| cf9143f | Richard Levitte | 28 May 2019, 12:56:29 UTC | Prepare for 1.0.2s release Reviewed-by: Matt Caswell <matt@openssl.org> | 28 May 2019, 12:56:29 UTC |
| 66c236c | Richard Levitte | 28 May 2019, 12:41:38 UTC | Update copyright year Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9032) | 28 May 2019, 12:41:38 UTC |
| bb36ec5 | Richard Levitte | 27 May 2019, 19:38:00 UTC | Add CHANGES for 1.0.2s Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9019) | 28 May 2019, 08:07:44 UTC |
| 0f283c9 | Kurt Roeckx | 13 April 2019, 10:32:48 UTC | Change default RSA, DSA and DH size to 2048 bit Fixes: #8737 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #8741 (cherry picked from commit 70b0b977f73cd70e17538af3095d18e0cf59132e) | 21 May 2019, 14:58:42 UTC |
| cea83f9 | Emilia Kasper | 03 June 2016, 12:42:04 UTC | RT 4242: reject invalid EC point coordinates This is a backport of commit 1e2012b7 to 1.0.2. This hardening change was made to 1.1.0 but was not backported to 1.0.2. Recent CVEs in user applications have shown this additional hardening in 1.0.2 would be beneficial. E.g. see the patch for CVE-2019-9498 https://w1.fi/security/2019-4/0011-EAP-pwd-server-Verify-received-scalar-and-element.patch and CVE-2019-9499 https://w1.fi/security/2019-4/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch The original commit had this description: We already test in EC_POINT_oct2point that points are on the curve. To be on the safe side, move this check to EC_POINT_set_affine_coordinates_* so as to also check point coordinates received through some other method. We do not check projective coordinates, though, as - it's unlikely that applications would be receiving this primarily internal representation from untrusted sources, and - it's possible that the projective setters are used in a setting where performance matters. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8750) | 25 April 2019, 12:09:22 UTC |
| f937540 | Dr. Matthias St. Pierre | 09 April 2019, 13:04:29 UTC | Add FIPS support for Android Arm 64-bit Fixes #2490 Fixes #8711 In commit 6db8e3bdc9e, support for Android Arm 64-bit was added to the OpenSSL FIPS Object Module. For some reason, the corresponding target 'android64-aarch64' was missing OpenSSL 1.0.2, whence it could not be built with FIPS support on Android Arm 64-bit. This commit adds the missing target. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8713) | 16 April 2019, 23:58:26 UTC |
| d3299a3 | Shane Lontis | 27 March 2019, 07:38:28 UTC | fixed public range check in ec_GF2m_simple_oct2point Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/8607) (cherry picked from commit cad8347be23c5e0c0d9eea02d090d42daf2dd7a9) | 30 March 2019, 14:12:07 UTC |
| c3e7bea | Bernd Edlinger | 20 March 2019, 21:02:58 UTC | Modify the RSA_private_decrypt functions to check the padding in constant time with a memory access pattern that does not depend on secret information. [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8543) (cherry picked from commit 9c0cf214e7836eb5aaf1ea5d3cbf6720533f86b5) | 22 March 2019, 13:48:37 UTC |
| d284d27 | Bernd Edlinger | 20 March 2019, 19:01:12 UTC | Make err_clear_constant_time really constant time [extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8558) | 22 March 2019, 13:39:02 UTC |
| 94eb7d0 | Bernd Edlinger | 17 March 2019, 16:28:24 UTC | Clear the point S before freeing in ec_mul_consttime The secret point R can be recovered from S using the equation R = S - P. The X and Z coordinates should be sufficient for that. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8505) (cherry picked from commit 502b871ad4eacc96a31f89d9a9470ca2858da998) | 18 March 2019, 21:50:08 UTC |
| dbf71ae | Bernd Edlinger | 17 March 2019, 09:02:07 UTC | Clear the secret point in ecdh_compute_key Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8502) | 17 March 2019, 09:02:07 UTC |
| 6555a89 | Bernd Edlinger | 28 February 2019, 09:08:18 UTC | Fix memory overrun in rsa padding check functions Backported from d7f5e5ae6d5 Fixes #8364 and #8357 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8438) | 07 March 2019, 22:36:55 UTC |
| d5e37fc | Matt Caswell | 05 March 2019, 13:26:45 UTC | Avoid an underflow in ecp_nistp521.c The function felem_diff_128_64 in ecp_nistp521.c substracts the number |in| from |out| mod p. In order to avoid underflow it first adds 32p mod p (which is equivalent to 0 mod p) to |out|. The comments and variable naming suggest that the original author intended to add 64p mod p. In fact it has been shown that with certain unusual co-ordinates it is possible to cause an underflow in this function when only adding 32p mod p while performing a point double operation. By changing this to 64p mod p the underflow is avoided. It turns out to be quite difficult to construct points that satisfy the underflow criteria although this has been done and the underflow demonstrated. However none of these points are actually on the curve. Finding points that satisfy the underflow criteria and are also *on* the curve is considered significantly more difficult. For this reason we do not believe that this issue is currently practically exploitable and therefore no CVE has been assigned. This only impacts builds using the enable-ec_nistp_64_gcc_128 Configure option. With thanks to Bo-Yin Yang, Billy Brumley and Dr Liu for their significant help in investigating this issue. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/8405) (cherry picked from commit 13fbce17fc9f02e2401fc3868f3f8e02d6647e5f) | 07 March 2019, 14:53:28 UTC |
