openssl.git
14 months agoEnable DH "keys" which only contain domain parameters
Matt Caswell [Wed, 4 Sep 2019 09:58:59 +0000 (10:58 +0100)]
Enable DH "keys" which only contain domain parameters

It is valid for a pub_key and priv_key to be missing from a DH "key".

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9753)

14 months agoAdd docs for the provider interface for signature operations
Matt Caswell [Tue, 3 Sep 2019 16:05:52 +0000 (17:05 +0100)]
Add docs for the provider interface for signature operations

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9753)

14 months agoAdd public API docs for newly added EVP_SIGNATURE related functions
Matt Caswell [Tue, 3 Sep 2019 15:15:21 +0000 (16:15 +0100)]
Add public API docs for newly added EVP_SIGNATURE related functions

Documentation for EVP_SIGNATURE_*() as well as EVP_PKEY_sign_init_ex(),
EVP_PKEY_verify_init_ex() and EVP_PKEY_verify_recover_init_ex().

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9753)

14 months agoAdd support for verify/verify_recover functions to EVP_SIGNATURE
Matt Caswell [Mon, 2 Sep 2019 15:48:26 +0000 (16:48 +0100)]
Add support for verify/verify_recover functions to EVP_SIGNATURE

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9753)

14 months agoImplement DSA in the default provider
Matt Caswell [Fri, 30 Aug 2019 12:33:37 +0000 (13:33 +0100)]
Implement DSA in the default provider

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9753)

14 months agoAdd the ability to perform signatures in a provider
Matt Caswell [Fri, 30 Aug 2019 12:33:10 +0000 (13:33 +0100)]
Add the ability to perform signatures in a provider

This makes EVP_PKEY_sign and EVP_PKEY_sign_init provider aware. It
also introduces the new type EVP_SIGNATURE to represent signature
algorithms. This also automatically makes the EVP_Sign* APIs provider
aware because they use EVP_Digest* (which is already provider aware)
and EVP_PKEY_sign(_init) under the covers.

At this stage there are no signature algorithms in any providers. That
will come in the following commits.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9753)

14 months agoDH_check_pub_key_ex was accidentally calling DH_check,
Bernd Edlinger [Fri, 6 Sep 2019 22:58:31 +0000 (00:58 +0200)]
DH_check_pub_key_ex was accidentally calling DH_check,
so results were undefined.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9796)

14 months agoUse BN_clear_free in DH_set0_key
Bernd Edlinger [Fri, 6 Sep 2019 22:53:24 +0000 (00:53 +0200)]
Use BN_clear_free in DH_set0_key

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9796)

14 months agoCheck the DH modulus bit length
Bernd Edlinger [Fri, 6 Sep 2019 21:38:49 +0000 (23:38 +0200)]
Check the DH modulus bit length

The check was missing in DH_check and DH_check_params.

[extended tests]

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9796)

14 months agoUniform TEST_*() check usage in test/ectest.c
Nicola Tuveri [Mon, 9 Sep 2019 01:00:37 +0000 (04:00 +0300)]
Uniform TEST_*() check usage in test/ectest.c

- Replace a `TEST_true()` with `!TEST_false()` to avoid reporting
  confusing errors
- We tend to use `if (!TEST_foo() || !TEST_bar())` and it's a bit
  confusing to switch to `if(!(TEST_foo() && TEST_bar()))`: replace it
  with the more common style

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9813)

14 months agoFix spacing nit in test/ectest.c
Nicola Tuveri [Mon, 9 Sep 2019 00:52:00 +0000 (03:52 +0300)]
Fix spacing nit in test/ectest.c

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9813)

14 months agoFix typos in the OSSL_METHOD_STORE doc
Jakub Zelenka [Sun, 8 Sep 2019 16:32:07 +0000 (17:32 +0100)]
Fix typos in the OSSL_METHOD_STORE doc

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9825)

14 months ago[ec] Match built-in curves on EC_GROUP_new_from_ecparameters
Nicola Tuveri [Sat, 7 Sep 2019 15:05:31 +0000 (18:05 +0300)]
[ec] Match built-in curves on EC_GROUP_new_from_ecparameters

Description
-----------

Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any
of the built-in curves. If that is the case, return a new
`EC_GROUP_new_by_curve_name()` object instead of the explicit parameters
`EC_GROUP`.

