summaryrefslogtreecommitdiffstats
path: root/providers (follow)
Commit message (Collapse)AuthorAgeFilesLines
* drbg: provide requested amount of entropy, rather than self-strengthDimitri John Ledkov4 days1-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Parent DRBG can be seed source (os or jitter) and thus able to provide unlimited entropy. get_entropy is documented to provide at least the request amount of entropy. If requested amount of entropy is same as, or less than drbg->strength, everything is compliant. However, if requested entropy is more than drbg->strength (unlikely, but possible), the returned amount of entropy will be insufficient and additional repeated calls to get_entropy will be required. Reading history of refactors, it seems to me that this function call previouslly had assumptions and usecases that couldn't ever request or require more than strength amount of entropy. If entropy is set, request that amount, otherwise request drbg->strength amount. Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25850)
* Pre-ML-KEM/DSA decoder/encoder refactorViktor Dukhovni8 days3-61/+47
| | | | | | | | | Simplify some decoder/encoder internals to facilitate upcoming support for ML-KEM and ML-DSA. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26355)
* ec_kem.c: Fix ikmlen checkЗишан Мирза2024-12-301-2/+2
| | | | | | | | | | | | This makes `ikmlen` have a length of at least `Nsk`. Closes #26213 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26254)
* Fix leak of a RAND_POOL in error conditionTomas Mraz2024-12-132-2/+6
| | | | | | | | | Fixes Coverity 1636676 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26154)
* Add function to mix in an additional input into a RAND_POOLTomas Mraz2024-12-102-23/+13
| | | | | | | | | It will be just xor-ed over the existing entropy in the pool. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26128)
* jitter_generate(): Properly mix in the additional inputTomas Mraz2024-12-061-8/+8
| | | | | | | | | By adding the additional input directly to the pool we were using just the additional input. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26112)
* Code & comments changes to make them in consistentwillmafh2024-12-061-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* Change all one's complement to ones' complement for consistencywillmafh2024-12-061-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)
* Add handling for additional input in jitter rngjsondevers2024-12-031-0/+8
| | | | | | | | | Fixes #25917 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25966)
* providers: stop probing for getentropy(3) on recent FreeBSDKyle Evans2024-12-031-23/+28
| | | | | | | | | | | | | | | | | | | | | | | | FreeBSD has supported both getrandom(2) and getentropy(3) since 12.0. The last version which did *not* have these went EoL in September 2021. Use getrandom(2) unconditionally and fallback to sysctl kern.arandom if we do happen to have a FreeBSD that old. This is generally a necessary step for FreeBSD's _FORTIFY_SOURCE implementation, which needs to do some symbol renaming tricks with the getentropy declaration that would otherwise add some platform-specific hacks here to accommodate. getentropy(3) uses getrandom(2) internally on FreeBSD, so we just cut out the middleman. While we're here, it doesn't seem to make sense to ever prefer the sysctl on FreeBSD or NetBSD. For both platforms, it's limited to 256 bytes in a single request while getrandom(2) will generally use the same backend but service the entire request in one shot, even for larger amounts of entropy, modulo the EINTR possibility that presents itself with larger requests. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24903)
* Fix memleak in dsa_gen()Holger Dengler2024-11-291-1/+1
| | | | | | | | | | | | | Free the stack return value `dsa` on each early exit. Fixes #25905 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25948)
* fips: change integrity check zeroization to use the ↵Pauli2024-11-281-0/+2
| | | | | | | | OPENSSL_PEDANTIC_ZEROIZATION define Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* pbkdf2: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli2024-11-281-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* hkdf: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION definePauli2024-11-281-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)