| 56ff0f6 | Matt Caswell | 26 February 2019, 14:21:45 UTC | Prepare for 1.0.2s-dev Reviewed-by: Richard Levitte <levitte@openssl.org> | 26 February 2019, 14:21:45 UTC |
| b34cf4e | Matt Caswell | 26 February 2019, 14:20:55 UTC | Prepare for 1.0.2r release Reviewed-by: Richard Levitte <levitte@openssl.org> | 26 February 2019, 14:20:55 UTC |
| 28c43df | Matt Caswell | 26 February 2019, 10:21:24 UTC | Updates CHANGES and NEWS for the new release Reviewed-by: Richard Levitte <levitte@openssl.org> | 26 February 2019, 14:13:05 UTC |
| 48c8bcf | Matt Caswell | 20 February 2019, 14:21:36 UTC | Clarify that SSL_shutdown() must not be called after a fatal error Follow on from CVE-2019-1559 Reviewed-by: Richard Levitte <levitte@openssl.org> | 26 February 2019, 14:13:05 UTC |
| e9bbefb | Matt Caswell | 14 December 2018, 07:28:30 UTC | Go into the error state if a fatal alert is sent or received If an application calls SSL_shutdown after a fatal alert has occured and then behaves different based on error codes from that function then the application may be vulnerable to a padding oracle. CVE-2019-1559 Reviewed-by: Richard Levitte <levitte@openssl.org> | 26 February 2019, 14:13:05 UTC |
| c81f169 | Matt Caswell | 26 February 2019, 14:07:28 UTC | Update copyright year Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8348) | 26 February 2019, 14:11:34 UTC |
| b250f2a | Matt Caswell | 25 February 2019, 11:28:32 UTC | Ensure bn_cmp_words can handle the case where n == 0 Thanks to David Benjamin who reported this, performed the analysis and suggested the patch. I have incorporated some of his analysis in the comments below. This issue can cause an out-of-bounds read. It is believed that this was not reachable until the recent "fixed top" changes. Analysis has so far only identified one code path that can encounter this - although it is possible that others may be found. The one code path only impacts 1.0.2 in certain builds. The fuzzer found a path in RSA where iqmp is too large. If the input is all zeros, the RSA CRT logic will multiply a padded zero by iqmp. Two mitigating factors: - Private keys which trip this are invalid (iqmp is not reduced mod p). Only systems which take untrusted private keys care. - In OpenSSL 1.1.x, there is a check which rejects the oversize iqmp, so the bug is only reproducible in 1.0.2 so far. Fortunately, the bug appears to be relatively harmless. The consequences of bn_cmp_word's misbehavior are: - OpenSSL may crash if the buffers are page-aligned and the previous page is non-existent. - OpenSSL will incorrectly treat two BN_ULONG buffers as not equal when they are equal. - Side channel concerns. The first is indeed a concern and is a DoS bug. The second is fine in this context. bn_cmp_word and bn_cmp_part_words are used to compute abs(a0 - a1) in Karatsuba. If a0 = a1, it does not matter whether we use a0 - a1 or a1 - a0. The third would be worth thinking about, but it is overshadowed by the entire Karatsuba implementation not being constant time. Due to the difficulty of tripping this and the low impact no CVE is felt necessary for this issue. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8326) (cherry picked from commit 576129cd72ae054d246221f111aabf42b9c6d76d) | 25 February 2019, 16:37:52 UTC |
| 9acdddf | Nicola Tuveri | 08 February 2019, 10:42:25 UTC | Clear BN_FLG_CONSTTIME on BN_CTX_get() (cherry picked from commit c8147d37ccaaf28c430d3fb45a14af36597e48b8) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8295) | 20 February 2019, 21:02:09 UTC |
| d769ce0 | Nicola Tuveri | 11 February 2019, 22:37:25 UTC | Test for constant-time flag leakage in BN_CTX This commit adds a simple unit test to make sure that the constant-time flag does not "leak" among BN_CTX frames: - test_ctx_consttime_flag() initializes (and later frees before returning) a BN_CTX object, then it calls in sequence test_ctx_set_ct_flag() and test_ctx_check_ct_flag() using the same BN_CTX object. - test_ctx_set_ct_flag() starts a frame in the given BN_CTX and sets the BN_FLG_CONSTTIME flag on some of the BIGNUMs obtained from the frame before ending it. - test_ctx_check_ct_flag() then starts a new frame and gets a number of BIGNUMs from it. In absence of leaks, none of the BIGNUMs in the new frame should have BN_FLG_CONSTTIME set. In actual BN_CTX usage inside libcrypto the leak could happen at any depth level in the BN_CTX stack, with varying results depending on the patterns of sibling trees of nested function calls sharing the same BN_CTX object, and the effect of unintended BN_FLG_CONSTTIME on the called BN_* functions. This simple unit test abstracts away this complexity and verifies that the leak does not happen between two sibling functions sharing the same BN_CTX object at the same level of nesting. (manually cherry picked from commit fe16ae5f95fa86ddb049a8d1e2caee0b80b32282) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8295) | 20 February 2019, 20:57:19 UTC |
