1. 28 9月, 2019 3 次提交
    • D
      Fix header file include guard names · fbbfd128
      Dr. Matthias St. Pierre 提交于
      Make the include guards consistent by renaming them systematically according
      to the naming conventions below
      
      The public header files (in the 'include/openssl' directory) are not changed
      in 1.1.1, because it is a stable release.
      
      For the private header files files, the guard names try to match the path
      specified in the include directives, with all letters converted to upper case
      and '/' and '.' replaced by '_'. An extra 'OSSL_' is added as prefix.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9681)
      fbbfd128
    • D
      Reorganize local header files · b5acbf91
      Dr. Matthias St. Pierre 提交于
      Apart from public and internal header files, there is a third type called
      local header files, which are located next to source files in the source
      directory. Currently, they have different suffixes like
      
        '*_lcl.h', '*_local.h', or '*_int.h'
      
      This commit changes the different suffixes to '*_local.h' uniformly.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9681)
      b5acbf91
    • D
      Reorganize private crypto header files · 0c994d54
      Dr. Matthias St. Pierre 提交于
      Currently, there are two different directories which contain internal
      header files of libcrypto which are meant to be shared internally:
      
      While header files in 'include/internal' are intended to be shared
      between libcrypto and libssl, the files in 'crypto/include/internal'
      are intended to be shared inside libcrypto only.
      
      To make things complicated, the include search path is set up in such
      a way that the directive #include "internal/file.h" could refer to
      a file in either of these two directoroes. This makes it necessary
      in some cases to add a '_int.h' suffix to some files to resolve this
      ambiguity:
      
        #include "internal/file.h"      # located in 'include/internal'
        #include "internal/file_int.h"  # located in 'crypto/include/internal'
      
      This commit moves the private crypto headers from
      
        'crypto/include/internal'  to  'include/crypto'
      
      As a result, the include directives become unambiguous
      
        #include "internal/file.h"       # located in 'include/internal'
        #include "crypto/file.h"         # located in 'include/crypto'
      
      hence the superfluous '_int.h' suffixes can be stripped.
      
      The files 'store_int.h' and 'store.h' need to be treated specially;
      they are joined into a single file.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9681)
      0c994d54
  2. 21 9月, 2019 1 次提交
  3. 17 9月, 2019 1 次提交
  4. 16 9月, 2019 1 次提交
  5. 13 9月, 2019 1 次提交
  6. 12 9月, 2019 1 次提交
  7. 11 9月, 2019 2 次提交
  8. 10 9月, 2019 7 次提交
  9. 09 9月, 2019 5 次提交
    • B
      Fix build with VS2008 · 827eab4c
      Bernd Edlinger 提交于
      crypto/rand/rand_win.c(70) : error C2065: 'BCRYPT_USE_SYSTEM_PREFERRED_RNG' : undeclared identifier
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9827)
      
      (cherry picked from commit d3a1128bc25ec8bf835c81821e1be68fba39ab4b)
      827eab4c
    • B
      Use BN_clear_free in DH_set0_key · 4bf9781a
      Bernd Edlinger 提交于
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/9796)
      
      (cherry picked from commit fa01370f7dc8f0a379483bbe74de11225857e5fe)
      4bf9781a
    • B
      DH_check_pub_key_ex was accidentally calling DH_check, · 8003138f
      Bernd Edlinger 提交于
      so results were undefined.
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/9796)
      
      (cherry picked from commit 2b95e8efcf8b99892106070d9ac745a0a369f503)
      8003138f
    • B
      Change DH_generate_parameters back to order 2q subgroup · 1f9dc86b
      Bernd Edlinger 提交于
      For for G=2 and 5 DH_generate_parameters will continue to generate
      the order 2q subgroup for compatibility with previous versions.
      
      For G=3 DH_generate_parameters generates an order q subgroup, but it
      will not pass the check in DH_check with previous OpenSSL versions.
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9820)
      1f9dc86b
    • N
      [ec] Match built-in curves on EC_GROUP_new_from_ecparameters · 9a43a733
      Nicola Tuveri 提交于
      Description
      -----------
      
      Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any
      of the built-in curves. If that is the case, return a new
      `EC_GROUP_new_by_curve_name()` object instead of the explicit parameters
      `EC_GROUP`.
      