* fips-jitter: set provider into error state upon CRNG permanent failuresDimitri John Ledkov2024-11-251-2/+6
| | | | | | | | | | | | | | | With fips-jitter build time option, jitter can be inside FIPS boundary. Calls to jent_read_entropy() can return permanent failures for Repetitive Count Test (RTC), Adaptive Proportion Test (APT), LAG prediction test. Ensure the module enters error state upon permanent jitter failures. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25957)
* Fix potential memory leak on failure of ecx_gen_init()Niels Dossche2024-11-251-1/+1
| | | | | | | | | | When ecx_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq, leading to a memory leak. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26015)
* Fix potential memory leak on failure of dsa_gen_init()Niels Dossche2024-11-251-1/+1
| | | | | | | | | | | | | When dsa_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_PKEY_PARAM_FFC_DIGEST already in gctx->mdname, leading to a memory leak. Allocated here: https://github.com/openssl/openssl/blob/47a80fd2034cd4314d3b4958539dcd3106087109/providers/implementations/keymgmt/dsa_kmgmt.c#L524 Can return 0 here: https://github.com/openssl/openssl/blob/47a80fd2034cd4314d3b4958539dcd3106087109/providers/implementations/keymgmt/dsa_kmgmt.c#L529-L536 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26016)
* fips: remove redundant RSA encrypt/decrypt KATDimitri John Ledkov2024-11-222-142/+0
| | | | | | | | | | | | | | | | | | | | | FIPS 140-2 IG D.9 has become FIPS 140-3 D.G (see "Mapping FIPS 140-2 IGs to FIPS 140-3" in the FIPS 140-3 IG). The requirements w.r.t. RSA KATs have now been relaxed, meaning that existing full-message RSA signature verification (which is performed separately) is sufficient to meet KAT requirements for all RSA usecases (KEM/Encrypt/Decrypt/Sign/Verify). Dropping this KAT is very useful, because it is large/expensive on module startup, but also because it enables in the future to block RSA Encrypt/Decrypt operations with paddings other than OAEP, which are legacy or deprecated by either current or draft algorithm transition SP. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25988)
* fips: zeroize temporary self-check out MD variableDimitri John Ledkov2024-11-221-0/+1
| | | | | | | | | | | At least this is done on module startup only. To satisfy ISO/IEC 19790:2012/Cor.1:2015(E) Section 7.5 [05.10] requirement. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25945)
* Add CTX copy function for EVP_MD to optimize the performance of ↵wangcheng2024-11-203-0/+27
| | | | | | | | | | | | | | | | | | | | | | EVP_MD_CTX_copy_ex. 1. Add OSSL_FUNC_digest_copyctx_fn function for EVP_MD, which is used to copy algctx from the old EVP_MD_CTX to the new one. 2. Add implementation of OSSL_FUNC_digest_copyctx_fn function for default providers. 3. Modify EVP_MD_CTX_copy_ex: When the fetched digest is the same in in and out contexts, use the copy function to copy the members in EVP_MD_CTX if the OSSL_FUNC_digest_copyctx_fn function exists. Otherwise, use the previous method to copy. 4. Add documentation for OSSL_FUNC_digest_copyctx function in doc/man7/provider-digest.pod. 5. Add testcase. Fixes #25703 Signed-off-by: wangcheng <bangwangnj@163.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25726)
* fips no-des: compile out TDES KATDimitri John Ledkov2024-10-241-0/+4
| | | | | | | | | | | | | | | | FIPS provider correctly supports no-des build time option and doesn't advertise DES related algorithms. However KAT test for DES is still attempted to be executed and fails. This prevents configuring FIPS provider without legacy behaviour as defined in SP 800-131Arev2. Also see #25761 internal docs. Fix `enable-fips no-des` build option, and add a daily checker for "legacy-free" (as much as currently feasible) FIPS configuration. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25762)
* first cut at KEM & key management skeletonsMichael Baentsch2024-10-215-0/+638
| | | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25640)