| e30dfbe | Richard Levitte | 18 February 2019, 20:47:33 UTC | Move stray POD file into the fold Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8273) | 18 February 2019, 20:47:33 UTC |
| 3077dd4 | Corinna Vinschen | 15 February 2019, 11:22:07 UTC | cygwin: drop explicit O_TEXT Cygwin binaries should not enforce text mode these days, just use text mode if the underlying mount point requests it CLA: trivial Signed-off-by: Corinna Vinschen <vinschen@redhat.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8249) | 15 February 2019, 16:44:28 UTC |
| fff469b | Richard Levitte | 12 December 2018, 10:22:52 UTC | test/evp_test.c: use EVP_DecryptUpdate when decrypting, even for AAD Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7856) | 15 January 2019, 17:32:36 UTC |
| 7ab24d9 | Richard Levitte | 10 December 2018, 09:23:01 UTC | make update Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7856) | 15 January 2019, 17:32:36 UTC |
| cfa9a7c | Richard Levitte | 10 December 2018, 09:18:10 UTC | Prevent calling decryption in an encryption context and vice versa Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7856) | 15 January 2019, 17:32:36 UTC |
| eed51aa | Matt Caswell | 02 January 2019, 17:05:27 UTC | make update Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7974) | 03 January 2019, 09:33:25 UTC |
| 668d643 | Richard Levitte | 15 December 2018, 10:06:00 UTC | Makefile.org: prevent .bak files to become part of the tarball Fixes #7903 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7910) | 15 December 2018, 10:12:45 UTC |
| ab061e7 | Dr. Matthias St. Pierre | 12 December 2018, 06:38:07 UTC | doc/man3: remove copy&paste leftover Fixes #7883 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7884) (cherry picked from commit 00eb879f74971e3c048286ef44f6f544676f90d7) | 12 December 2018, 19:05:14 UTC |
| 4960e84 | Tobias Stoeckmann | 11 December 2018, 19:34:21 UTC | Fixed typo (vi leftover). There was a trailing :w at a line, which didn't make sense in context of the sentence/styling. Removed it, because I think it's a leftover vi command. CLA: trivial Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7875) (cherry picked from commit 143b631639f95822e5e00768254fa35c787f6396) | 12 December 2018, 09:41:32 UTC |
| e42e531 | Richard Levitte | 07 December 2018, 08:26:04 UTC | Make EVP_PKEY_asn1_add0() stricter about its input It turns out that the strictness that was implemented in EVP_PKEY_asn1_new() (see Github openssl/openssl#6880) was badly placed for some usages, and that it's better to do this check only when the method is getting registered. Fixes #7758 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7847) (cherry picked from commit a86003162138031137727147c9b642d99db434b1) | 07 December 2018, 11:06:04 UTC |
| 110ef88 | Andy Polyakov | 14 September 2018, 15:24:13 UTC | rsa/rsa_ssl.c: make RSA_padding_check_SSLv23 constant-time. Copy of RSA_padding_check_PKCS1_type_2 with a twist that rejects padding if nul delimiter is preceded by 8 consecutive 0x03 bytes. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 603221407ddc6404f8c417c6beadebf84449074c) Resolved conflicts: crypto/rsa/rsa_ssl.c (Merged from https://github.com/openssl/openssl/pull/7737) | 06 December 2018, 11:18:35 UTC |
| b29b91b | Andy Polyakov | 06 September 2018, 19:54:23 UTC | rsa/rsa_oaep.c: remove memcpy calls from RSA_padding_check_PKCS1_OAEP. And make RSAErr call unconditional. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 75f5e944be97f28867e7c489823c889d89d0bd06) Resolved conflicts: crypto/rsa/rsa_oaep.c (Merged from https://github.com/openssl/openssl/pull/7737) | 06 December 2018, 11:18:35 UTC |
| 47f8fba | Andy Polyakov | 01 September 2018, 10:00:33 UTC | rsa/rsa_pk1.c: remove memcpy calls from RSA_padding_check_PKCS1_type_2. And make RSAErr call unconditional. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit e875b0cf2f10bf2adf73e0c2ec81428290f4660c) Resolved conflicts: crypto/rsa/rsa_pk1.c (Merged from https://github.com/openssl/openssl/pull/7737) | 06 December 2018, 11:18:35 UTC |
| 3b776fd | Andy Polyakov | 30 November 2018, 20:07:18 UTC | rsa/rsa_eay.c: make RSAerr call in rsa_ossl_private_decrypt unconditional. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 89072e0c2a483f2ad678e723e112712567b0ceb1) (Merged from https://github.com/openssl/openssl/pull/7737) | 06 December 2018, 11:18:35 UTC |
| 8db50d6 | Andy Polyakov | 01 September 2018, 10:19:30 UTC | err/err.c: add err_clear_last_constant_time. Expected usage pattern is to unconditionally set error and then wipe it if there was no actual error. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit f658a3b64d8750642f4975090740865f770c2a1b) Resolved conflicts: crypto/err/err.c crypto/constant_time_locl.h (Merged from https://github.com/openssl/openssl/pull/7737) | 06 December 2018, 11:18:35 UTC |