This affects all users of `EC_GROUP_new_from_ecparameters()`:
- direct calls to `EC_GROUP_new_from_ecparameters()`
- direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit
  parameters argument
- ASN.1 parsing of explicit parameters keys (as it eventually
  ends up calling `EC_GROUP_new_from_ecpkparameters()`)

A parsed explicit parameter key will still be marked with the
`OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless
programmatically forced otherwise, if the key is eventually serialized
the output will still be encoded with explicit parameters, even if
internally it is treated as a named curve `EC_GROUP`.

Before this change, creating any `EC_GROUP` object using
`EC_GROUP_new_from_ecparameters()`, yielded an object associated with
the default generic `EC_METHOD`, but this was never guaranteed in the
documentation.
After this commit, users of the library that intentionally want to
create an `EC_GROUP` object using a specific `EC_METHOD` can still
explicitly call `EC_GROUP_new(foo_method)` and then manually set the
curve parameters using `EC_GROUP_set_*()`.

Motivation
----------

This has obvious performance benefits for the built-in curves with
specialized `EC_METHOD`s and subtle but important security benefits:
- the specialized methods have better security hardening than the
  generic implementations
- optional fields in the parameter encoding, like the `cofactor`, cannot
  be leveraged by an attacker to force execution of the less secure
  code-paths for single point scalar multiplication
- in general, this leads to reducing the attack surface

Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth
analysis of the issues related to this commit.

It should be noted that `libssl` does not allow to negotiate explicit
parameters (as per RFC 8422), so it is not directly affected by the
consequences of using explicit parameters that this commit fixes.
On the other hand, we detected external applications and users in the
wild that use explicit parameters by default (and sometimes using 0 as
the cofactor value, which is technically not a valid value per the
specification, but is tolerated by parsers for wider compatibility given
that the field is optional).
These external users of `libcrypto` are exposed to these vulnerabilities
and their security will benefit from this commit.

Related commits
---------------

While this commit is beneficial for users using built-in curves and
explicit parameters encoding for serialized keys, commit
b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the
1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the
invalid cofactor values more in general also for other curves
(CVE-2019-1547).

The following list covers commits in `master` that are related to the
vulnerabilities presented in the manuscript motivating this commit:

d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too
311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats

Note that the PRs that contributed the listed commits also include other
commits providing related testing and documentation, in addition to
links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and
1.1.1 branches.

Responsible Disclosure
----------------------

This and the other issues presented in https://arxiv.org/abs/1909.01785
were reported by Cesar Pereida GarcĂ­a, Sohaib ul Hassan, Nicola Tuveri,
Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the
NISEC group at Tampere University, FINLAND.

The OpenSSL Security Team evaluated the security risk for this
vulnerability as low, and encouraged to propose fixes using public Pull
Requests.

_______________________________________________________________________________

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9808)

14 months agoDo no mention private headers in public headers
Richard Levitte [Mon, 9 Sep 2019 00:41:26 +0000 (02:41 +0200)]
Do no mention private headers in public headers

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/9812)

14 months agoConfigure: clang: move -Wno-unknown-warning-option to the front
Dr. Matthias St. Pierre [Tue, 23 Jul 2019 18:54:03 +0000 (20:54 +0200)]
Configure: clang: move -Wno-unknown-warning-option to the front

While gcc ignores unknown options of the type '-Wno-xxx', clang by default issues
a warning [-Wunknown-warning-option] (see [3]), which together with '-Werror'
causes the build to fail. This turned out to be a problem on the 1.0.2 stable branch
in the case of the '-Wextended-offsetof' option, which was removed in version 6.0.0,
but needs to be kept here in order to support older clang versions, too (see #9446).

Incidentally, master and 1.1.1 branch already contained the -Wno-unknown-warning-option
option. Due to its special role and its importance, this commit adds an explaining
commit message and moves the option to the front.

[extended tests]

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9447)

14 months agoCHANGES entry: for ECC parameters with NULL or zero cofactor, compute it
Billy Brumley [Fri, 6 Sep 2019 14:26:40 +0000 (17:26 +0300)]
CHANGES entry: for ECC parameters with NULL or zero cofactor, compute it

This is a forward port from https://github.com/openssl/openssl/pull/9781
of the CHANGES entry for the functionality added in
https://github.com/openssl/openssl/pull/9727

(cherry picked from commit 4b965086cb56c24cb5d2197fc04869b95f209a11)

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9797)

14 months ago[test] computing ECC cofactors: regression test
Billy Brumley [Fri, 6 Sep 2019 14:26:08 +0000 (17:26 +0300)]
[test] computing ECC cofactors: regression test

This is a forward port from
    https://github.com/openssl/openssl/pull/9781
for the test logic introduced by
    https://github.com/openssl/openssl/pull/9727

As @mattcaswell commented
(https://github.com/openssl/openssl/pull/9781#discussion_r321621541):

> These `TEST_true` calls should be `!TEST_false` because we are
> *expecting* a failure.
> The difference is that the test framework will print error details if
> the test doesn't give the expected answer.
> So by using `TEST_true` instead of `!TEST_false` we'll get error
> details printed, but the test will succeed anyway.

