1. 09 9月, 2019 7 次提交
    • B
      [test] ECC: check the bounds for auto computing cofactor · 73a683b7
      Billy Brumley 提交于
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/9821)
      
      (cherry picked from commit 1d3cd983f56e0a580ee4216692ee3c9c7bf14de9)
      73a683b7
    • B
      Fix build with VS2008 · 827eab4c
      Bernd Edlinger 提交于
      crypto/rand/rand_win.c(70) : error C2065: 'BCRYPT_USE_SYSTEM_PREFERRED_RNG' : undeclared identifier
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9827)
      
      (cherry picked from commit d3a1128bc25ec8bf835c81821e1be68fba39ab4b)
      827eab4c
    • B
      Use BN_clear_free in DH_set0_key · 4bf9781a
      Bernd Edlinger 提交于
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/9796)
      
      (cherry picked from commit fa01370f7dc8f0a379483bbe74de11225857e5fe)
      4bf9781a
    • B
      DH_check_pub_key_ex was accidentally calling DH_check, · 8003138f
      Bernd Edlinger 提交于
      so results were undefined.
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/9796)
      
      (cherry picked from commit 2b95e8efcf8b99892106070d9ac745a0a369f503)
      8003138f
    • B
      Change DH_generate_parameters back to order 2q subgroup · 1f9dc86b
      Bernd Edlinger 提交于
      For for G=2 and 5 DH_generate_parameters will continue to generate
      the order 2q subgroup for compatibility with previous versions.
      
      For G=3 DH_generate_parameters generates an order q subgroup, but it
      will not pass the check in DH_check with previous OpenSSL versions.
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9820)
      1f9dc86b
    • N
      Fix spacing nit in test/ectest.c · 288241b6
      Nicola Tuveri 提交于
      (cherry picked from commit 65936a56461fe09e8c81bca45122af5adcfabb00)
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9813)
      288241b6
    • N
      [ec] Match built-in curves on EC_GROUP_new_from_ecparameters · 9a43a733
      Nicola Tuveri 提交于
      Description
      -----------
      
      Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any
      of the built-in curves. If that is the case, return a new
      `EC_GROUP_new_by_curve_name()` object instead of the explicit parameters
      `EC_GROUP`.
      
      This affects all users of `EC_GROUP_new_from_ecparameters()`:
      - direct calls to `EC_GROUP_new_from_ecparameters()`
      - direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit
        parameters argument
      - ASN.1 parsing of explicit parameters keys (as it eventually
        ends up calling `EC_GROUP_new_from_ecpkparameters()`)
      
      A parsed explicit parameter key will still be marked with the
      `OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless
      programmatically forced otherwise, if the key is eventually serialized
      the output will still be encoded with explicit parameters, even if
      internally it is treated as a named curve `EC_GROUP`.
      
      Before this change, creating any `EC_GROUP` object using
      `EC_GROUP_new_from_ecparameters()`, yielded an object associated with
      the default generic `EC_METHOD`, but this was never guaranteed in the
      documentation.
      After this commit, users of the library that intentionally want to
      create an `EC_GROUP` object using a specific `EC_METHOD` can still
      explicitly call `EC_GROUP_new(foo_method)` and then manually set the
      curve parameters using `EC_GROUP_set_*()`.
      
      Motivation
      ----------
      
      This has obvious performance benefits for the built-in curves with
      specialized `EC_METHOD`s and subtle but important security benefits:
      - the specialized methods have better security hardening than the
        generic implementations
      - optional fields in the parameter encoding, like the `cofactor`, cannot
        be leveraged by an attacker to force execution of the less secure
        code-paths for single point scalar multiplication
      - in general, this leads to reducing the attack surface
      
      Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth
      analysis of the issues related to this commit.
      
      It should be noted that `libssl` does not allow to negotiate explicit
      parameters (as per RFC 8422), so it is not directly affected by the
      consequences of using explicit parameters that this commit fixes.
      On the other hand, we detected external applications and users in the
      wild that use explicit parameters by default (and sometimes using 0 as
      the cofactor value, which is technically not a valid value per the
      specification, but is tolerated by parsers for wider compatibility given
      that the field is optional).
      These external users of `libcrypto` are exposed to these vulnerabilities
      and their security will benefit from this commit.
      
      Related commits
      ---------------
      
      While this commit is beneficial for users using built-in curves and
      explicit parameters encoding for serialized keys, commit
      b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the
      1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the
      invalid cofactor values more in general also for other curves
      (CVE-2019-1547).
      