| 0235443 | Richard Levitte | 03 December 2018, 09:57:01 UTC | Docs fixup: some man3 pages had unindented code in SYNOPSIS Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7744) (cherry picked from commit 7b4a3515a4ddb567d48000e61d7cb640d0c5f261) | 03 December 2018, 10:50:27 UTC |
| 63262bd | David Woodhouse | 16 October 2018, 14:59:46 UTC | Honour mandatory digest on private key in tls1_process_sigalgs() If the private key says it can only support one specific digest, then don't ask it to perform a different one. Fixes: #7348 (cherry picked from commit 2d263a4a73f852005b16359873475d48755999ad and reworked for 1.0.2) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7610) | 24 November 2018, 07:01:07 UTC |
| cf68eb3 | David Woodhouse | 16 October 2018, 14:41:17 UTC | Stop marking default digest for EC keys as mandatory ASN1_PKEY_CTRL_DEFAULT_MD_NID is documented to return 2 for a mandatory digest algorithm, when the key can't support any others. That isn't true here, so return 1 instead. Partially fixes #7348 (cherry picked from commit eb7eb1378cd15c4652884b3701d4c0ef27b5b8a6) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7610) | 24 November 2018, 07:00:25 UTC |
| 23bfb5b | Andy Polyakov | 07 November 2018, 21:07:22 UTC | rsa/rsa_eay.c: cache MONT_CTX for public modulus earlier. Blinding is performed more efficiently and securely if MONT_CTX for public modulus is available by the time blinding parameter are instantiated. So make sure it's the case. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (manually cherry picked from commit 2cc3f68cde77af23c61fbad65470602ee86f2575) (Merged from https://github.com/openssl/openssl/pull/7586) | 23 November 2018, 12:05:16 UTC |
| 8bfde25 | Richard Levitte | 22 November 2018, 10:05:31 UTC | VMS: ensure x509_time_test is built A lacking DCL variable to indicate where it's located was missing. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7685) | 22 November 2018, 10:05:31 UTC |
| 49d07eb | Matt Caswell | 20 November 2018, 13:46:11 UTC | Prepare for 1.0.2r-dev Reviewed-by: Richard Levitte <levitte@openssl.org> | 20 November 2018, 13:46:11 UTC |
| 5707219 | Matt Caswell | 20 November 2018, 13:45:20 UTC | Prepare for 1.0.2q release Reviewed-by: Richard Levitte <levitte@openssl.org> | 20 November 2018, 13:45:20 UTC |
| d98ff54 | Matt Caswell | 20 November 2018, 13:45:20 UTC | make update Reviewed-by: Richard Levitte <levitte@openssl.org> | 20 November 2018, 13:45:20 UTC |
| 8ea1672 | Matt Caswell | 20 November 2018, 13:23:36 UTC | Update copyright year Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7671) | 20 November 2018, 13:29:53 UTC |
| 548cce6 | Matt Caswell | 20 November 2018, 10:52:53 UTC | Update CHANGES and NEWS for new release Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7667) | 20 November 2018, 11:57:17 UTC |
| d88ff89 | Richard Levitte | 20 November 2018, 11:11:38 UTC | VMS: ensure crypto/getenv.c is included in the build Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7665) | 20 November 2018, 11:47:40 UTC |
| 84b4759 | Vitezslav Cizek | 25 October 2018, 11:53:26 UTC | DSA: Check for sanity of input parameters dsa_builtin_paramgen2 expects the L parameter to be greater than N, otherwise the generation will get stuck in an infinite loop. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (cherry picked from commit 3afd38b277a806b901e039c6ad281c5e5c97ef67) (Merged from https://github.com/openssl/openssl/pull/7493) | 14 November 2018, 12:09:41 UTC |
| b18162a | Billy Brumley | 08 November 2018, 11:57:54 UTC | CVE-2018-5407 fix: ECC ladder Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7593) | 12 November 2018, 14:00:30 UTC |
| 59b9c67 | Dr. Matthias St. Pierre | 09 November 2018, 20:37:38 UTC | Fix 'no-ecdh' build Fixes #3302 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7606) | 09 November 2018, 23:45:24 UTC |
| f1e5009 | Matt Caswell | 16 October 2018, 16:08:11 UTC | Properly handle duplicated messages from the next epoch Since 3884b47b7c we may attempt to buffer a record from the next epoch that has already been buffered. Prior to that this never occurred. We simply ignore a failure to buffer a duplicated record. Fixes #6902 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7415) | 02 November 2018, 10:00:14 UTC |
| 880d1c7 | Pauli | 31 October 2018, 22:44:11 UTC | Add a constant time flag to one of the bignums to avoid a timing leak. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7549) (cherry picked from commit 00496b6423605391864fbbd1693f23631a1c5239) | 01 November 2018, 22:18:20 UTC |
| ebf65db | Pauli | 28 October 2018, 21:18:09 UTC | Merge to 1.0.2: DSA mod inverse fix. There is a side channel attack against the division used to calculate one of the modulo inverses in the DSA algorithm. This change takes advantage of the primality of the modulo and Fermat's little theorem to calculate the inverse without leaking information. Thanks to Samuel Weiser for finding and reporting this. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7512) | 29 October 2018, 21:30:12 UTC |
