aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Kill off the quite vestigal pubkey_enums header. Move most of the codelloyd2012-03-2811-60/+59
| | | | | | | to key_constraints.{h,cpp} in cert/x509. Move the X509_Encoding enum to x509_key.h Constify argument to X509_Object::check_signature, accidental ommision
* Pass a class to the validation function that represents anylloyd2012-03-284-186/+292
| | | | | | | | | | | | | | restrictions on the validation process. Currently these are if revocation information (CRL or hypothetically OCSP) is required, and what hashes to trust. Default trusted hashes are SHA-1 and SHA-2. This will also be used for policy restrictions, likely other things. The result enum is now a member of Path_Validation_Result Remove the usage restrictions enum. It is easier, for applications that actually care about one of these, to just check the extended constraint attribute on the final result, if everything else validates.
* propagate from branch 'net.randombit.botan' (head ↵lloyd2012-03-2838-945/+500
|\ | | | | | | | | | | 0d0f3fba72f3300bc995c79124a75a4fc0b83879) to branch 'net.randombit.botan.x509-path-validation' (head 48d03e596f032c0c69d691dbf49a2a1415b348c3)
| * All of the X509 modules were actually mutually dependent. Ideally thislloyd2012-02-0631-82/+75
| | | | | | | | | | would be fixed but it's quite hard to do, makes more sense for now to merge then back into one big x509 blog.
| * Fully working path validation. Even fixes the cases in PKITS where welloyd2012-02-0617-130/+351
| | | | | | | | | | got the answer wrong before. Still no policy or name constraints support, though.
| * propagate from branch 'net.randombit.botan' (head ↵lloyd2012-02-039-814/+155
| |\ | | | | | | | | | | | | | | | 78a772f3855abc89c3eed2fe8735e8438463399c) to branch 'net.randombit.botan.x509-path-validation' (head 9e678a8bc141087439a1238783006e9892a98450)
| | * propagate from branch 'net.randombit.botan' (head ↵lloyd2011-04-229-812/+153
| | |\ | | | | | | | | | | | | | | | | | | | | 8efb138f9a7c0b02429372a9c4e4f6614c5a6b87) to branch 'net.randombit.botan.x509-path-validation' (head af3daa43e17054ae367c02de09f77ab9e5f8136f)
| | | * Some changes circa Feb 22lloyd2011-04-225-729/+68
| | | |
| | | * propagate from branch 'net.randombit.botan' (head ↵lloyd2011-02-2221-49/+719
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | 8453f801979d78b448a2aff80d2042715a42e843) to branch 'net.randombit.botan.x509-path-validation' (head 084e8139f4b131b5aab6b6359e59324d7681488f)
| | | * \ propagate from branch 'net.randombit.botan' (head ↵lloyd2011-02-14179-4790/+13148
| | | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a4ea4629f9caa98bd72b87de6050d9e52190d09a) to branch 'net.randombit.botan.x509-path-validation' (head 6217561bf05ef77a49ab2ebe39f16bf7133a005a)
| | | * | | New branch for splitting up path validation vs certificate storagelloyd2010-11-014-5/+7
| | | | | |
* | | | | | Don't require a <source> entry in info.txt, if not set use *.cpplloyd2012-03-161-11/+13
| | | | | |
* | | | | | In Python 3 subprocess returns bytes instead of strings. We canlloyd2012-03-141-8/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | convert using bytes.decode, but that's not available in Python 2.5 and there doesn't seem to be a good way to test for it at runtime. Instead use a slight hack of calling subprocess with universal_newlines=True, which causes Py3k subprocess to assume the output is UTF-8 and decode accordingly (this should be fine in these cases since monotone will output a hex string and GCC will just output a version number). On Python 2 it's mostly ignored (especially as we call strip on the result anyway).
* | | | | | Typo in commentlloyd2012-03-091-1/+1
| | | | | |
* | | | | | Allow the semi-standard but rarely used 1.3.132.1.12 OID for ECDH keyslloyd2012-02-211-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on decoding by default, and add a comment showing how to enable it for encoding.
* | | | | | The benchmark examples ran very slowly because they were passinglloyd2012-02-204-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 16*1024 to an argument that treated those values as KiB, it took the RNG ~3 seconds to create 16 MiB of data to randomize the input. Change to 16. Also cap the value that can be passed to --buf-size to 1024, for a 1 MiB buffer.
* | | | | | Avoid blocking more than 100 ms in the random device reader. Scale uplloyd2012-02-202-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | how much we ask for on the basis of how many bits we're counting each byte as contributing. Change /dev/*random estimate to 7 bits per byte. Small cleanup in HMAC_RNG.
* | | | | | Avoid having more than one directory open at a time by just keeping alloyd2012-02-201-28/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | list of directory names (without the open DIRs) plus the one currently active dir.