* Avoid undefined behaviour with the <ctype.h> functions.Taylor R Campbell2024-10-102-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fix https://github.com/openssl/openssl/issues/25112 As defined in the C standard: In all cases the argument is an int, the value of which shall be representable as an unsigned char or shall equal the value of the macro EOF. If the argument has any other value, the behavior is undefined. This is because they're designed to work with the int values returned by getc or fgetc; they need extra work to handle a char value. If EOF is -1 (as it almost always is), with 8-bit bytes, the allowed inputs to the ctype.h functions are: {-1, 0, 1, 2, 3, ..., 255}. However, on platforms where char is signed, such as x86 with the usual ABI, code like char *p = ...; ... isspace(*p) ... may pass in values in the range: {-128, -127, -126, ..., -2, -1, 0, 1, ..., 127}. This has two problems: 1. Inputs in the set {-128, -127, -126, ..., -2} are forbidden. 2. The non-EOF byte 0xff is conflated with the value EOF = -1, so even though the input is not forbidden, it may give the wrong answer. Casting char inputs to unsigned char first works around this, by mapping the (non-EOF character) range {-128, -127, ..., -1} to {128, 129, ..., 255}, leaving no collisions with EOF. So the above fragment needs to be: char *p = ...; ... isspace((unsigned char)*p) ... This patch inserts unsigned char casts where necessary. Most of the cases I changed, I compile-tested using -Wchar-subscripts -Werror on NetBSD, which defines the ctype.h functions as macros so that they trigger the warning when the argument has type char. The exceptions are under #ifdef __VMS or #ifdef _WIN32. I left alone calls where the input is int where the cast would obviously be wrong; and I left alone calls where the input is already unsigned char so the cast is unnecessary. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25113)
* Add utility function ossl_param_is_empty()slontis2024-10-0962-99/+113
| | | | | | | | | | | | Changed all provider implementations that have a set_ctx_params() to call this function instead of just testing (params == NULL).This detects the case wherean OSSL_PARAM array contains just a terminator entry. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25499)
* fips: fix locking issuesPauli2024-10-091-13/+7
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25498)
* jitter: support an internal jitter entropy source in the FIPS providerPauli2024-10-092-0/+7
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25498)
* jitter: avoid a signed vs unsigned comparisonPauli2024-10-091-1/+1
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25498)
* Add some documentation to describe the encap/decap requirementsNeil Horman2024-10-071-0/+11
| | | | | | | | | | Document the fact that we now require unwrappedlen/wrappedlen to be set to the size of the unwrapped/wrapped buffers Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25522)
* Update rsasve_recover to properly store outlen on successNeil Horman2024-10-071-4/+39
| | | | | | | | | | | | Outlen was never validated in this function prior to use, nor is it set to the decrypted value on sucess. Add both of those operations Fixes #25509 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25522)
* Drop the aid field of the signature prov ctxlan11202024-10-074-13/+30
| | | | | | | | Signed-off-by: lan1120 <lanming@huawei.com> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23094)
* Fix rsa_sigalg_set_ctx_params() to return 1 for unknown parameters.slontis2024-10-041-4/+1
| | | | | | | | | | | This keeps the code consistent with the changes done for other algorithms that support sigalg_set_ctx_params(). set_ctx_params() should always return 1 if the parameter is unknown. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25570)
* Change FIPS self tests to use EVP_PKEY_sign/verify API.slontis2024-10-042-40/+42
| | | | | | | | Self tests no longer use the EVP_DigestSign/Verify API's. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25570)
* fips: add lots of potentially missing ossl_prov_is_running checksDimitri John Ledkov2024-10-026-2/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After rudimentary analysis, it appears the below functions can potentially produce output, whilst the provider is in error state. These functions were detected using this method: ``` CFLAGS='-save-temps' ./Configure enable-fips --debug make -j10 find . -name '*.i' | xargs git add -f git grep --cached -p ossl_prov_is_running | grep libfips-lib > ossl_prov_is_running.txt git grep --cached -p 'return' | grep libfips-lib > return.txt grep '\.i=' return.txt > func-with_return.txt grep '\.i=' ossl_prov_is_running.txt > func-with-ossl_prov_is_running.txt