| 43e6a58 | Pauli | 28 October 2018, 22:24:22 UTC | Merge DSA reallocation timing fix CVE-2018-0734. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7513) | 28 October 2018, 22:24:22 UTC |
| 896e8c5 | Dr. Matthias St. Pierre | 18 October 2018, 21:17:46 UTC | md_rand.c: don't stop polling until properly initialized Previously, the RNG sets `initialized=1` after the first call to RAND_poll(), although its criterion for being initialized actually is whether condition `entropy >= ENTROPY_NEEDED` is true. This commit now assigns `initialized=(entropy >= ENTROPY_NEEDED)`, which has the effect that on the next call, RAND_poll() will be called again, if it previously failed to obtain enough entropy. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7439) | 18 October 2018, 21:46:31 UTC |
| 35cf781 | Viktor Dukhovni | 08 October 2018, 16:05:14 UTC | Apply self-imposed path length also to root CAs Also, some readers of the code find starting the count at 1 for EE cert confusing (since RFC5280 counts only non-self-issued intermediate CAs, but we also counted the leaf). Therefore, never count the EE cert, and adjust the path length comparison accordinly. This may be more clear to the reader. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit dc5831da59e9bfad61ba425d886a0b06ac160cd6) | 18 October 2018, 04:43:52 UTC |
| c8ce9e5 | Viktor Dukhovni | 05 October 2018, 03:53:01 UTC | Only CA certificates can be self-issued At the bottom of https://tools.ietf.org/html/rfc5280#page-12 and top of https://tools.ietf.org/html/rfc5280#page-13 (last paragraph of above https://tools.ietf.org/html/rfc5280#section-3.3), we see: This specification covers two classes of certificates: CA certificates and end entity certificates. CA certificates may be further divided into three classes: cross-certificates, self-issued certificates, and self-signed certificates. Cross-certificates are CA certificates in which the issuer and subject are different entities. Cross-certificates describe a trust relationship between the two CAs. Self-issued certificates are CA certificates in which the issuer and subject are the same entity. Self-issued certificates are generated to support changes in policy or operations. Self- signed certificates are self-issued certificates where the digital signature may be verified by the public key bound into the certificate. Self-signed certificates are used to convey a public key for use to begin certification paths. End entity certificates are issued to subjects that are not authorized to issue certificates. that the term "self-issued" is only applicable to CAs, not end-entity certificates. In https://tools.ietf.org/html/rfc5280#section-4.2.1.9 the description of path length constraints says: The pathLenConstraint field is meaningful only if the cA boolean is asserted and the key usage extension, if present, asserts the keyCertSign bit (Section 4.2.1.3). In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path. (Note: The last certificate in the certification path is not an intermediate certificate, and is not included in this limit. Usually, the last certificate is an end entity certificate, but it can be a CA certificate.) This makes it clear that exclusion of self-issued certificates from the path length count applies only to some *intermediate* CA certificates. A leaf certificate whether it has identical issuer and subject or whether it is a CA or not is never part of the intermediate certificate count. The handling of all leaf certificates must be the same, in the case of our code to post-increment the path count by 1, so that we ultimately reach a non-self-issued intermediate it will be the first one (not zeroth) in the chain of intermediates. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit ed422a2d0196ada0f5c1b6e296f4a4e5ed69577f) | 18 October 2018, 04:40:44 UTC |
| b1016c9 | Andy Polyakov | 05 September 2018, 12:33:21 UTC | rsa/rsa_ossl.c: fix and extend commentary [skip ci]. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7123) (cherry picked from commit d1c008f66bad435b18aa45aa59f72bed7c682849) | 12 October 2018, 20:38:10 UTC |
| 6be3286 | Andy Polyakov | 23 September 2018, 14:38:11 UTC | util/domd: omit superfluous shift in -MD handling. While reviewing last modification in GH#6261 Richard actually spotted the inconsistency, but withdrew the remark, correct one in aftermath... Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7298) | 12 October 2018, 18:46:44 UTC |
| fff1da4 | Nicola Tuveri | 06 September 2018, 21:44:36 UTC | Access `group->mont_data` conditionally in EC_GROUP_set_generator() It appears that, in FIPS mode, `ec_precompute_mont_data()` always failed but the error was ignored until commit e3ab8cc from #6810. The actual problem lies in the fact that access to the `mont_data` field of an `EC_GROUP` struct should always be guarded by an `EC_GROUP_VERSION(group)` check to avoid OOB accesses, because `group` might come from the FIPS module, which does not define the `mont_data` field inside the EC_GROUP structure. This commit adds the required check before any access to `group->mont_data` in `EC_GROUP_set_generator()`. Fixes #7127 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7135) | 02 October 2018, 10:46:02 UTC |