      This affects all users of `EC_GROUP_new_from_ecparameters()`:
      - direct calls to `EC_GROUP_new_from_ecparameters()`
      - direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit
        parameters argument
      - ASN.1 parsing of explicit parameters keys (as it eventually
        ends up calling `EC_GROUP_new_from_ecpkparameters()`)
      
      A parsed explicit parameter key will still be marked with the
      `OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless
      programmatically forced otherwise, if the key is eventually serialized
      the output will still be encoded with explicit parameters, even if
      internally it is treated as a named curve `EC_GROUP`.
      
      Before this change, creating any `EC_GROUP` object using
      `EC_GROUP_new_from_ecparameters()`, yielded an object associated with
      the default generic `EC_METHOD`, but this was never guaranteed in the
      documentation.
      After this commit, users of the library that intentionally want to
      create an `EC_GROUP` object using a specific `EC_METHOD` can still
      explicitly call `EC_GROUP_new(foo_method)` and then manually set the
      curve parameters using `EC_GROUP_set_*()`.
      
      Motivation
      ----------
      
      This has obvious performance benefits for the built-in curves with
      specialized `EC_METHOD`s and subtle but important security benefits:
      - the specialized methods have better security hardening than the
        generic implementations
      - optional fields in the parameter encoding, like the `cofactor`, cannot
        be leveraged by an attacker to force execution of the less secure
        code-paths for single point scalar multiplication
      - in general, this leads to reducing the attack surface
      
      Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth
      analysis of the issues related to this commit.
      
      It should be noted that `libssl` does not allow to negotiate explicit
      parameters (as per RFC 8422), so it is not directly affected by the
      consequences of using explicit parameters that this commit fixes.
      On the other hand, we detected external applications and users in the
      wild that use explicit parameters by default (and sometimes using 0 as
      the cofactor value, which is technically not a valid value per the
      specification, but is tolerated by parsers for wider compatibility given
      that the field is optional).
      These external users of `libcrypto` are exposed to these vulnerabilities
      and their security will benefit from this commit.
      
      Related commits
      ---------------
      
      While this commit is beneficial for users using built-in curves and
      explicit parameters encoding for serialized keys, commit
      b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the
      1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the
      invalid cofactor values more in general also for other curves
      (CVE-2019-1547).
      
      The following list covers commits in `master` that are related to the
      vulnerabilities presented in the manuscript motivating this commit:
      
      - d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too
      - 311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
      - b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
      - 724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats
      
      Note that the PRs that contributed the listed commits also include other
      commits providing related testing and documentation, in addition to
      links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and
      1.1.1 branches.
      
      This commit includes a partial backport of
      https://github.com/openssl/openssl/pull/8555
      (commit 8402cd5f75f8c2f60d8bd39775b24b03dd8b3b38)
      for which the main author is Shane Lontis.
      
      Responsible Disclosure
      ----------------------
      
      This and the other issues presented in https://arxiv.org/abs/1909.01785
      were reported by Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri,
      Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the
      NISEC group at Tampere University, FINLAND.
      
      The OpenSSL Security Team evaluated the security risk for this
      vulnerability as low, and encouraged to propose fixes using public Pull
      Requests.
      
      _______________________________________________________________________________
      Co-authored-by: NShane Lontis <shane.lontis@oracle.com>
      
      (Backport from https://github.com/openssl/openssl/pull/9808)
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9809)
      9a43a733
  10. 07 9月, 2019 8 次提交
    • B
      Remove x86/x86_64 BSAES and AES_ASM support · 87bea655
      Bernd Edlinger 提交于
      This leaves VPAES and AESNI support.
      The VPAES performance is comparable but BSAES is not
      completely constant time. There are table lookups
      using secret key data in AES_set_encrypt/decrypt_key
      and in ctr mode short data uses the non-constant
      time AES_encrypt function instead of bit-slicing.
      Furthermore the AES_ASM is by far outperformed
      by recent GCC versions.
      Since BSAES calls back to AES_ASM for short
      data blocks the performance on those is also
      worse than the pure software implementaion.
      