grep --fixed-strings --line-regexp --file=func-with-ossl_prov_is_running.txt return.txt > func-without-ossl_prov_is_running.txt grep -e newctx -e initctx -e dupctx func-without-ossl_prov_is_running.txt | grep -v ossl_prov_is_running ``` And from there doing manual inspection, as the list was short at that point. As in compile with keeping pre-processed source code; and use `git grep --cached -p` to find these preprocessed files, and scan for calls to return or opssl_prov_is_running, with function name printed. And then exclude one from the other, to hopefully get a list of all the functions that do not check for ossl_prov_is_running. As number of functions without "func-without-ossl_prov_is_running" check is large, I do wonder which other functions are "interesting" to check for. I think I'm not scanning for _update functions correctly. Any tips on improving above analysis will help with maintaining such checks going forward. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25580)
* Use the correct length value for input saltSimo Sorce2024-10-021-1/+1
| | | | | | | | | | | | | | | | | | | In this function the salt can be either a zero buffer of exactly mdlen length, or an arbitrary salt of prevsecretlen length. Although in practice OpenSSL will always pass in a salt of mdlen size bytes in the current TLS 1.3 code, the openssl kdf command can pass in arbitrary values (I did it for testing), and a future change in the higher layer code could also result in unmatched lengths. If prevsecretlen is > mdlen this will cause incorrect salt expansion, if prevsecretlen < mdlen this could cause a crash or reading random information. Inboth case the generated output would be incorrect. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25579)
* Fix bugs in ECDH cofactor FIPS indicator.slontis2024-09-301-1/+4
| | | | | | | | | | | | | | | | | | | | | | The code was not detecting that the cofactor was set up correctly if OSSL_PKEY_PARAM_USE_COFACTOR_ECDH was set, resulting in an incorrect FIPS indicator error being triggered. Added a test for all possible combinations of a EVP_PKEY setting OSSL_PKEY_PARAM_USE_COFACTOR_ECDH and the derive context setting OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE. This only affects the B & K curves (which have a cofactor that is not 1). Bug reported by @abkarcher Testing this properly, also detected a memory leak of privk when the FIPS indicator error was triggered (in the case where mode = 0 and use_cofactor was 1). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25548)
* kdfs: implement key length check in X9.42Dimitri John Ledkov2024-09-302-6/+47
| | | | | | | | | Similar to other KDFs, the input key should be 112 bits long. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25529)
* fips: Prohibit SHA1 in DH & ECDH exchangeDimitri John Ledkov2024-09-274-12/+13
| | | | | | | | | | | | | | | | | See Section 5 Key Agreement Using Diffie-Hellman and MQV of [NIST SP 800-131Ar2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf). Strengths less than 112bits is disallowed, thus eliminating SHA1. Skip cms test case that requires use of SHA1 with X9.42 DH. Rename ossl_fips_ind_digest_check to ossl_fips_ind_digest_exch_check Add myself to Changes for fips indicator work Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/25517)
* fips: continuous random bit generator testsPauli2024-09-197-204/+440
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For FIPS 140-3 the continuous tests specified in SP 800-90B need to be included on the output of any entropy source. They are implemented here as a replacement for the primary DRBG in the FIPS provider. This results in a setup that looks like this: +-------------+ | | | Seed Source | | | +------+------+ | | v +-------------+ | | | CRNG Test | | | ++----------+-+ | | | | v v +--------------+ +--------------+ | | | | | Public DRBG | | Private DRBG | | | | | +--------------+ +--------------+ An additional benefit, that of avoiding DRBG chains, is also gained. The current standards do not permit the output of one DRBG to be used as the input for a second (i.e. a chain). This also leaves open the future possibility of incorporating a seed source inside the FIPS boundary. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* rand: remove unused field in DRBG structurePauli2024-09-191-2/+0