| 788d2fa | Pauli | 24 September 2018, 04:06:45 UTC | Merge 1.0.2 setuid calls to getenv(3) safety. Manual merge of #7047 to 1.0.2-stable. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7300) | 26 September 2018, 23:26:35 UTC |
| 2b87256 | Manikantan Subramanian | 18 September 2018, 01:54:13 UTC | Use gethostbyname_r if available Fixes #7228 The function BIO_get_host_ip uses gethostbyname, which is not thread safe and hence we grab a lock. In multi-threaded applications, this lock sometimes causes performance bottlenecks. This patch uses the function gethostbyname_r (thread safe version), when available. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7250) | 26 September 2018, 06:37:59 UTC |
| 7a6d121 | Daniel Bevenius | 24 September 2018, 06:43:35 UTC | Document OPENSSL_VERSION_TEXT macro This commit documents the OPENSSL_VERSION_TEXT which is currently missing in the man page. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7301) (cherry picked from commit 7c69495712e3dc9aa8db38271f0c3faeb2037165) | 24 September 2018, 10:09:29 UTC |
| 459b128 | Richard Levitte | 21 September 2018, 09:11:15 UTC | crypto/bn/asm/x86_64-gcc.c: remove unnecessary redefinition of BN_ULONG This module includes bn.h via other headers, so it picks up the definition from there and doesn't need to define them locally (any more?). Worst case scenario, the redefinition may be different and cause all sorts of compile errors. Fixes #7227 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7287) (cherry picked from commit dda5396aaec315bdbcb080e42fb5cd0191f2ad72) | 21 September 2018, 09:37:40 UTC |
| f58001c | Dr. Matthias St. Pierre | 17 September 2018, 15:50:54 UTC | drbg_get_entropy: force a reseed before calling ssleay_rand_bytes() Fixes #7240 In FIPS mode, the default FIPS DRBG uses the drbg_get_entropy() callback to reseed itself, which is provided by the wrapping libcrypto library. This callback in turn uses ssleay_rand_bytes() to generate random bytes. Now ssleay_rand_bytes() calls RAND_poll() once on first call to seed itself, but RAND_poll() is never called again (unless the application calls RAND_poll() explicitely). This implies that whenever the DRBG reseeds itself (which happens every 2^14 generate requests) this happens without obtaining fresh random data from the operating system's entropy sources. This patch forces a reseed from system entropy sources on every call to drbg_get_entropy(). In contrary to the automatic reseeding of the DRBG in master, this reseeding does not break applications running in a chroot() environment (see c7504aeb640a), because the SSLEAY PRNG does not maintain an error state. (It does not even check the return value of RAND_poll() on its instantiation.) In the worst case, if no random device is available for reseeding, no fresh entropy will be added to the SSLEAY PRNG but it will happily continue to generate random bytes as 'entropy' input for the DRBG's reseeding, which is just as good (or bad) as before this patch. To prevent ssleay_rand_bytes_from_system() (and hence RAND_poll()) from being called twice during instantiation, a separate drbg_get_nonce() callback has been introduced, which is identical with the previous implementation of drbg_get_entropy(). Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7259) | 20 September 2018, 16:27:27 UTC |
| 79951b1 | Richard Levitte | 19 September 2018, 19:33:45 UTC | crypto/ui/ui_openssl.c: make sure to recognise ENXIO and EIO too These both indicate that the file descriptor we're trying to use as a terminal isn't, in fact, a terminal. Fixes #7271 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7272) (cherry picked from commit 276bf8620ce35a613c856f2b70348f65ffe94067) (cherry picked from commit ad1730359220cef5903d16c7f58b602fc3713414) | 20 September 2018, 04:43:56 UTC |
| 5a6fbf6 | Bernd Edlinger | 10 September 2018, 12:18:23 UTC | Make the config script fail with an error code if Configure failed Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7166) (cherry picked from commit e13dc23cc0fd64c304c25a67d5fa516a77f9e8f1) | 11 September 2018, 16:45:59 UTC |
| fb953d2 | Richard Levitte | 06 September 2018, 07:35:39 UTC | CAPI engine: add support for RSA_NO_PADDING Since the SSL code started using RSA_NO_PADDING, the CAPI engine became unusable. This change fixes that. Fixes #7131 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7132) | 11 September 2018, 08:49:35 UTC |
| 4a98bb0 | Matt Caswell | 10 September 2018, 15:23:14 UTC | Check the return value from ASN1_INTEGER_set Found by Coverity Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7169) (cherry picked from commit 512d811719fc955f574090af4c3586a9aba46fa7) | 10 September 2018, 16:33:53 UTC |
