aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/pubkey
Commit message (Collapse)AuthorAgeFilesLines
* s/as_string/to_string/Jack Lloyd2019-03-015-8/+8
| | | | | A few older APIs use as_string where everywhere else uses to_string. Add to_string's where missing, and deprecate X::as_string.
* Default McEliece and XMSS to SIV modeJack Lloyd2019-02-181-2/+10
|
* Fixes for minimized buildsJack Lloyd2019-02-161-3/+8
| | | | Various configurations would fail build or test, fix that.
* Avoid a harmless data race in RSA decryptionJack Lloyd2019-01-281-0/+7
| | | | | | | | | Both threads called Modular_Reducer::reduce on m, which caused the significant words result to be written twice in an unsynchronized way. By calling it once beforehand it is computed and cached and so no additional writes occur. Found with helgrind.
* Rename Integrity_Failure to Invalid_Authentication_TagJack Lloyd2019-01-188-15/+12
| | | | | | | | | This makes the meaning and usage more clear. Add a specific error type so invalid tags can be distinguished without having to catch that specific type. See also #1813
* Fix init ordering warningJack Lloyd2019-01-181-1/+1
|
* Fix some warnings from PVS-StudioJack Lloyd2019-01-176-7/+9
| | | | No real bugs, but pointed out some odd constructs and duplicated logic
* Remove trailing whitespaceJack Lloyd2019-01-131-3/+3
|
* Some cleanups in McEliece keygenJack Lloyd2019-01-031-15/+17
| | | | Lots more of this needed in here
* Add cast for MSVCJack Lloyd2019-01-031-1/+4
|
* Add VC 2019 preview buildJack Lloyd2019-01-021-0/+1
|
* Avoid const-time modulo in DSA verificationJack Lloyd2018-12-291-1/+11
| | | | | | It has a substantial perf hit and is not necessary. It may not be really necessary for signatures either but leave that as it, with a comment explaining.
* Fix Barrett reduction input boundJack Lloyd2018-12-261-8/+18
| | | | | | | | | | | | In the long ago when I wrote the Barrett code I must have missed that Barrett works for any input < 2^2k where k is the word size of the modulus. Fixing this has several nice effects, it is faster because it replaces a multiprecision comparison with a single size_t compare, and now the branch does not reveal information about the input or modulus, but only their word lengths, which is not considered sensitive. Fixing this allows reverting the change make in a57ce5a4fd2 and now RSA signing is even slightly faster than in 2.8, rather than 30% slower.
* Always use const-time modulo during DSA signingJack Lloyd2018-12-241-1/+2
| | | | | | | | | | | Since we are reducing a mod-p integer down to mod-q this would nearly always use ct_modulo in any case. And, in the case where Barrett did work, it would reveal that g^k mod p was <= q*q which would likely be useful for searching for k. This should actually be slightly faster (if anything) since it avoids the unnecessary comparison against q*q and jumps directly to ct_modulo.
* Address a side channel in RSA and SM2Jack Lloyd2018-12-242-8/+4
| | | | | | | | | | | | | | | | | Barrett will branch to a different (and slower) algorithm if the input is larger than the square of the modulus. This branch can be detected by a side channel. For RSA we need to compute m % p and m % q to get CRT started. Being able to detect if m > q*q (assuming q is the smaller prime) allows a binary search on the secret prime. This attack is blocked by input blinding, but still seems dangerous. Unfortunately changing to use the generic const time modulo instead of Barrett introduces a rather severe performance regression in RSA signing. In SM2, reduce k-r*x modulo the order before multiplying it with (x-1)^-1. Otherwise the need for slow modulo vs Barrett leaks information about k and/or x.
* Avoid using unblinded Montgomery ladder during ECC key generationJack Lloyd2018-12-182-11/+32
| | | | | | | | | | | As doing so means that information about the high bits of the scalar can leak via timing since the loop bound depends on the length of the scalar. An attacker who has such information can perform a more efficient brute force attack (using Pollard's rho) than would be possible otherwise. Found by Ján Jančár (@J08nY) using ECTester (https://github.com/crocs-muni/ECTester) CVE-2018-20187
* In PointGFp addition, prevent all_zeros from being shortcircuitedJack Lloyd2018-12-141-4/+7
| | | | | | This doesn't matter much but it causes confusing valgrind output when const-time checking since it distinguishes between the two possible conditional returns.
* Simplify the const time lookup in ECC scalar mulJack Lloyd2018-12-141-12/+9
| | | | | Code is easier to understand and it may let the CPU interleave the loads and logical ops better. Slightly faster on my machine.