      The following list covers commits in `master` that are related to the
      vulnerabilities presented in the manuscript motivating this commit:
      
      - d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too
      - 311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
      - b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
      - 724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats
      
      Note that the PRs that contributed the listed commits also include other
      commits providing related testing and documentation, in addition to
      links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and
      1.1.1 branches.
      
      This commit includes a partial backport of
      https://github.com/openssl/openssl/pull/8555
      (commit 8402cd5f75f8c2f60d8bd39775b24b03dd8b3b38)
      for which the main author is Shane Lontis.
      
      Responsible Disclosure
      ----------------------
      
      This and the other issues presented in https://arxiv.org/abs/1909.01785
      were reported by Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri,
      Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the
      NISEC group at Tampere University, FINLAND.
      
      The OpenSSL Security Team evaluated the security risk for this
      vulnerability as low, and encouraged to propose fixes using public Pull
      Requests.
      
      _______________________________________________________________________________
      Co-authored-by: NShane Lontis <shane.lontis@oracle.com>
      
      (Backport from https://github.com/openssl/openssl/pull/9808)
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9809)
      9a43a733
  2. 08 9月, 2019 1 次提交
  3. 07 9月, 2019 11 次提交
  4. 06 9月, 2019 4 次提交
  5. 05 9月, 2019 3 次提交
  6. 04 9月, 2019 4 次提交
  7. 30 8月, 2019 3 次提交
  8. 27 8月, 2019 1 次提交
  9. 24 8月, 2019 2 次提交
  10. 22 8月, 2019 1 次提交
    • R
      openssl dgst, openssl enc: check for end of input · 8be96f23
      Richard Levitte 提交于
      The input reading loop in 'openssl dgst' and 'openssl enc' doesn't
      check for end of input, and because of the way BIO works, it thereby
      won't detect that the end is reached before the read is an error.
      With the FILE BIO, an error occurs when trying to read past EOF, which
      is fairly much ok, except when the command is used interactively, at
      least on Unix.  The result in that case is that the user has to press
      Ctrl-D twice for the command to terminate.
      
      The issue is further complicated because both these commands use
      filter BIOs on top of the FILE BIO, so a naïve attempt to check
      BIO_eof() doesn't quite solve it, since that only checks the state of
      the source/sink BIO, and the filter BIO may have some buffered data
      that still needs to be read.  Fortunately, there's BIO_pending() that
      checks exactly that, if any filter BIO has pending data that needs to
      be processed.
      
      We end up having to check both BIO_pending() and BIO_eof().
      
      Thanks to Zsigmond Lőrinczy for the initial effort and inspiration.
      
      Fixes #9355
      Reviewed-by: NTomas Mraz <tmraz@fedoraproject.org>
      (Merged from https://github.com/openssl/openssl/pull/9668)
      
      (cherry picked from commit 8ed7bbb411d2a9e0edef928958ad955e0be3d6dd)
      8be96f23
  11. 20 8月, 2019 2 次提交
    • J
      Correct documented return value for BIO_get_mem_data() · 378d53ec
      Johannes 提交于
      CLA: trivial
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      Reviewed-by: NTomas Mraz <tmraz@fedoraproject.org>
      (Merged from https://github.com/openssl/openssl/pull/9643)
      
      (cherry picked from commit 797a5b7af9d9bbfbcbff4607c10ad5c5595ac785)
      378d53ec
    • P
      Start up DEVRANDOM entropy improvement for older Linux devices. · 3ff98f55
      Pauli 提交于
      Improve handling of low entropy at start up from /dev/urandom by waiting for
      a read(2) call on /dev/random to succeed.  Once one such call has succeeded,
      a shared memory segment is created and persisted as an indicator to other
      processes that /dev/urandom is properly seeded.
      
      This does not fully prevent against attacks weakening the entropy source.
      An attacker who has control of the machine early in its boot sequence
      could create the shared memory segment preventing detection of low entropy
      conditions.  However, this is no worse than the current situation.
      
      An attacker would also be capable of removing the shared memory segment
      and causing seeding to reoccur resulting in a denial of service attack.
      This is partially mitigated by keeping the shared memory alive for the
      duration of the process's existence.  Thus, an attacker would not only need
      to have called call shmctl(2) with the IPC_RMID command but the system
      must subsequently enter a state where no instances of libcrypto exist in
      any process.  Even one long running process will prevent this attack.
      
      The System V shared memory calls used here go back at least as far as
      Linux kernel 2.0.  Linux kernels 4.8 and later, don't have a reliable way
      to detect that /dev/urandom has been properly seeded, so a failure is raised
      for this case (i.e. the getentropy(2) call has already failed).
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9595)
      
      [manual merge]
      3ff98f55
  12. 19 8月, 2019 1 次提交