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* Add failed entropy continuous test errorPauli2024-09-191-0/+2
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* drbg: Fix typoPauli2024-09-191-1/+1
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25415)
* Add Missing Error Messages for AES-OCB Tag Length Validationerbsland-dev2024-09-131-2/+10
| | | | | | | | | | | | | | | | | | | Related to #8331 Addressing found issues by adding specific error messages to improve feedback when tag length checks fail for the `EVP_CTRL_AEAD_SET_TAG` parameter in the AES-OCB algorithm. - Added PROV_R_INVALID_TAG_LENGTH error to indicate when the current tag length exceeds the maximum tag length of the algorithm. - Added `PROV_R_INVALID_TAG_LENGTH` error to indicate when the current tag length in the context does not match a custom tag length provided as a parameter. - Added `ERR_R_PASSED_INVALID_ARGUMENT` error to handle cases where an invalid pointer is passed in encryption mode. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25425)
* s390x: Add hardware acceleration for full AES-XTSHolger Dengler2024-09-134-0/+228
| | | | | | | | | | | | | | The CPACF instruction KM provides support for accelerating the full AES-XTS algorithm on newer machines for AES_XTS_128 and AES_XTS_256. Preliminary measurements showed performance improvements of up to 50%, dependent on the message size. Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25414)
* Don't restrict the ECDSA settable ctx params unnecessarilyMatt Caswell2024-09-091-9/+0
| | | | | | | | | | | | | We just allow all possible settables all the time. Some things like the digest name can't actually be changed in some circumstances - but we already have checks for those things. It's still possible to pass a digest of the same name to one that's already been set for example. Fixes #25012 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25057)
* Complain about a missing digest when doing deterministic ECDSAMatt Caswell2024-09-091-1/+5
| | | | | | | | | | | We need a digest for the none when doing deterministic ECDSA. Give a better error message if one hasn't been supplied. See openssl/openssl#25012 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25057)
* s390x: Fix s390x_shake_squeeze() when MSA 12 is availableIngo Franzki2024-09-061-1/+4
| | | | | | | | | | | | | | | | | | | | On the first squeeze call, when finishing the absorb process, also set the NIP flag, if we are still in XOF_STATE_INIT state. When MSA 12 is available, the state buffer A has not been zeroed during initialization, thus we must also pass the NIP flag here. This situation can happen when a squeeze is performed without a preceding absorb (i.e. a SHAKE of the empty message). Add a test that performs a squeeze without a preceding absorb and check if the result is correct. Fixes: https://github.com/openssl/openssl/commit/25f5d7b85f6657cd2f9f1ab7ae87f319d9bafe54 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25388)
* s390x: Fix s390x_sha3_absorb() when no data is processed by KIMDIngo Franzki2024-09-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | If the data to absorb is less than a block, then the KIMD instruction is called with zero bytes. This is superfluous, and causes incorrect hash output later on if this is the very first absorb call, i.e. when the xof_state is still XOF_STATE_INIT and MSA 12 is available. In this case the NIP flag is set in the function code for KIMD, but KIMD ignores the NIP flag when it is called with zero bytes to process. Skip any KIMD calls for zero length data. Also do not set the xof_state to XOF_STATE_ABSORB until the first call to KIMD with data. That way, the next KIMD (with non-zero length data) or KLMD call will get the NIP flag set and will then honor it to produce correct output. Fixes: https://github.com/openssl/openssl/commit/25f5d7b85f6657cd2f9f1ab7ae87f319d9bafe54 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25388)
* argon2: Fixed an thread availability error stringPIums2024-09-051-2/+2
| | | | | | | | | | | | Correctly display the number of requested threads and the number of available threads. CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25375)
* make updateTomas Mraz2024-09-053-316/+364
| | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
* Copyright year updatesTomas Mraz2024-09-0558-58/+58
| | | | | Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-18 09:06:04 +0100