(cherry picked from commit e8aafc891d9bd7fa1cce0401d858ef842f09b49e)

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9797)

14 months agoUse common digest getter for X942 KDF
Pauli [Sat, 7 Sep 2019 00:50:46 +0000 (10:50 +1000)]
Use common digest getter for X942 KDF

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUse common digest getter for SSH KDF
Pauli [Sat, 7 Sep 2019 00:50:14 +0000 (10:50 +1000)]
Use common digest getter for SSH KDF

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUse common digest getter for TLS1 PRF
Pauli [Sat, 7 Sep 2019 00:49:53 +0000 (10:49 +1000)]
Use common digest getter for TLS1 PRF

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUse common digest getter for single step KDF
Pauli [Sat, 7 Sep 2019 00:49:36 +0000 (10:49 +1000)]
Use common digest getter for single step KDF

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUse common digest getter for PBKDF2
Pauli [Sat, 7 Sep 2019 00:49:18 +0000 (10:49 +1000)]
Use common digest getter for PBKDF2

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUse common digest getter for HKDF
Pauli [Sat, 7 Sep 2019 00:48:56 +0000 (10:48 +1000)]
Use common digest getter for HKDF

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUse common define for properties, engine, cipher and digest params
Pauli [Sat, 7 Sep 2019 00:48:07 +0000 (10:48 +1000)]
Use common define for properties, engine, cipher and digest params

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoAdd 'engine' param to KDFs
Pauli [Sat, 7 Sep 2019 00:47:37 +0000 (10:47 +1000)]
Add 'engine' param to KDFs

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoKMAC using common digest get code
Pauli [Thu, 5 Sep 2019 03:55:04 +0000 (13:55 +1000)]
KMAC using common digest get code

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoHMAC using common digest get code
Pauli [Thu, 5 Sep 2019 03:54:53 +0000 (13:54 +1000)]
HMAC using common digest get code

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoGMAC using common cipher get code
Pauli [Thu, 5 Sep 2019 04:24:44 +0000 (14:24 +1000)]
GMAC using common cipher get code

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoCMAC using common cipher get code
Pauli [Thu, 5 Sep 2019 04:15:02 +0000 (14:15 +1000)]
CMAC using common cipher get code

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months agoUnify the digest getting code inside providers.
Pauli [Thu, 5 Sep 2019 03:53:20 +0000 (13:53 +1000)]
Unify the digest getting code inside providers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9770)

14 months ago[ec/ecp_nistp*.c] restyle: use {} around `else` too
Nicola Tuveri [Fri, 6 Sep 2019 11:05:26 +0000 (14:05 +0300)]
[ec/ecp_nistp*.c] restyle: use {} around `else` too

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9511)

14 months ago[ec/ecp_nistp*.c] remove flip_endian()
Nicola Tuveri [Thu, 5 Sep 2019 22:31:45 +0000 (01:31 +0300)]
[ec/ecp_nistp*.c] remove flip_endian()

Replace flip_endian() by using the little endian specific
BN_bn2lebinpad() and BN_lebin2bn().

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9511)

14 months agoUniform BN_bn2binpad() and BN_bn2lebinpad() implementations
Nicola Tuveri [Thu, 5 Sep 2019 21:18:36 +0000 (00:18 +0300)]
Uniform BN_bn2binpad() and BN_bn2lebinpad() implementations

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9511)

14 months agoMake BN_num_bits() consttime upon BN_FLG_CONSTTIME
Nicola Tuveri [Thu, 1 Aug 2019 23:08:34 +0000 (02:08 +0300)]
Make BN_num_bits() consttime upon BN_FLG_CONSTTIME

This issue was partially addressed by commit
972c87dfc7e765bd28a4964519c362f0d3a58ca4, which hardened its callee
BN_num_bits_word() to avoid leaking the most-significant word of its
argument via branching and memory access pattern.
The commit message also reported:
> There are a few places where BN_num_bits is called on an input where
> the bit length is also secret. This does *not* fully resolve those
> cases as we still only look at the top word.

