summaryrefslogtreecommitdiffstats
path: root/crypto/bn (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Workaround for RSA on AArch64 Big EndianNikolay Nikolaev3 days1-0/+2
| | | | | | | | | | | | | | | | | | | 10646160125 introduced and optimized RSA NEON implementation for AArch64 architecture, namely Cortex-A72 and Neoverse N1. This implementation is broken in Big Endian mode, which is not widely used, therefore not properly verified. Here we disable this optimized implementation when Big Endian platform is used. Fixes: #22687 CLA: trivial Signed-off-by: Nikolay Nikolaev <nicknickolaev@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26257)
* Make it able to run asm code on OpenBSD (arm64)Theo Buehler4 days1-0/+1
| | | | | | | | | | | | | | | In order to get asm code running on OpenBSD we must place all constants into .rodata sections. The change to crypto/perlasm/arm-xlate.pl adjusts changes from Theo for additional assembler variants/flavours we use for building OpenSSL. Fixes #23312 Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24137)
* Code & comments changes to make them in consistentwillmafh2024-12-061-0/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* BN_secure_new function indentation correctionwillmafh2024-12-061-7/+7
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* Mark OPENSSL_armcap_P .hidden in arm asmKai Pastor2024-11-222-0/+2
| | | | | | | | | | Fixes #25601 Fixes #22414 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22181)
* s390x: Don't probe crypto cards for ME/CRT offloading during initializationIngo Franzki2024-10-231-6/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Probing for crypto cards during initialization by issuing an ioctl to the zcrypt device driver can cause a lot of traffic and overhead, because it runs for each and every application that uses OpenSSL, regardless if that application will later perform ME or CRT operations or not. Fix this by performing no probing during initialization, but detect the crypto card availability only at the first ME/CRT operation that is subject to be offloaded. If the ioctl returns ENODEV, then no suitable crypto card is available in the system, and we disable further offloading attempts by setting flag OPENSSL_s390xcex_nodev to 1. Setting the global flag OPENSSL_s390xcex_nodev in case of ENODEV is intentionally not made in a thread save manner, because the only thing that could happen is that another thread, that misses the flag update, also issues an ioctl and gets ENODEV as well. The file descriptor is not closed in such error cases, because this could cause raise conditions where we would close a foreign file if the same file descriptor got reused by another thread. The file descriptor is finally closed during termination by the atexit handler. In case the ioctl returns ENOTTY then this indicates that the file descriptor was closed (e.g. by a sandbox), but in the meantime the same file descriptor has been reused for another file. Do not use the file descriptor anymore, and also do not close it during termination. Fixes: https://github.com/openssl/openssl/commit/79040cf29e011c21789563d74da626b7465a0540 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25576)
* Harden BN_GF2m_poly2arr against misuse.Viktor Dukhovni2024-10-161-8/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The BN_GF2m_poly2arr() function converts characteristic-2 field (GF_{2^m}) Galois polynomials from a representation as a BIGNUM bitmask, to a compact array with just the exponents of the non-zero terms. These polynomials are then used in BN_GF2m_mod_arr() to perform modular reduction. A precondition of calling BN_GF2m_mod_arr() is that the polynomial must have a non-zero constant term (i.e. the array has `0` as its final element). Internally, callers of BN_GF2m_poly2arr() did not verify that precondition, and binary EC curve parameters with an invalid polynomial could lead to out of bounds memory reads and writes in BN_GF2m_mod_arr(). The precondition is always true for polynomials that arise from the standard form of EC parameters for characteristic-two fields (X9.62). See the "Finite Field Identification" section of: https://www.itu.int/ITU-T/formal-language/itu-t/x/x894/2018-cor1/ANSI-X9-62.html The OpenSSL GF(2^m) code supports only the trinomial and pentanomial basis X9.62 forms. This commit updates BN_GF2m_poly2arr() to return `0` (failure) when the constant term is zero (i.e. the input bitmask BIGNUM is not odd). Additionally, the return value is made unambiguous when there is not enough space to also pad the array with