| dfb8e185 | 03-Apr-2023 |
Jeeban Sethi <13jeeban@gmail.com> |
Updated return value of PEM_write_TYPE() and PEM_write_bio_TYPE() in man-pages.
Fixes #20218
CLA: trivial
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas
Updated return value of PEM_write_TYPE() and PEM_write_bio_TYPE() in man-pages.
Fixes #20218
CLA: trivial
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20673)
show more ...
|
| 37ae8549 | 11-Apr-2023 |
dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
Bump coverallsapp/github-action from 1.2.4 to 2.1.0
Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.4 to 2.1.0.
- [Release notes](https://githu
Bump coverallsapp/github-action from 1.2.4 to 2.1.0
Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.4 to 2.1.0.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v1.2.4...v2.1.0)
---
updated-dependencies:
- dependency-name: coverallsapp/github-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
CLA: trivial
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20699)
show more ...
|
| f06ef165 | 13-Feb-2023 |
Bernd Edlinger |
Alternative fix for CVE-2022-4304
This is about a timing leak in the topmost limb
of the internal result of RSA_private_decrypt,
before the padding check.
There are in fact
Alternative fix for CVE-2022-4304
This is about a timing leak in the topmost limb
of the internal result of RSA_private_decrypt,
before the padding check.
There are in fact at least three bugs together that
caused the timing leak:
First and probably most important is the fact that
the blinding did not use the constant time code path
at all when the RSA object was used for a private
decrypt, due to the fact that the Montgomery context
rsa->_method_mod_n was not set up early enough in
rsa_ossl_private_decrypt, when BN_BLINDING_create_param
needed it, and that was persisted as blinding->m_ctx,
although the RSA object creates the Montgomery context
just a bit later.
Then the infamous bn_correct_top was used on the
secret value right after the blinding was removed.
And finally the function BN_bn2binpad did not use
the constant-time code path since the BN_FLG_CONSTTIME
was not set on the secret value.
In order to address the first problem, this patch
makes sure that the rsa->_method_mod_n is initialized
right before the blinding context.
And to fix the second problem, we add a new utility
function bn_correct_top_consttime, a const-time
variant of bn_correct_top.
Together with the fact, that BN_bn2binpad is already
constant time if the flag BN_FLG_CONSTTIME is set,
this should eliminate the timing oracle completely.
In addition the no-asm variant may also have
branches that depend on secret values, because the last
invocation of bn_sub_words in bn_from_montgomery_word
had branches when the function is compiled by certain
gcc compiler versions, due to the clumsy coding style.
So additionally this patch stream-lined the no-asm
C-code in order to avoid branches where possible and
improve the resulting code quality.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20281)
show more ...
|
| 34e4a962 | 29-Mar-2023 |
Anatolii Lishchynskyi |
Erase temporary buffer in EVP_PKEY_get_bn_param()
Function EVP_PKEY_get_bn_param() uses temporary buffer (on stack or
heap allocated) to store serialized bignum, but after deserializing
Erase temporary buffer in EVP_PKEY_get_bn_param()
Function EVP_PKEY_get_bn_param() uses temporary buffer (on stack or
heap allocated) to store serialized bignum, but after deserializing it
into BIGNUM*, the buffer is not erased and may contain sensitive data.
This change makes sure the buffer is erased if it was successfully
filled before. Unfortunately, it does not distinguish between public and
private key components, and will always erase the buffer.
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20639)
show more ...
|
| 843f6e27 | 29-Mar-2023 |
Matt Caswell |
Add a test for SSL_version(), SSL_get_version() etc
We also test SSL_is_dtls(), SSL_is_tls() and SSL_is_quic().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dal
Add a test for SSL_version(), SSL_get_version() etc
We also test SSL_is_dtls(), SSL_is_tls() and SSL_is_quic().
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20650)
show more ...
|
| 50769b15 | 29-Mar-2023 |
Matt Caswell |
Make sure we can query the SSL object for version info when using QUIC
We have the existing functions SSL_version(), SSL_get_version() and
SSL_is_dtls(). We extend the first two to retur
Make sure we can query the SSL object for version info when using QUIC
We have the existing functions SSL_version(), SSL_get_version() and
SSL_is_dtls(). We extend the first two to return something sensible when
using QUIC. We additionally provide the new functions SSL_is_tls() and
SSL_is_quic() to provide a mechanism to figure out what protocol we are
using.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20650)
show more ...
|
| fae5a155 | 30-Mar-2023 |
Anthony Roberts |
Fix compilation error when using clang-cl 16 or higher
Fixes a "Incompatible function pointer types" error.
In prior versions, this was a warning, but is now an error.
CLA:
Fix compilation error when using clang-cl 16 or higher
Fixes a "Incompatible function pointer types" error.
In prior versions, this was a warning, but is now an error.
CLA: trivial
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20654)
show more ...
|
| 9559ad0e | 21-Mar-2023 |
slontis |
Make DSA_sign() test for negative p,q,g values.
Related to #20268
DSA_sign() assumes that the signature passed in is related to DSA_size().
If q is negative then DSA_size() actu
Make DSA_sign() test for negative p,q,g values.
Related to #20268
DSA_sign() assumes that the signature passed in is related to DSA_size().
If q is negative then DSA_size() actually fails and returns 0.
A test that tries to allocate the signature buffer using DSA_size() and then
pass it to DSA_sign() will then either.
(1) Have a signature buffer of NULL. In this case it was leaking data
returned via i2d_DSA_SIG.
(2) Cause a seg fault because we created a buffer that was not large
enough to hold the signature. As it already checked zero we also now
check for negative values also.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/20553)
show more ...
|
| 4557e280 | 24-Dec-2022 |
Michael Baentsch <57787676+baentsch@users.noreply.github.com> |
Provider-based KEM and SIG alg speed testing added
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/ope
Provider-based KEM and SIG alg speed testing added
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/19968)
show more ...
|
| 1636b355 | 29-Mar-2023 |
Taylor R Campbell |
/dev/crypto: Suppress warning when open /dev/crypto fails with ENXIO.
On NetBSD the device node is essentially always present, but these
days it's mostly not useful except for testing th
/dev/crypto: Suppress warning when open /dev/crypto fails with ENXIO.
On NetBSD the device node is essentially always present, but these
days it's mostly not useful except for testing the kernel crypto
stack since the cost of CPU crypto has gone down much faster than the
cost of I/O to external crypto engines. So on most systems it is
disabled in a way that makes open fail with ENXIO. NetBSD has had
this warning for ENXIO patched away for years.
CLA: trivial
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20636)
show more ...
|