BN_num_bits() is called directly or indirectly (e.g., through
BN_num_bytes() or BN_bn2binpad() ) in various parts of the `crypto/ec`
code, notably in all the currently supported implementations of scalar
multiplication (in the generic path through ec_scalar_mul_ladder() as
well as in dedicated methods like ecp_nistp{224,256,521}.c and
ecp_nistz256.c).

Under the right conditions, a motivated SCA attacker could retrieve the
secret bitlength of a secret nonce through this vulnerability,
potentially leading, ultimately, to recover a long-term secret key.

With this commit, exclusively for BIGNUMs that are flagged with
BN_FLG_CONSTTIME, instead of accessing only bn->top, all the limbs of
the BIGNUM are accessed up to bn->dmax and bitwise masking is used to
avoid branching.

Memory access pattern still leaks bn->dmax, the size of the lazily
allocated buffer for representing the BIGNUM, which is inevitable with
the current BIGNUM architecture: reading past bn->dmax would be an
out-of-bound read.
As such, it's the caller responsibility to ensure that bn->dmax does not
leak secret information, by explicitly expanding the internal BIGNUM
buffer to a public value sufficient to avoid any lazy reallocation
while manipulating it: this should be already done at the top level
alongside setting the BN_FLG_CONSTTIME.

Thanks to David Schrammel and Samuel Weiser for reporting this issue
through responsible disclosure.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9511)

14 months agoFix a SCA leak using BN_bn2bin()
Nicola Tuveri [Thu, 1 Aug 2019 22:33:05 +0000 (01:33 +0300)]
Fix a SCA leak using BN_bn2bin()

BN_bn2bin() is not constant-time and leaks the number of bits in the
processed BIGNUM.

The specialized methods in ecp_nistp224.c, ecp_nistp256.c and
ecp_nistp521.c internally used BN_bn2bin() to convert scalars into the
internal fixed length representation.

This can leak during ECDSA/ECDH key generation or handling the nonce
while generating an ECDSA signature, when using these implementations.
The amount and risk of leaked information useful for a SCA attack
varies for each of the three curves, as it depends mainly on the
ratio between the bitlength of the curve subgroup order (governing the
size of the secret nonce/key) and the limb size for the internal BIGNUM
representation (which depends on the compilation target architecture).

To fix this, we replace BN_bn2bin() with BN_bn2binpad(), bounding the
output length to the width of the internal representation buffer: this
length is public.

Internally the final implementation of both BN_bn2binpad() and
BN_bn2bin() already has masking in place to avoid leaking bn->top
through memory access patterns.
Memory access pattern still leaks bn->dmax, the size of the lazily
allocated buffer for representing the BIGNUM, which is inevitable with
the current BIGNUM architecture: reading past bn->dmax would be an
out-of-bound read.
As such, it's the caller responsibility to ensure that bn->dmax does not
leak secret information, by explicitly expanding the internal BIGNUM
buffer to a public value sufficient to avoid any lazy reallocation
while manipulating it: this is already done at the top level alongside
setting the BN_FLG_CONSTTIME.

Finally, the internal implementation of BN_bn2binpad() indirectly calls
BN_num_bits() via BN_num_bytes(): the current implementation of
BN_num_bits() can leak information to a SCA attacker, and is addressed
in the next commit.

Thanks to David Schrammel and Samuel Weiser for reporting this issue
through responsible disclosure.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/9511)

14 months agoFix a SCA leak in BN_generate_dsa_nonce
Bernd Edlinger [Fri, 6 Sep 2019 06:46:46 +0000 (08:46 +0200)]
Fix a SCA leak in BN_generate_dsa_nonce

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/9782)

14 months ago[crypto/rsa] Set the constant-time flag in multi-prime RSA too
Cesar Pereida Garcia [Fri, 6 Sep 2019 07:48:00 +0000 (10:48 +0300)]
[crypto/rsa] Set the constant-time flag in multi-prime RSA too

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9779)

14 months ago[crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
Cesar Pereida Garcia [Thu, 5 Sep 2019 09:13:11 +0000 (12:13 +0300)]
[crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.

This commit addresses multiple side-channel vulnerabilities present
during RSA key validation.
Private key parameters are re-computed using variable-time functions.

This issue was discovered and reported by the NISEC group at TAU Finland.