* | | | | | Be more conservative about entropy estimates. In particular, insteadlloyd2012-02-175-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of giving /dev/random, EGD, and CryptoAPI a full 8 bits per byte of entropy, estimate at 6 bits. In the proc walker, allow more files to be read, read more of any particular file, and count each bit for 1/10 as much as before. Reading more of the file seems especially valuable, as some files are quite random, whereas others are very static, and this should ensure we read more of the actually unpredictable inputs. Prefer /dev/random over /dev/urandom
* | | | | | Force a reseed in HMAC_RNG after 20 bytes have been added, rather thanlloyd2012-02-151-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | waiting for a full kilobyte. This is for the benefit of DSA/ECDSA which want a call to add_entropy to update the state in some way, passing just a hash input which might be as small as 20 bytes.
* | | | | | Support ECDH key creation in the key factory function. Patch from Seanlloyd2012-02-031-0/+14
|/ / / / / | | | | | | | | | | | | | | | Cassidy, sent to the mailing list.
* | | | | Whitespacelloyd2012-02-022-4/+3
| | | | |
* | | | | Disable this version of the SSL code by defaultlloyd2012-02-012-2/+10
| | | | |
* | | | | Remove debug printfs, stdio includeslloyd2012-01-303-11/+0
| | | | |
* | | | | Pointer writing seems cleanerlloyd2012-01-302-102/+102
| | | | |
* | | | | Partially de-unroll the loop to make changes easierlloyd2012-01-301-86/+41
| | | | |
* | | | | Add a slow but functional implementation of Camellialloyd2012-01-287-1/+428
| | | | |
* | | | | Fix lib suffixlloyd2012-01-252-3/+9
| | | | |
* | | | | Fix -Wreorder warninglloyd2012-01-251-1/+1
| | | | |
* | | | | Use initializer list, make destructor virtuallloyd2012-01-061-2/+2
| | | | |
* | | | | Remove the autheticator generation from the SRP code as it's not usedlloyd2011-12-314-52/+143
| | | | | | | | | | | | | | | | | | | | | | | | | by TLS (relies on the finished message check). Add a class for reading files created by GnuTLS's srptool.
* | | | | A bad decrypt on a TLS 1.0/1.1 message would cause a mostly infinitelloyd2011-12-311-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | loop (size_t overflow), likely causing a segfault. Not exploitable as far as I can tell, beyond the obvious crashing.
* | | | | Dirty hack to support multiple 'define' options in a module info file.lloyd2011-12-231-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the default value is a list we will append to it instead of overwriting it. (Previouly, multiple define targets 'worked' with last one winning as the values were progressively overwritten). This might be useful for other things, compiler warning options maybe?
* | | | | Add code point for the SRP identifier extension and add a check for itlloyd2011-12-173-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | in the Client_Hello parser. Works, tested with GnuTLS command line client.
* | | | | Initial run at an SRP-6a implementation. Not entirely sure about thelloyd2011-12-175-0/+291
| | | | | | | | | | | | | | | | | | | | | | | | | interface but it's a plausible start. Will probably have more insights after adding TLS hooks.
* | | | | Add the 2048 bit SRP group from RFC 5054lloyd2011-12-171-0/+15
| | | | |
* | | | | Basic instructions for building the docslloyd2011-12-171-5/+17
| | | | |
* | | | | Make this exception somewhat more understandable. I think.lloyd2011-12-171-1/+1
| | | | |
* | | | | Add TCHead to list of userslloyd2011-12-171-0/+3
| | | | |
* | | | | Use LoadLibraryA instead of bare LoadLibrary so things work if used inlloyd2011-12-131-1/+1
| | | | | | | | | | | | | | | | | | | | an amalgamation and the app is compiled in Unicode mode.
* | | | | Fix readme URLslloyd2011-12-081-4/+4
| | | | |
* | | | | Fix PR 166lloyd2011-12-081-5/+9
| | | | |
* | | | | Add basic NaCl targetlloyd2011-12-082-0/+6
| | | | |
* | | | | Warn the user if targetting for GCC on Windows without an explicitlloyd2011-12-022-9/+17
| | | | | | | | | | | | | | | | | | | | | | | | | --os=windows since likely they actually wanted either --os=cygwin or --os=mingw
* | | | | LoadLibrary apparently works on MinGWlloyd2011-12-021-0/+1
| | | | |
* | | | | GCC doesn't like casting a function pointer to void* without anlloyd2011-12-022-1/+4
| | | | | | | | | | | | | | | | | | | | explicit cast.
* | | | | Add AltiVec detection on OpenBSD, contributed by Brad Smith in PR 162lloyd2011-11-282-1/+17
| | | | |
* | | | | Fix PGP key linklloyd2011-11-281-1/+1
| | | | |
* | | | | Fix link, and use sphinx to generatelloyd2011-11-281-3/+2
| | | | |
* | | | | Call cpuid via inline asm on x86-64, so we can use it with Clang (nolloyd2011-11-181-2/+16
| | | | | | | | | | | | | | | | | | | | cpuid intrinsic) and older GCC (no cpuid.h before 4.3)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 06:53:09 +0000