a final `-1` sentinel value. The return value is now always the number of elements (including the final `-1`) that would be filled when the output array is sufficiently large. Previously the same count was returned both when the array has just enough room for the final `-1` and when it had only enough space for non-sentinel values. Finally, BN_GF2m_poly2arr() is updated to reject polynomials whose degree exceeds `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against CPU exhausition attacks via excessively large inputs. The above issues do not arise in processing X.509 certificates. These generally have EC keys from "named curves", and RFC5840 (Section 2.1.1) disallows explicit EC parameters. The TLS code in OpenSSL enforces this constraint only after the certificate is decoded, but, even if explicit parameters are specified, they are in X9.62 form, which cannot represent problem values as noted above. Initially reported as oss-fuzz issue 71623. A closely related issue was earlier reported in <https://github.com/openssl/openssl/issues/19826>. Severity: Low, CVE-2024-9143 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25639)
* Copyright year updatesTomas Mraz2024-09-0516-16/+16
| | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
* Missing .rodata for AVX2/AVX512 codepathsTheo Buehler2024-09-024-6/+8
| | | | | | | | | This is a follow-up to #23997 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25340)
* crypto: factorize to hex chars conversion code.FdaSilvaYY2024-08-071-4/+1
| | | | | | Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24968)
* Fix typos found by codespellDimitri Papadopoulos2024-08-071-1/+1
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24949)
* Prefer ARRAY_SIZE(...)Dimitri Papadopoulos2024-07-221-1/+2
| | | | | | | | | | | In OpenSSL, it's actually OSSL_NELEM() in "internal/nelem.h". Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* that open brace { should be on the previous lineDimitri Papadopoulos2024-07-222-4/+5
| | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22097)
* Allow group methods to customize initialization for speedWatson Ladd2024-06-051-0/+42
| | | | | | | | | | | This commit also adds an implementation for P256 that avoids some expensive initialization of Montgomery arithmetic structures in favor of precomputation. Since ECC groups are not always cached by higher layers this brings significant savings to TLS handshakes. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22746)
* Optimizated calculation of shared power of 2 in bn_gcdAndrew Golovashevich2024-05-151-11/+23
| | | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24332)
* Correct top for EC/DSA nonces if BN_DEBUG is onTomas Mraz2024-05-021-0/+8
| | | | | | | | Otherwise following operations would bail out in bn_check_top(). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Rename BN_generate_dsa_nonce() to ossl_bn_gen_dsa_nonce_fixed_top()Tomas Mraz2024-05-021-10/+31
| | | | | | | | | | | | And create a new BN_generate_dsa_nonce() that corrects the BIGNUM top. We do this to avoid leaking fixed top numbers via the public API. Also add a slight optimization in ossl_bn_gen_dsa_nonce_fixed_top() and make it LE/BE agnostic. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Add ossl_bn_priv_rand_range_fixed_top() and use it for EC/DSATomas Mraz2024-05-021-2/+43
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Make ossl_gen_deterministic_nonce_rfc6979() constant timeTomas Mraz2024-05-024-5/+21
| | | | | | Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Make BN_generate_dsa_nonce() constant time and non-biasedTomas Mraz2024-05-023-36/+77
| | | | | | | | Co-authored-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24265)
* Unable to run asm code on OpenBSD (amd64)Theo Buehler2024-04-172-0/+4
| | | | | | | | | | | | | | | In order to get asm code running on OpenBSD we must place all constants into .rodata sections. davidben@ also pointed out we need to adjust `x86_64-xlate.pl` perlasm script to adjust read-olny sections for various flavors (OSes). Those changes were cherry-picked from boringssl. closes #23312 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23997)
* Fix GCC compilation -Waggressive-loop-optimizationsAdrien Zinger2024-04-021-5/+1
| | | | | | | | | | | | | | | | GCC 13.1.0 were reporting a compilation warning with -O2/3 and -Waggressive-loop-optimizations. GCC is raising an undefined behavior in the while loop. Replace the while loop with a memset call at the top of the function. Fixes #21088 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23898)
