1. 09 11月, 2016 6 次提交
  2. 08 11月, 2016 8 次提交
    • M
    • R
      INSTALL: small typo · b77b6127
      Richard Levitte 提交于
      libssl, not libddl.
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/1871)
      b77b6127
    • F
      Allow null in X509_CRL_METHOD_free · 7cb1ecec
      FdaSilvaYY 提交于
      and fix documentation.
      Reviewed-by: NTim Hudson <tjh@openssl.org>
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/1634)
      7cb1ecec
    • A
      Improve PRF documentation · 27ed73a9
      Andrea Grandi 提交于
      Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      
      GH: #1834
      27ed73a9
    • D
      Improve RSA test coverage. · f3205557
      David Benjamin 提交于
      MD5/SHA1 and MDC-2 have special-case logic beyond the generic DigestInfo
      wrapping. Test that each of these works, including hash and length
      mismatches (both input and signature). Also add VerifyRecover tests. It
      appears 5824cc29 added support for
      VerifyRecover, but forgot to add the test data.
      Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      
      GH: #1474
      f3205557
    • D
      Make RSA_sign.pod less confusing. · aa90ca11
      David Benjamin 提交于
      PKCS #1 v2.0 is the name of a document which specifies an algorithm
      RSASSA-PKCS1-v1_5, often referred to as "PKCS #1 v1.5" after an earlier
      document which specified it. This gets further confusing because the
      document PKCS #1 v2.1 specifies two signature algorithms,
      RSASSA-PKCS1-v1_5 and RSASSA-PSS. RSA_sign implements RSASSA-PKCS1-v1_5.
      
      Refer to the document using the RFC number which is easier to find
      anyway, and refer to the algorithm by its name.
      Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      
      GH: #1474
      aa90ca11
    • D
      Implement RSASSA-PKCS1-v1_5 as specified. · 608a0264
      David Benjamin 提交于
      RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode
      the DigestInfo struct and then compare the result against the public key
      operation result. This implies that one and only one encoding is legal.
      
      OpenSSL instead parses with crypto/asn1, then checks that the encoding
      round-trips, and allows some variations for the parameter. Sufficient
      laxness in this area can allow signature forgeries, as described in
      https://www.imperialviolet.org/2014/09/26/pkcs1.html
      
      Although there aren't known attacks against OpenSSL's current scheme,
      this change makes OpenSSL implement the algorithm as specified. This
      avoids the uncertainty and, more importantly, helps grow a healthy
      ecosystem. Laxness beyond the spec, particularly in implementations
      which enjoy wide use, risks harm to the ecosystem for all. A signature
      producer which only tests against OpenSSL may not notice bugs and
      accidentally become widely deployed. Thus implementations have a
      responsibility to honor the specification as tightly as is practical.
      
      In some cases, the damage is permanent and the spec deviation and
      security risk becomes a tax all implementors must forever pay, but not
      here. Both BoringSSL and Go successfully implemented and deployed
      RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so
      this change should be compatible enough to pin down in future OpenSSL
      releases.
      
      See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00
      
      As a bonus, by not having to deal with sign/verify differences, this
      version is also somewhat clearer. It also more consistently enforces
      digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath
      wasn't quite doing this right.
      Reviewed-by: NKurt Roeckx <kurt@roeckx.be>
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      
      GH: #1474
      608a0264
    • M
      Partial revert of "Fix client verify mode to check SSL_VERIFY_PEER" · c8e2f98c
      Matt Caswell 提交于
      This partially reverts commit c636c1c4. It also tweaks the documentation
      and comments in this area. On the client side the documented interface for
      SSL_CTX_set_verify()/SSL_set_verify() is that setting the flag
      SSL_VERIFY_PEER causes verfication of the server certificate to take place.
      Previously what was implemented was that if *any* flag was set then
      verification would take place. The above commit improved the semantics to
      be as per the documented interface.
      
      However, we have had a report of at least one application where an
      application was incorrectly using the interface and used *only*
      SSL_VERIFY_FAIL_IF_NO_PEER_CERT on the client side. In OpenSSL prior to
      the above commit this still caused verification of the server certificate
      to take place. After this commit the application silently failed to verify
      the server certificate.
      
      Ideally SSL_CTX_set_verify()/SSL_set_verify() could be modified to indicate
      if invalid flags were being used. However these are void functions!
      
      The simplest short term solution is to revert to the previous behaviour
      which at least means we "fail closed" rather than "fail open".
      
      Thanks to Cory Benfield for reporting this issue.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      c8e2f98c
  3. 07 11月, 2016 9 次提交
  4. 05 11月, 2016 2 次提交
  5. 04 11月, 2016 15 次提交