      Fixes: #9640
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9675)
      87bea655
    • B
      [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it · 30c22fa8
      Billy Brumley 提交于
      The cofactor argument to EC_GROUP_set_generator is optional, and SCA
      mitigations for ECC currently use it. So the library currently falls
      back to very old SCA-vulnerable code if the cofactor is not present.
      
      This PR allows EC_GROUP_set_generator to compute the cofactor for all
      curves of cryptographic interest. Steering scalar multiplication to more
      SCA-robust code.
      
      This issue affects persisted private keys in explicit parameter form,
      where the (optional) cofactor field is zero or absent.
      
      It also affects curves not built-in to the library, but constructed
      programatically with explicit parameters, then calling
      EC_GROUP_set_generator with a nonsensical value (NULL, zero).
      
      The very old scalar multiplication code is known to be vulnerable to
      local uarch attacks, outside of the OpenSSL threat model. New results
      suggest the code path is also vulnerable to traditional wall clock
      timing attacks.
      
      CVE-2019-1547
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NTomas Mraz <tmraz@fedoraproject.org>
      Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/9781)
      30c22fa8
    • N
      [ec/ecp_nistp*.c] restyle: use {} around `else` too · ed0ac119
      Nicola Tuveri 提交于
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9511)
      
      (cherry picked from commit 4fe2ee3a449a8ca2886584e221f34ff0ef5de119)
      ed0ac119
    • N
      [ec/ecp_nistp*.c] remove flip_endian() · 61387fd3
      Nicola Tuveri 提交于
      Replace flip_endian() by using the little endian specific
      BN_bn2lebinpad() and BN_lebin2bn().
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9511)
      
      (cherry picked from commit e0b660c27d8d97b4ad9e2098cc957de26872c0ef)
      61387fd3
    • N
      Uniform BN_bn2binpad() and BN_bn2lebinpad() implementations · 2432e129
      Nicola Tuveri 提交于
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9511)
      
      (cherry picked from commit 1b338abe3abb8c73f004c34d4b8a9272b89dfd5d)
      2432e129
    • N
      Make BN_num_bits() consttime upon BN_FLG_CONSTTIME · b9a380f7
      Nicola Tuveri 提交于
      This issue was partially addressed by commit
      972c87df, which hardened its callee
      BN_num_bits_word() to avoid leaking the most-significant word of its
      argument via branching and memory access pattern.
      The commit message also reported:
      > There are a few places where BN_num_bits is called on an input where
      > the bit length is also secret. This does *not* fully resolve those
      > cases as we still only look at the top word.
      
      BN_num_bits() is called directly or indirectly (e.g., through
      BN_num_bytes() or BN_bn2binpad() ) in various parts of the `crypto/ec`
      code, notably in all the currently supported implementations of scalar
      multiplication (in the generic path through ec_scalar_mul_ladder() as
      well as in dedicated methods like ecp_nistp{224,256,521}.c and
      ecp_nistz256.c).
      
      Under the right conditions, a motivated SCA attacker could retrieve the
      secret bitlength of a secret nonce through this vulnerability,
      potentially leading, ultimately, to recover a long-term secret key.
      
      With this commit, exclusively for BIGNUMs that are flagged with
      BN_FLG_CONSTTIME, instead of accessing only bn->top, all the limbs of
      the BIGNUM are accessed up to bn->dmax and bitwise masking is used to
      avoid branching.
      
      Memory access pattern still leaks bn->dmax, the size of the lazily
      allocated buffer for representing the BIGNUM, which is inevitable with
      the current BIGNUM architecture: reading past bn->dmax would be an
      out-of-bound read.
      As such, it's the caller responsibility to ensure that bn->dmax does not
      leak secret information, by explicitly expanding the internal BIGNUM
      buffer to a public value sufficient to avoid any lazy reallocation
      while manipulating it: this should be already done at the top level
      alongside setting the BN_FLG_CONSTTIME.
      