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9779)

14 months agolibcrypto.num entries for KDFs
Pauli [Wed, 4 Sep 2019 22:11:48 +0000 (08:11 +1000)]
libcrypto.num entries for KDFs

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoMove OSSL_OP_KDF into its rightful place amongst the other OSSL_OP_ definitions
Pauli [Tue, 3 Sep 2019 04:30:53 +0000 (14:30 +1000)]
Move OSSL_OP_KDF into its rightful place amongst the other OSSL_OP_ definitions

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoRemove reference to legacy aliases for MAC and KDF
Pauli [Tue, 3 Sep 2019 04:29:46 +0000 (14:29 +1000)]
Remove reference to legacy aliases for MAC and KDF

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoClear collected_seed after freeing it
Pauli [Tue, 3 Sep 2019 04:28:47 +0000 (14:28 +1000)]
Clear collected_seed after freeing it

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoLowercase command line 'N' argument since params have lower case names
Pauli [Tue, 3 Sep 2019 04:26:19 +0000 (14:26 +1000)]
Lowercase command line 'N' argument since params have lower case names

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoUpdate KDF documentation (section 3)
Pauli [Mon, 2 Sep 2019 04:23:50 +0000 (14:23 +1000)]
Update KDF documentation (section 3)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoUpdate KDF documentation (section 1)
Pauli [Mon, 2 Sep 2019 03:58:42 +0000 (13:58 +1000)]
Update KDF documentation (section 1)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoUpdate KDF documentation (section 7)
Pauli [Mon, 2 Sep 2019 03:58:22 +0000 (13:58 +1000)]
Update KDF documentation (section 7)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoDeal with BUF_MEM_grow ambiguity
Richard Levitte [Fri, 30 Aug 2019 14:54:47 +0000 (16:54 +0200)]
Deal with BUF_MEM_grow ambiguity

BUF_MEM_grow() returns the passed length, but also zero on error.  If
the passed length was zero, an extra check to see if a returned zero
was an error or not is needed.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agocrypto/evp/pkey_kdf.c: further special treatment of "seed" and "info"
Richard Levitte [Fri, 30 Aug 2019 14:34:27 +0000 (16:34 +0200)]
crypto/evp/pkey_kdf.c: further special treatment of "seed" and "info"

pkey_kdf_ctrl_str() has to do the same kind of special treatment as
pkey_kdf_ctrl() does.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoMore KDF cleanup
Richard Levitte [Fri, 30 Aug 2019 13:36:20 +0000 (15:36 +0200)]
More KDF cleanup

The EVP_KDF_ definitions are no longer needed, and neither is
EVP_get_kdfbyname()

test/evp_kdf_test.c tried to use a EVP_get_kdfbyname() that was rewritten
to use EVP_KDF_fetch() without ever freeing the resulting KDF method.
It's better to refactor the test to use EVP_KDF_fetch directly.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoPBKDF2 implementation: refactor to avoid memleak
Richard Levitte [Fri, 30 Aug 2019 13:11:08 +0000 (15:11 +0200)]
PBKDF2 implementation: refactor to avoid memleak

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoFix memleaks in KDF implementations
Richard Levitte [Fri, 30 Aug 2019 12:35:43 +0000 (14:35 +0200)]
Fix memleaks in KDF implementations

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agocrypto/evp/pkey_kdf.c: Redo parameter processing
Richard Levitte [Fri, 30 Aug 2019 12:32:55 +0000 (14:32 +0200)]
crypto/evp/pkey_kdf.c: Redo parameter processing

Undo the caching scheme, pass through most controls as parameters, except
for SEED and INFO, where we keep supporting adding data through additional
ctrl calls by collecting the data, and only passing it to the EVP_KDF
before calling its derive function.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agocrypto/evp/kdf_meth.c: Add the reset function to the method
Richard Levitte [Fri, 30 Aug 2019 12:32:33 +0000 (14:32 +0200)]
crypto/evp/kdf_meth.c: Add the reset function to the method

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoUpdate private.num for KDFs/PRFs
Pauli [Thu, 29 Aug 2019 05:07:55 +0000 (15:07 +1000)]
Update private.num for KDFs/PRFs

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoossl_provider_library_context(NULL) returns NULL.
Pauli [Thu, 29 Aug 2019 03:02:54 +0000 (13:02 +1000)]
ossl_provider_library_context(NULL) returns NULL.