| 6e87325 | Richard Levitte | 03 September 2018, 11:17:03 UTC | openssl req: don't try to report bits With the introduction of -pkeyopt, the number of bits may change without |newkey| being updated. Unfortunately, there is no API to retrieve the information from a EVP_PKEY_CTX either, so chances are that we report incorrect information. For the moment, it's better not to try to report the number of bits at all. Fixes #7086 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7096) (cherry picked from commit 17147181bd3f97c53592e2a5c9319b854b954039) | 04 September 2018, 12:29:36 UTC |
| 62025a4 | Richard Levitte | 04 September 2018, 10:05:39 UTC | VMS: add missing x509_time test to test scripts Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7112) | 04 September 2018, 12:21:47 UTC |
| 85d5a4e | Matt Caswell | 23 August 2018, 10:37:22 UTC | Clarify the EVP_DigestSignInit docs They did not make it clear how the memory management works for the |pctx| parameter. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7043) | 04 September 2018, 10:21:08 UTC |
| 3c55cb2 | Jakub Wilk | 03 September 2018, 09:09:51 UTC | Fix example in crl(1) man page The default input format is PEM, so explicit "-inform DER" is needed to read DER-encoded CRL. CLA: trivial Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7094) (cherry picked from commit 785e614a95a134831f213749332bcf40c4920f69) (cherry picked from commit e25fc6b5b2b99ed02f8966192c94c820b6f69add) | 04 September 2018, 10:06:58 UTC |
| e121d5c | Matt Caswell | 09 August 2018, 15:25:29 UTC | The req documentation incorrectly states that we default to md5 Just remove that statement. It's not been true since 2005. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/6906) | 04 September 2018, 09:58:36 UTC |
| 78ca7b7 | Pauli | 02 September 2018, 21:37:38 UTC | Check the return from BN_sub() in BN_X931_generate_Xpq(). Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7088) (cherry picked from commit 6bcfcf16bf6aef4f9ec267d8b86ae1bffd8deab9) | 03 September 2018, 00:43:32 UTC |
| e24892e | Eric Brown | 16 August 2018, 15:34:39 UTC | Remove redundant ASN1_INTEGER_set call This trivial patch removes a duplicated call to ASN1_INTEGER_set. Fixes Issue #6977 Signed-off-by: Eric Brown <browne@vmware.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6984) (cherry picked from commit 59701e6363531cddef5b2114c0127b8453deb1f3) | 02 September 2018, 21:28:22 UTC |
| bc25145 | Andy Polyakov | 15 August 2018, 13:46:35 UTC | bn/bn_lib.c: conceal even memmory access pattern in bn2binpad. (cherry picked from commit 324b95605225410763fe63f7cff36eb46ca54ee9) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6942) | 28 August 2018, 17:35:49 UTC |
| b6f773b | Andy Polyakov | 13 August 2018, 14:59:08 UTC | bn/bn_blind.c: use Montgomery multiplication when possible. (cherry picked from commit e02c519cd32a55e6ad39a0cfbeeda775f9115f28) Resolved conflicts: crypto/bn/bn_blind.c Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6942) | 28 August 2018, 17:35:41 UTC |
| f9381fd | Andy Polyakov | 13 August 2018, 18:20:28 UTC | rsa/rsa_eay.c: implement variant of "Smooth CRT-RSA." In [most common] case of p and q being of same width, it's possible to replace CRT modulo operations with Montgomery reductions. And those are even fixed-length Montgomery reductions... (cherry picked from commit 41bfd5e7c8ac3a0874a94e4d15c006ad5eb48e59) Resolved conflicts: crypto/rsa/rsa_eay.c Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6942) | 28 August 2018, 17:35:33 UTC |
| 387d170 | Andy Polyakov | 10 August 2018, 17:31:22 UTC | crypto/bn: add more fixed-top routines. Add bn_mul_fixed_top, bn_from_mont_fixed_top, bn_mod_sub_fixed_top. Switch to bn_{mul|sqr}_fixed_top in bn_mul_mont_fixed_top and remove memset in bn_from_montgomery_word. (cherry picked from commit fcc4ee09473cac511eca90faa003661c7786e4f9) Resolved conflicts: crypto/bn/bn_mod.c crypto/bn_int.h Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6942) | 28 August 2018, 17:34:55 UTC |
| 1909667 | Hubert Kario | 27 August 2018, 13:21:18 UTC | document the -no_ecdhe option in s_server man page the option is provided in the -help message of the s_server utility but it is not documented in the man page, this fixes it Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7046) | 27 August 2018, 13:21:18 UTC |
| 9804228 | Andy Polyakov | 29 July 2018, 12:13:32 UTC | x509v3/v3_purp.c: resolve Thread Sanitizer nit. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6916) (cherry picked from commit 0da7358b0757fa35f2c3a8f51fa036466ae50fd7) Resolved conflicts: crypto/x509v3/v3_purp.c | 17 August 2018, 07:58:50 UTC |
| 8297ab5 | Matt Caswell | 14 August 2018, 13:01:59 UTC | Prepare for 1.0.2q-dev Reviewed-by: Richard Levitte <levitte@openssl.org> | 14 August 2018, 13:01:59 UTC |
| e71ebf2 | Matt Caswell | 14 August 2018, 13:01:02 UTC | Prepare for 1.0.2p release Reviewed-by: Richard Levitte <levitte@openssl.org> | 14 August 2018, 13:01:02 UTC |
| b9dd4b9 | Matt Caswell | 14 August 2018, 13:01:02 UTC | make update Reviewed-by: Richard Levitte <levitte@openssl.org> | 14 August 2018, 13:01:02 UTC |
