| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
| |
PasswordHash::from_configuration has bee replace with with PasswordHash::from_params.
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
See #1822
|
| |
|
| |
|
| |
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This makes the meaning and usage more clear.
Add a specific error type so invalid tags can be distinguished without
having to catch that specific type.
See also #1813
|
| | |
|
| | |
|
|/ |
|
|
|
|
|
|
|
|
|
| |
Boost doesn't buy us anything here since we need to maintain
Win32 and POSIX implementations for non-Boost builds, and Boost
only supports those two APIs anyway.
MSVC's implementation of std::filesystem does not help for similar
reasons, as we have to maintain a Win32 version for MinGW.
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As described in #602, using mmap with fork causes problems because
the mmap remains shared in the child instead of being copy-on-write,
then the parent and child stomp on each others memory.
However we really do not need mmap semantics, we just want a block of
memory that is page-aligned, which can be done with posix_memalign
instead. This was added in POSIX.1-2001 and seems to be implemented by
all modern systems.
Closes #602
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the long ago when I wrote the Barrett code I must have missed that
Barrett works for any input < 2^2k where k is the word size of the
modulus. Fixing this has several nice effects, it is faster because it
replaces a multiprecision comparison with a single size_t compare, and
now the branch does not reveal information about the input or modulus,
but only their word lengths, which is not considered sensitive.
Fixing this allows reverting the change make in a57ce5a4fd2 and now
RSA signing is even slightly faster than in 2.8, rather than 30% slower.
|
| |
|
|
|
|
|
|
| |
Using the Montgomery ladder for operator* was introduced in ca155a7e54, previous
versions did something different, which was itself vulnerable to side channels,
but not with the same issue as CVE-2018-20187.
|
|
|
|
|
|
|
|
|
|
|
| |
As doing so means that information about the high bits of the scalar can leak
via timing since the loop bound depends on the length of the scalar. An attacker
who has such information can perform a more efficient brute force attack (using
Pollard's rho) than would be possible otherwise.
Found by Ján Jančár (@J08nY) using ECTester (https://github.com/crocs-muni/ECTester)
CVE-2018-20187
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
explicit_bzero/explicit_memset since quite a time.
getentropy exists for FreeBSD, but only from 12.x.
|
| |
|
| |
|
|
|
|
|
| |
This is kind of implicit by the deprecation of CBC ciphersuites
but should be called out more clearly.
|
|
|
|
| |
See GH #1721 and #1718
|
| |
|
|
|
|
| |
Diagnosed by Sphinx 1.8.0
|
| |
|
|
|
|
|
| |
Originally written by Jeffrey Walton for Crypto++, which was in turn
based on my SSE2 ChaCha.
|
|
|
|
|
|
|
| |
Add tests from NIST that demonstrate the problem, as well as OpenSSL
generated tests for all input sizes 16...128 bytes.
Fixes GH #1706
|
|
|
|
|
|
|
|
|
| |
commas.
Examples:
./configure.py --enable-modules=
./configure.py --enable-modules=zlib,openssl,
./configure.py --enable-modules=zlib,,bzip2,
|
| |
|
|
|
|
|
| |
This allows things to mostly work out of the box (#1702), and
allows us to write Emscripten specific code where required.
|
|
|
|
| |
Closes GH #1557
|
| |
|
| |
|