* Avoid an infinite loop in BN_GF2m_mod_invMatt Caswell2023-12-121-1/+7
| | | | | | | | | | | | | | | | If p is set to 1 when calling BN_GF2m_mod_inv then an infinite loop will result. Calling this function set 1 when applications call this directly is a non-sensical value - so this would be considered a bug in the caller. It does not seem possible to cause OpenSSL internal callers of BN_GF2m_mod_inv to call it with a value of 1. So, for the above reasons, this is not considered a security issue. Reported by Bing Shi. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22960)
* bn_nist: Fix strict-aliasing violations in little-endian optimizationsXi Ruoyao2023-11-301-52/+74
| | | | | | | | | | | | | | | | | | | | | | | | | The little-endian optimization is doing some type-punning in a way violating the C standard aliasing rule by loading or storing through a lvalue with type "unsigned int" but the memory location has effective type "unsigned long" or "unsigned long long" (BN_ULONG). Convert these accesses to use memcpy instead, as memcpy is defined as-is "accessing through the lvalues with type char" and char is aliasing with all types. GCC does a good job to optimize away the temporary copies introduced with the change. Ideally copying to a temporary unsigned int array, doing the calculation, and then copying back to `r_d` will make the code look better, but unfortunately GCC would fail to optimize away this temporary array then. I've not touched the LE optimization in BN_nist_mod_224 because it's guarded by BN_BITS2!=64, then BN_BITS2 must be 32 and BN_ULONG must be unsigned int, thus there is no aliasing issue in BN_nist_mod_224. Fixes #12247. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22816)
* bn: Properly error out if aliasing return value with modulusTomas Mraz2023-10-262-0/+31
| | | | | | | | | | | Test case amended from code initially written by Bernd Edlinger. Fixes #21110 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22421)
* BN_gcd(): Avoid shifts of negative valuesTomas Mraz2023-10-051-3/+3
| | | | | | | | | | | Fixes #22216 Thanks to Leland Mills for investigation and testing. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22272)
* Copyright year updatesMatt Caswell2023-09-0718-18/+18
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* Move ALIGN32 and ALIGN64 into common.h, and fix for clang-cl.exeTom Cosgrove2023-09-041-9/+2
| | | | | | | | | | | | | | clang-cl.exe defines __clang__ and _MSC_VER but not __GNUC__, so a clang- specific guard is needed to get the correct ALIGNxx versions. Fixes #21914 Change-Id: Icdc047b182ad1ba61c7b1b06a1e951eda1a0c33d Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21921)
* Don't call ossl_assert on the result of bn_wexpandMatt Caswell2023-08-141-1/+1
| | | | | | | | | | | | bn_wexpand can fail as the result of a memory allocation failure. We should not be calling ossl_assert() on its result because it can fail in normal operation. Found via the reproducible error injection in #21668 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/21725)
* Check for 0 modulus in BN_RECP_CTX_set.fullwaywang2023-06-261-1/+1
| | | | | | | | | | | | | | The function BN_RECP_CTX_set did not check whether arg d is zero, in which case an early failure should be returned to the invoker. This is a similar fix to the cognate defect of CVE-2015-1794. Fixes #21111 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21255)
* Fix typos found by codespellDimitri Papadopoulos2023-06-151-1/+1
| | | | | | | | Typos in doc/man* will be fixed in a different commit. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20910)
* Coverity 1528485: Remove unused assignment of wvalueTomas Mraz2023-06-111-3/+3
| | | | | | | | | | wvalue is always initialized at the beginning of each cycle and used only within the cycle Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21145)
* Coverity 1528494 and 1528493: Remove unused assignment of wvalueTomas Mraz2023-06-111-6/+6
| | | | | wvalue is always initialized at the beginning of each cycle and used only within the cycle
* Fix a typo found by codespell in a variable nameDimitri Papadopoulos2023-05-111-5/+5
| | | | | | | | | | | The change is limited to a single C file. CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20912)
* bn_local: remove unused `PTR_SIZE_INT` definitionAlois Klink2023-04-161-18/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* bn_nist: remove unused type-punning union `u`Alois Klink2023-04-161-21/+12