| 2d2fe42 | Richard Levitte | 14 August 2018, 12:52:49 UTC | i2d_ASN1_BOOLEAN(): correct error module Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6957) | 14 August 2018, 12:57:51 UTC |
| c24e2f1 | Matt Caswell | 14 August 2018, 12:29:02 UTC | Update copyright year Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6955) | 14 August 2018, 12:40:34 UTC |
| 0698c33 | Matt Caswell | 14 August 2018, 09:39:19 UTC | Updates to CHANGES and NEWS for the new release Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6951) | 14 August 2018, 09:57:38 UTC |
| 7d4c97a | Richard Levitte | 13 August 2018, 18:37:43 UTC | i2d_ASN1_BOOLEAN(): allocate memory if the user didn't provide a buffer Just as was done recently for i2d_ASN1_OBJECT, we also make i2d_ASN1_BOOLEAN comply with the documentation. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6943) | 14 August 2018, 09:50:12 UTC |
| 0971432 | Richard Levitte | 11 August 2018, 07:59:20 UTC | i2d_ASN1_OBJECT(): allocate memory if the user didn't provide a buffer Since 0.9.7, all i2d_ functions were documented to allocate an output buffer if the user didn't provide one, under these conditions (from the 1.0.2 documentation): For OpenSSL 0.9.7 and later if B<*out> is B<NULL> memory will be allocated for a buffer and the encoded data written to it. In this case B<*out> is not incremented and it points to the start of the data just written. i2d_ASN1_OBJECT was found not to do this, and would crash if a NULL output buffer was provided. Fixes #6914 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6918) (cherry picked from commit 6114041540d8d1fecaf23a861788c3c742d3b467) | 11 August 2018, 10:38:46 UTC |
| ec3f996 | Andy Polyakov | 04 February 2018, 14:24:54 UTC | rsa/*: switch to BN_bn2binpad. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6889) (cherry picked from commit 582ad5d4d9b7703eb089016935133e3a18ea8205) Resolved conflicts: crypto/rsa/rsa_ossl.c crypto/rsa/rsa_pk1.c | 10 August 2018, 19:08:21 UTC |
| df6b67b | Andy Polyakov | 16 July 2018, 16:17:44 UTC | bn/bn_lib.c address Coverity nit in bn2binpad. It was false positive, but one can as well view it as readability issue. Switch even to unsigned indices because % BN_BYTES takes 4-6 instructions with signed dividend vs. 1 (one) with unsigned. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6889) (cherry picked from commit 83e034379fa3f6f0d308ec75fbcb137e26154aec) | 10 August 2018, 19:08:15 UTC |
| 6412738 | Andy Polyakov | 04 February 2018, 14:20:29 UTC | bn/bn_lib.c: add computationally constant-time bn_bn2binpad. "Computationally constant-time" means that it might still leak information about input's length, but only in cases when input is missing complete BN_ULONG limbs. But even then leak is possible only if attacker can observe memory access pattern with limb granularity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6889) (cherry picked from commit 89d8aade5f4011ddeea7827f08ec544c914f275a) Resolved conflicts: crypto/bn/bn_lib.c | 10 August 2018, 19:07:14 UTC |
| f72a7ce | Richard Levitte | 07 August 2018, 04:21:43 UTC | Make EVP_PKEY_asn1_new() stricter with its input Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6881) | 07 August 2018, 05:58:27 UTC |
| 29d8bda | Andy Polyakov | 30 July 2018, 10:39:08 UTC | CHANGES: mention blinding reverting in ECDSA. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6810) | 01 August 2018, 14:33:51 UTC |
| 983e1ad | Andy Polyakov | 30 July 2018, 10:37:17 UTC | ecdsa/ecs_ossl.c: switch to fixed-length Montgomery multiplication. (back-ported from commit 37132c9702328940a99b1307f742ab094ef754a7) Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6810) | 01 August 2018, 14:33:51 UTC |
| e3ab8cc | Billy Brumley | 20 January 2016, 11:18:21 UTC | Fix BN_gcd errors for some curves Those even order that do not play nicely with Montgomery arithmetic (back-ported from commit 3a6a4a93518fbb3d96632bfdcb538d340f29c56b) Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6810) | 01 August 2018, 14:33:06 UTC |
| 6a81596 | Andy Polyakov | 25 July 2018, 08:29:51 UTC | bn/bn_mod.c: harmonize BN_mod_add_quick with original implementation. New implementation failed to correctly reset r->neg flag. Spotted by OSSFuzz. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6810) (cherry picked from commit 70a579ae2f37437a1e02331eeaa84e1b68ba021e) | 01 August 2018, 14:15:25 UTC |
| 83325a6 | Andy Polyakov | 06 July 2018, 13:55:34 UTC | ecdsa/ecs_ossl.c: revert blinding in ECDSA signature. Originally suggested solution for "Return Of the Hidden Number Problem" is arguably too expensive. While it has marginal impact on slower curves, none to ~6%, optimized implementations suffer real penalties. Most notably sign with P-256 went more than 2 times[!] slower. Instead, just implement constant-time BN_mod_add_quick. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6810) (cherry picked from commit 3fc7a9b96cbed0c3da6f53c08e34d8d0c982745f) Resolved onflicts: crypto/ec/ecdsa_ossl.c crypto/include/internal/bn_int.h | 01 August 2018, 14:15:17 UTC |