This will only be required until everything is moved to providers and a NULL
provider pointer won't be possible.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoParams from text to allow zero length value fields
Pauli [Tue, 27 Aug 2019 05:48:39 +0000 (15:48 +1000)]
Params from text to allow zero length value fields

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoUpdate EVP test data for KDFs and PRFs.
Pauli [Tue, 27 Aug 2019 05:23:09 +0000 (15:23 +1000)]
Update EVP test data for KDFs and PRFs.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoKDF error codes reworked
Pauli [Sat, 24 Aug 2019 10:14:51 +0000 (20:14 +1000)]
KDF error codes reworked

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoCleanse KDF missing crypto files
Pauli [Sat, 24 Aug 2019 09:50:46 +0000 (19:50 +1000)]
Cleanse KDF missing crypto files

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoCleanse KDF error files
Pauli [Sat, 24 Aug 2019 09:50:21 +0000 (19:50 +1000)]
Cleanse KDF error files

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoCleanse crypto/kdf directory
Pauli [Sat, 24 Aug 2019 09:49:46 +0000 (19:49 +1000)]
Cleanse crypto/kdf directory

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoKDF/PRF updates to libcrypto
Pauli [Wed, 21 Aug 2019 08:54:35 +0000 (18:54 +1000)]
KDF/PRF updates to libcrypto

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoApp updates for KDF provider conversion.
Pauli [Wed, 21 Aug 2019 08:53:45 +0000 (18:53 +1000)]
App updates for KDF provider conversion.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoKDF provider conversion error updates - generated
Pauli [Wed, 21 Aug 2019 08:53:07 +0000 (18:53 +1000)]
KDF provider conversion error updates - generated

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoKDF additons to names and numbers
Pauli [Wed, 21 Aug 2019 08:52:32 +0000 (18:52 +1000)]
KDF additons to names and numbers

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoTest updates in light of the KDF switchover
Pauli [Wed, 21 Aug 2019 08:52:04 +0000 (18:52 +1000)]
Test updates in light of the KDF switchover

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoDocumentation updates in light of the KDF conversion
Pauli [Wed, 21 Aug 2019 08:51:34 +0000 (18:51 +1000)]
Documentation updates in light of the KDF conversion

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoAdd KDFs to providers
Pauli [Wed, 21 Aug 2019 03:09:10 +0000 (13:09 +1000)]
Add KDFs to providers

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoFix users of KDFs to use params not ctls
Pauli [Tue, 20 Aug 2019 22:06:29 +0000 (08:06 +1000)]
Fix users of KDFs to use params not ctls

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoRemove old KDF initialisation
Pauli [Tue, 20 Aug 2019 22:04:27 +0000 (08:04 +1000)]
Remove old KDF initialisation

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoFix TLS/SSL PRF usages.
Pauli [Tue, 20 Aug 2019 22:01:08 +0000 (08:01 +1000)]
Fix TLS/SSL PRF usages.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoMove KDFs to the provider.
Pauli [Tue, 20 Aug 2019 22:00:12 +0000 (08:00 +1000)]
Move KDFs to the provider.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9662)

14 months agoTeach TLSProxy how to parse CertificateRequest messages
Matt Caswell [Thu, 5 Sep 2019 15:21:56 +0000 (16:21 +0100)]
Teach TLSProxy how to parse CertificateRequest messages

We also use this in test_tls13messages to check that the extensions we
expect to see in a CertificateRequest are there.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9780)

14 months agoDon't send a status_request extension in a CertificateRequest message
Matt Caswell [Thu, 5 Sep 2019 15:43:57 +0000 (16:43 +0100)]
Don't send a status_request extension in a CertificateRequest message

If a TLSv1.3 server configured to respond to the status_request extension
also attempted to send a CertificateRequest then it was incorrectly
inserting a non zero length status_request extension into that message.

The TLSv1.3 RFC does allow that extension in that message but it must
always be zero length.

In fact we should not be sending the extension at all in that message
because we don't support it.

Fixes #9767

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9780)

14 months agoUndeprecate OpenSSL_version_num and OPENSSL_VERSION_NUMBER
Viktor Dukhovni [Sun, 9 Dec 2018 22:10:29 +0000 (17:10 -0500)]
Undeprecate OpenSSL_version_num and OPENSSL_VERSION_NUMBER

The OpenSSL_version_num() function returns at runtime the
OPENSSL_VERSION_NUMBER of the compiled OpenSSL library.  This is a
used and useful interface, and should not (at least yet) be
deprecated, we just introduced the new versioning schema, it seems
too early to deprecate the old.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7853)

14 months agoReverting check to correct
Dmitry Belyavskiy [Thu, 5 Sep 2019 12:50:58 +0000 (15:50 +0300)]
Reverting check to correct

Fixes #9773.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9776)

14 months agoDisallow change EVP_CIPHER properties once set
Dmitry Belyavskiy [Thu, 5 Sep 2019 05:31:38 +0000 (08:31 +0300)]
Disallow change EVP_CIPHER properties once set