      Thanks to David Schrammel and Samuel Weiser for reporting this issue
      through responsible disclosure.
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9511)
      
      (cherry picked from commit 8b44198b916015f77bef1befa26edb48ad8a0238)
      b9a380f7
    • N
      Fix a SCA leak using BN_bn2bin() · 083f297a
      Nicola Tuveri 提交于
      BN_bn2bin() is not constant-time and leaks the number of bits in the
      processed BIGNUM.
      
      The specialized methods in ecp_nistp224.c, ecp_nistp256.c and
      ecp_nistp521.c internally used BN_bn2bin() to convert scalars into the
      internal fixed length representation.
      
      This can leak during ECDSA/ECDH key generation or handling the nonce
      while generating an ECDSA signature, when using these implementations.
      The amount and risk of leaked information useful for a SCA attack
      varies for each of the three curves, as it depends mainly on the
      ratio between the bitlength of the curve subgroup order (governing the
      size of the secret nonce/key) and the limb size for the internal BIGNUM
      representation (which depends on the compilation target architecture).
      
      To fix this, we replace BN_bn2bin() with BN_bn2binpad(), bounding the
      output length to the width of the internal representation buffer: this
      length is public.
      
      Internally the final implementation of both BN_bn2binpad() and
      BN_bn2bin() already has masking in place to avoid leaking bn->top
      through memory access patterns.
      Memory access pattern still leaks bn->dmax, the size of the lazily
      allocated buffer for representing the BIGNUM, which is inevitable with
      the current BIGNUM architecture: reading past bn->dmax would be an
      out-of-bound read.
      As such, it's the caller responsibility to ensure that bn->dmax does not
      leak secret information, by explicitly expanding the internal BIGNUM
      buffer to a public value sufficient to avoid any lazy reallocation
      while manipulating it: this is already done at the top level alongside
      setting the BN_FLG_CONSTTIME.
      
      Finally, the internal implementation of BN_bn2binpad() indirectly calls
      BN_num_bits() via BN_num_bytes(): the current implementation of
      BN_num_bits() can leak information to a SCA attacker, and is addressed
      in the next commit.
      
      Thanks to David Schrammel and Samuel Weiser for reporting this issue
      through responsible disclosure.
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9511)
      
      (cherry picked from commit 805315d3a20f7274195eed75b06c391dacf3b197)
      083f297a
    • B
      Fix a SCA leak in BN_generate_dsa_nonce · 9e1403d9
      Bernd Edlinger 提交于
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/9782)
      
      (cherry picked from commit 31ca19403d56ad71d823cf62990518dfc6905bb4)
      9e1403d9
  11. 06 9月, 2019 2 次提交
  12. 05 9月, 2019 3 次提交
  13. 30 8月, 2019 1 次提交
  14. 27 8月, 2019 1 次提交
  15. 24 8月, 2019 1 次提交
  16. 20 8月, 2019 1 次提交
    • P
      Start up DEVRANDOM entropy improvement for older Linux devices. · 3ff98f55
      Pauli 提交于
      Improve handling of low entropy at start up from /dev/urandom by waiting for
      a read(2) call on /dev/random to succeed.  Once one such call has succeeded,
      a shared memory segment is created and persisted as an indicator to other
      processes that /dev/urandom is properly seeded.
      
      This does not fully prevent against attacks weakening the entropy source.
      An attacker who has control of the machine early in its boot sequence
      could create the shared memory segment preventing detection of low entropy
      conditions.  However, this is no worse than the current situation.
      
      An attacker would also be capable of removing the shared memory segment
      and causing seeding to reoccur resulting in a denial of service attack.
      This is partially mitigated by keeping the shared memory alive for the
      duration of the process's existence.  Thus, an attacker would not only need
      to have called call shmctl(2) with the IPC_RMID command but the system
      must subsequently enter a state where no instances of libcrypto exist in
      any process.  Even one long running process will prevent this attack.
      
      The System V shared memory calls used here go back at least as far as
      Linux kernel 2.0.  Linux kernels 4.8 and later, don't have a reliable way
      to detect that /dev/urandom has been properly seeded, so a failure is raised
      for this case (i.e. the getentropy(2) call has already failed).
      Reviewed-by: NBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9595)
      
      [manual merge]
      3ff98f55
  17. 19 8月, 2019 1 次提交