-31/+54
| | | | | | | | | | | | | | | (1) use correct (message) block size of 128 byte (instead of 64 bytes) for HMAC-SHA512/384 (RFC4634). (2) RFC4868 specifies that HMAC-SHA-{256,384,512} is truncated to nnn/2 bits, while we still use 96 bits. 96 bits have been specified in draft-ietf-ipsec-ciph-sha-256-00 while draft-ietf-ipsec-ciph-sha-256-01 changed it to 128 bits. WARNING: this change makes IPsec with SHA-256 (the default) incompatible with older OpenBSD versions and other IPsec-implementations that share this bug. ok+tests naddy, fries; requested by reyk/deraadt
* crypto hardware (eg, hifn) establishes its interrupt handler atdlg2009-09-032-8/+18
| | | | | | | | | | | | | | | | | | | | IPL_NET. when the hardware finishes some work for the crypto subsystem and therefore something in the kernel that wanted crypto done, it calls crypto_done from that interrupt handler. one of the things that uses crypto is ipsec. when crypto is done for ipsec it then pushes the packet along the network stack. the problem is that all the structures inside the network stack are only protected at splsoftnet. we could be in the middle of modifications to the pf state table or the pfsync queues when we get a hifn interrupt and then go stomp on the same structures. the solution is to defer the completions so they can do the right spl protections. this basically reverts r1.46 of src/sys/crypto/crypto.c. found by naddy@
* sizeof(ptr) -> sizeof(*ptr) as intended; ok djm@ millert@miod2009-08-171-1/+1
|
* Buffer in RMD160_CTX is length RMD160_BLOCK_LENGTH not RMD160_DIGEST_LENGTH.millert2009-07-051-2/+2
| | | | Userland version was already correct. From Jason Fritcher. OK deraadt@
* variable no longer usedderaadt2009-02-171-2/+2
|
* The loop here preparing the uio always added the length of the firstoga2009-02-171-4/+2
| | | | | | | | | iovec, not the correct one. It worked ok since iovcnt was always 1. Since it's unlikely to be any other number, remove the loop and just add the one length we care about. "go ahead" deraadt@.
* Use defines for constants. Use __attribute__ bounded.hshoexer2008-11-041-7/+16
| | | | ok markus@ (quite some time ago)
* reintroduce mutexes to workqs for locking.dlg2008-10-301-2/+2
| | | | | | tested by many on many archs including several alpha test. ok tedu@ go for it deraadt@
* match libc sha2(3) API changes for kernel; ok millert@djm2008-09-066-172/+172
|
* Implementation of the HMAC-MD5, HMAC-SHA1, HMAC-SHA256, AES-128-CMACdamien2008-08-126-0/+572
| | | | | | | | | | | and AES Key Wrap algorithms. They will replace/extend the non-generic implementation in net80211. AES-128-CMAC tested by sobrado@ (AlphaServer 1200), naddy@ (alpha/sparc64) and sthen@ (sparc64, armish). HMAC-* reviewed by hshoexer@ ok and hints from djm@
* gives this a chance to work on architectures with strict alignmentdamien2008-07-211-17/+28
| | | | constraints.
* implement automatic time-based rekeying (every 10 minutes); ok deraadt@djm2008-06-252-19/+24
|
* Introduce a facility to generate unpredictable 32 bit numbers withdjm2008-06-092-0/+167
| | | | | | | | | | | | | | near maximal (2^32) cycle times. These are useful for network IDs in cases where there are negative consequences to ID prediction and/or reuse. Use the idgen32() functions to generate IPv6 IDs and NFS client/server XIDs. Pseudorandom permutation code in crypto/idgen.c based on public domain skip32.c from Greg Rose. feedback & ok thib@ deraadt@
* add myself to copyrightdjm2008-06-091-3/+8
|
* Implement the AES XTS mode of operation for the crypto(9) framework.djm2008-06-095-15/+177
| | | | | | | | XTS is a "tweaked" AES mode that has properties that are desirable for block device encryption and it is specified in the IEEE P1619-2007 standard for this purpose. prodded by & ok hshoexer@
* constify arguments in wrapper functions; the lower level functionsdjm2008-06-092-10/+10
| | | | were already done
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.