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9764)

14 months agoDisallow change EVP_MD properties once set
Dmitry Belyavskiy [Wed, 4 Sep 2019 19:49:09 +0000 (22:49 +0300)]
Disallow change EVP_MD properties once set

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9764)

14 months ago[test] computing ECC cofactors: regression test
Billy Brumley [Mon, 2 Sep 2019 12:03:26 +0000 (15:03 +0300)]
[test] computing ECC cofactors: regression test

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9827)

14 months ago[crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
Billy Brumley [Mon, 2 Sep 2019 12:02:30 +0000 (15:02 +0300)]
[crypto/ec] for ECC parameters with NULL or zero cofactor, compute it

The cofactor argument to EC_GROUP_set_generator is optional, and SCA mitigations for ECC currently use it. So the library currently falls back to very old SCA-vulnerable code if the cofactor is not present.

This PR allows EC_GROUP_set_generator to compute the cofactor for all curves of cryptographic interest. Steering scalar multiplication to more SCA-robust code.

This issue affects persisted private keys in explicit parameter form, where the (optional) cofactor field is zero or absent.

It also affects curves not built-in to the library, but constructed programatically with explicit parameters, then calling EC_GROUP_set_generator with a nonsensical value (NULL, zero).

The very old scalar multiplication code is known to be vulnerable to local uarch attacks, outside of the OpenSSL threat model. New results suggest the code path is also vulnerable to traditional wall clock timing attacks.

CVE-2019-1547

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9827)

14 months agoMake failed messages easier to find
Rich Salz [Sun, 18 Aug 2019 13:04:17 +0000 (09:04 -0400)]
Make failed messages easier to find

Now that we use travis_terminate, we can make the status messages
simpler to find, and we don't need the "OK" output.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9707)

14 months agoFix error handling in x509_lu.c
Bernd Edlinger [Mon, 19 Aug 2019 15:12:22 +0000 (17:12 +0200)]
Fix error handling in x509_lu.c

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9639)

14 months agoCleanup includes in rand_unix.c
Bernd Edlinger [Wed, 4 Sep 2019 09:39:54 +0000 (11:39 +0200)]
Cleanup includes in rand_unix.c

Fixes #9757

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9761)

14 months agoChange provider params from int to size_t
Shane Lontis [Thu, 5 Sep 2019 01:23:57 +0000 (11:23 +1000)]
Change provider params from int to size_t

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9699)

14 months agoHandle the renamed command POD files in find-doc-nits
Rich Salz [Thu, 29 Aug 2019 16:12:17 +0000 (12:12 -0400)]
Handle the renamed command POD files in find-doc-nits

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9729)

14 months agoMove libapps.a source to apps/lib
Richard Levitte [Wed, 28 Aug 2019 20:27:47 +0000 (22:27 +0200)]
Move libapps.a source to apps/lib

This makes it clearer what's what.  The 'openssl' application and its
sub-commands remain in apps/

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9723)

14 months agoSuppress 'No server certificate CA names sent' message
Billy Brawner [Wed, 28 Aug 2019 00:07:17 +0000 (17:07 -0700)]
Suppress 'No server certificate CA names sent' message

Fixes #9080

Signed-off-by: Billy Brawner <billy@wbrawner.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9710)

14 months agoOSSL_PARAM_construct_utf8_string computes the string length.
Pauli [Wed, 4 Sep 2019 09:27:08 +0000 (19:27 +1000)]
OSSL_PARAM_construct_utf8_string computes the string length.

If the passed string length is zero, the function computes the string length
from the passed string.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9760)

14 months agoNew function EVP_CIPHER_free()
Richard Levitte [Tue, 3 Sep 2019 16:11:49 +0000 (18:11 +0200)]
New function EVP_CIPHER_free()

This function re-implements EVP_CIPHER_meth_free(), but has a name that
isn't encumbered by legacy EVP_CIPHER construction functionality.

We also refactor most of EVP_CIPHER_meth_new() into an internal
evp_cipher_new() that's used when creating fetched methods.

EVP_CIPHER_meth_new() and EVP_CIPHER_meth_free() are rewritten in terms of
evp_cipher_new() and EVP_CIPHER_free().  This means that at any time, we can
deprecate all the EVP_CIPHER_meth_ functions with no harmful consequence.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9758)

14 months agoNew function EVP_MD_free()
Richard Levitte [Tue, 3 Sep 2019 15:47:13 +0000 (17:47 +0200)]
New function EVP_MD_free()

This function re-implements EVP_MD_meth_free(), but has a name that
isn't encumbered by legacy EVP_MD construction functionality.