* Use a 3-bit comb for ECC base point multiplyJack Lloyd2018-12-132-19/+36
| | | | Improves ECDSA signing by 15%
* Some cleanups in x25519Jack Lloyd2018-12-101-53/+43
|
* Work around a problem when built with OpenSSLJack Lloyd2018-12-101-5/+1
| | | | | | | It appears OpenSSL has a different interpretation from us of how the message representative is formed for P-521 when given a hash to sign that is larger than the group order; signatures generated by us do not verify with OpenSSL and vice versa.
* Support recovering ECDSA public key from message/signature pairJack Lloyd2018-12-102-0/+107
| | | | | | See http://www.secg.org/sec1-v2.pdf section 4.1.6 Closes #664
* Avoid doing a variable time division during Montgomery setupJack Lloyd2018-12-091-9/+14
| | | | | | Instead require the inputs be reduced already. For RSA-CRT use Barrett which is const time already. For SRP6 inputs were not reduced, use the Barrett hook available in DL_Group.
* In ECDSA cache the RFC6979 objectJack Lloyd2018-12-061-3/+3
| | | | | This is a very minor savings but does make a difference especially for P-256.
* Do swaps in PointGFp instead of copiesJack Lloyd2018-12-051-13/+12
| | | | Saves 5% for ECDSA
* Silence MSVC warningsJack Lloyd2018-12-047-108/+108
| | | | static_casts for the compiler god
* Use ct_modulo during RSA key generationJack Lloyd2018-12-031-6/+7
|
* No need to check x when checking if a point is at infinityJack Lloyd2018-12-011-2/+1
| | | | I'm not sure why this was here.
* Add BigInt::mod_mulJack Lloyd2018-12-013-27/+10
|
* Fix debug asserts, and add it to CIJack Lloyd2018-11-291-2/+2
|
* Add CT::Mask typeJack Lloyd2018-11-284-22/+21
|
* Make more BigInt functions const-timeJack Lloyd2018-11-261-0/+1
| | | | In particular comparisons, calc sig words, and mod_sub are const time now.
* Make exceptions easier to translate to error codesJack Lloyd2018-11-238-24/+28
| | | | | | | | | | | Avoid throwing base Botan::Exception type, as it is difficult to determine what the error is in that case. Add Exception::error_code and Exception::error_type which allows (for error code) more information about the error and (for error type) allows knowing the error type without requiring a sequence of catches. See GH #1742
* Avoid calling memset, memcpy within library codeJack Lloyd2018-11-172-6/+6
| | | | | | | | | Prefer using wrappers in mem_utils for this. Current exception is where memcpy is being used to convert between two different types, since copy_mem requires input and output pointers have the same type. There should be a new function to handle conversion-via-memcpy operation.
* Avoid an implausible integer overflow flagged by Coverity [ci skip]Jack Lloyd2018-11-101-1/+6
|
* Add some missing includesJack Lloyd2018-11-083-0/+4
| | | | This is not exhaustive. See GH #1733
* Compile fixJack Lloyd2018-11-071-0/+1
|
* Avoid using std::invalid_argumentJack Lloyd2018-11-071-2/+2
| | | | See #1726
* Fix compilation problem when scrypt is disabledJack Lloyd2018-10-291-0/+1
| | | | Fixes GH #1720
* Remove support for Visual C++ 2013Jack Lloyd2018-10-012-3/+1
| | | | Closes GH #1557
* Fix more MSVC warningsJack Lloyd2018-10-012-22/+22
|
* Fix some MSVC warningsJack Lloyd2018-09-301-4/+4
|
* Spell check the documentationJack Lloyd2018-09-281-7/+7
|
* Merge GH #1670 New password hashing interfaceJack Lloyd2018-09-131-20/+44
|\
| * Remove redundant operationJack Lloyd2018-09-101-4/+0
| |
| * Add from_iterationsJack Lloyd2018-09-101-9/+4
| |
| * Convert ScryptJack Lloyd2018-09-101-20/+53
| | | | | | | | | | | | | | This also changes some (library only) APIs so PBES2 needed to be modified. This is a contribution of Ribose Inc (@riboseinc)
* | Add FFI functions for creating and getting X25519 dataJack Lloyd2018-09-102-0/+4
|/ | | | See GH #1680
* Support SM2 raw signaturesJack Lloyd2018-09-091-57/+101
| | | | | | Where SM2 signs a hash input provided by the application. This is a contribution by Ribose Inc (@riboseinc)
* Remove unneeded load_on autoJack Lloyd2018-09-041-2/+0
| | | | It is the default...
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 03:55:57 +0000