| | | | | | | | We no longer need to cast function pointers to PTR_SIZE_INT. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* bn_nist: replace pointer bit-fiddling with ternaryAlois Klink2023-04-161-45/+19
| | | | | | | | | | | | | | | | | | | | | | | | | Bit-fiddling pointers is technically implementation defined behavior in the C specification so the following code is not supported in all platforms: PTR_SIZE_INT mask; void * a, b, c; int boolean_flag; mask = 0 - boolean_flag; /* Not guaranteed to be a valid ptr to a or b on all platforms */ a = (void *) ((((PTR_SIZE_INT) b & ~mask) | (((PTR_SIZE_INT)) c & mask))); Using a ternary conditional operator is supported on all platforms (i.e. `a = boolean_flag ? b : c;`). On most modern compilers/CPUs, this will be faster, since it will get converted to a CMOV instruction. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* Alternative fix for CVE-2022-4304Bernd Edlinger2023-04-044-62/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Revert "Fix Timing Oracle in RSA decryption"Bernd Edlinger2023-04-044-650/+15
| | | | | | | | | | This reverts commit b1892d21f8f0435deb0250f24a97915dc641c807. Except for the moving derive_kdk to a separate function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Ensure there's only one copy of OPENSSL_armcap_P in libcrypto.aTom Cosgrove2023-03-292-2/+2
| | | | | | | | Change-Id: Ia94e528a2d55934435de6a2949784c52eb38d82f Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20621)
* rsaz-*k-avx512.pl: fix wrong name of avx512 flag variableTomas Mraz2023-03-173-6/+6
| | | | | | | | | Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20519) (cherry picked from commit d4765408c705f704f7cf33bd32bfb713061954a7)
* Add missing copyright headerPauli2023-03-141-0/+9
| | | | | | | | | | | This file was only recently introduced and the missing header slipped through the review process. Fixes #20461 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20470)
* Fix incorrect error branch in ossl_bn_rsa_fips186_4_derive_prime()ndossche2023-02-201-1/+1
| | | | | | | | | | | | | | | | BN_priv_rand_range_ex() and BN_add() both return a 0 on failure and a 1 on success. In case of failure, the algorithm should fail. However, the branch that it goes through on failure is "goto end", not "goto err". Therefore, the algorithm will return 1 which indicates success instead of 0 for failure, leading to potential problems for the callers. Fix it by changing the goto to "goto err" instead of "goto end". CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20279)
* rsa: add msvc intrinsic for non x64 platformsHubert Kario2023-02-111-1/+23
| | | | | | | | | | _umul128() is x86_64 (x64) only, while __umulh() works everywhere, but doesn't generate optimal code on x64 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20244)
* S390x: Support ME and CRT offloadingJuergen Christ2023-02-082-1/+144
| | | | | | | | | | | | | | | | S390x has to ability to offload modular exponentiation and CRT operations to Crypto Express Adapters. This possible performance optimization was not yet used by OpenSSL. Add support for offloading and implement an optimized version of RSA and DH with it. The environment variable OPENSSL_s390xcap now recognizes the token "nocex" to prevent offloading. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20113)
* Fix Timing Oracle in RSA decryptionDmitry Belyavskiy2023-02-074-15/+619
| | | | | | | | | | | | | | | | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. Patch written by Dmitry Belyavsky and Hubert Kario CVE-2022-4304 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
* Avoid duplicating symbols in legacy.a with some build optionsTomas Mraz2023-01-311-5/+0
| | | | | | | | | | | | | | If no-module or no-shared is used, the symbols from libcrypto should not be duplicated in legacy.a Also the BIGNUM functions are currently not needed in legacy.a at all. Fixes #20124 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20137)
* bn2bin(): Don't accept len < 0Richard Levitte2023-01-201-0/+4
| | | | | | | | | Test included Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20033)
* bin2bn(): When len==0, just return a zero BIGNUMRichard Levitte2023-01-201-0/+9
| | | | | | | | | | This allows calls with s==NULL and len==0 to be safe. It probably already was, but address sanitizers could still complain. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20033)
* Limit size of modulus for bn_mul_mont and BN_mod_exp_mont_consttimeBernd Edlinger2023-01-143-8/+48
| | | | | | | | | | Otherwise the alloca can cause an exception. Issue reported by Jiayi Lin. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-18 23:55:33 +0100