We also refactor most of EVP_MD_meth_new() into an internal
evp_md_new() that's used when creating fetched methods.

EVP_MD_meth_new() and EVP_MD_meth_free() are rewritten in terms of
evp_md_new() and EVP_MD_free().  This means that at any time, we can
deprecate all the EVP_MD_meth_ functions with no harmful consequence.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9758)

15 months agotest/errtest.c: more conditions for checking __FILE__ and __LINE__
Richard Levitte [Tue, 3 Sep 2019 13:10:43 +0000 (15:10 +0200)]
test/errtest.c: more conditions for checking __FILE__ and __LINE__

When at least one of OPENSSL_NO_ERR or OPENSSL_NO_FILENAMES is
defined, __FILE__ and __LINE__ are not saved with the error record.
This test only checked OPENSSL_NO_FILENAMES.  Now fixed.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9755)

15 months agoRefactor how KEYMGMT methods get associated with other methods
Richard Levitte [Fri, 23 Aug 2019 12:03:28 +0000 (14:03 +0200)]
Refactor how KEYMGMT methods get associated with other methods

KEYMGMT methods were attached to other methods after those were fully
created and registered, thereby creating a potential data race, if two
threads tried to create the exact same method at the same time.

Instead of this, we change the method creating function to take an
extra data parameter, passed all the way from the public fetching
function.  In the case of EVP_KEYEXCH, we pass all the necessary data
that evp_keyexch_from_dispatch() needs to be able to fetch the
appropriate KEYMGMT method on the fly.

Fixes #9592

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9678)

15 months agoFix Coverity 1453452: Control flow issues (DEADCODE)
Pauli [Sun, 1 Sep 2019 23:12:53 +0000 (09:12 +1000)]
Fix Coverity 1453452: Control flow issues (DEADCODE)

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9749)

15 months agoAdd CPU info to the speed command summary
Bernd Edlinger [Thu, 22 Aug 2019 12:28:23 +0000 (14:28 +0200)]
Add CPU info to the speed command summary

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9669)

15 months agoDiverse ERR fixes
Richard Levitte [Sun, 1 Sep 2019 08:58:19 +0000 (10:58 +0200)]
Diverse ERR fixes

1.  There are still references to the removed ERR_put_func_error().
2.  ERR_put_error() is deprecated as off version 3.0, so should
    ERR_PUT_error().
3.  'no-err' didn't affect what was passed to ERR_set_debug().

Fixes #9522

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9747)

15 months agoRework the documentation of our individual MAC implementations
Richard Levitte [Wed, 28 Aug 2019 07:13:21 +0000 (09:13 +0200)]
Rework the documentation of our individual MAC implementations

We now describe parameters instead of controls.

Also, since macros like EVP_MAC_CMAC do not exist any more, we rename
the pod files from EVP_MAC_{algo}.pod to EVP_MAC-{algo}.pod.  This
allows getting the documentation like this:

    man EVP_MAC CMAC

[skip ci]
Fixes #9709

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9713)

15 months agoFix function name typo in MAC documentation.
Pauli [Mon, 2 Sep 2019 04:09:37 +0000 (14:09 +1000)]
Fix function name typo in MAC documentation.

A spurious CTX crept into one of the function names.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9750)

15 months agoRemove extern declarations of OPENSSL_ia32cap_P
Bernd Edlinger [Sat, 24 Aug 2019 09:28:19 +0000 (11:28 +0200)]
Remove extern declarations of OPENSSL_ia32cap_P

Use the header file internal/cryptlib.h instead.
Remove checks for OPENSSL_NO_ASM and I386_ONLY
in cryptlib.c, to match the checks in other
places where OPENSSL_ia32cap_P is used and
assumed to be initialized.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/9688)

15 months agoFix platform specific issues with provider ciphers
Shane Lontis [Tue, 27 Aug 2019 09:22:42 +0000 (19:22 +1000)]
Fix platform specific issues with provider ciphers

s390_aes naming issues with ofb128 and cfb128
Solaris missing include for camellia.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9702)

15 months agoFix pkeyutl -verifyrecover
Matt Caswell [Thu, 29 Aug 2019 16:15:16 +0000 (17:15 +0100)]
Fix pkeyutl -verifyrecover

When performing a pkeyutl -verifyrecover operation the input file is not
a hash - it is the signature itself. Therefore don't do the check to make
sure it looks like a hash.

Fixes #9658

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9731)