aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/pubkey
Commit message (Collapse)AuthorAgeFilesLines
* Fix how DL_Group chooses generator for strong prime groups.Jack Lloyd2017-01-066-12/+28
| | | | | | | | | | | Previously it fixed g=2 but this is not always correct. GH #784 Change default PEM header for X9.42 groups to match OpenSSL. We accept either on decoding. GH #784 Change {DL_Group,EC_Group}::PEM_for_named_curve to return std::string instead of a const char*. That makes a future refactoring I have in mind possible without breaking API.
* Remove unnecessary BOTAN_DLL annotationsJack Lloyd2016-12-273-4/+4
|
* Add DL_Group testsJack Lloyd2016-12-232-6/+6
| | | | | | | | | Fix a bug in how the 6144 and 8192 IETF MODP groups were encoded; they have g and q values switched. Fixed by just switching the PEM header to match the actual encoded format. Rename DL_Group::X942_DH_PARAMETERS to ANSI_X9_42_DH_PARAMETERS to avoid a macro conflict with Windows cryptography headers (GH #482)
* Merge GH #779 Add ECDH/ECIES blinding and DH small subgroup checkingJack Lloyd2016-12-214-18/+55
|\
| * Add missing q == 0 check in DL_Scheme_PublicKey::check_key() as q may not be ↵Never2016-12-201-7/+19
| | | | | | | | available in all groups
| * Blind the ECDH/ECIES agree operation.Never2016-12-192-12/+21
| |
| * Added DH public key check y^q mod p = 1 against small-subgroup attacks as ↵Never2016-12-191-0/+2
| | | | | | | | described in rfc2785
| * Improved DL_Group verification. The group is invalid, if g^q mod p !=1 and ↵Never2016-12-191-5/+19
| | | | | | | | increased number of Miller-Rabin iterations, if strong is set (we pass 128 as prob in make_prm.cpp).
* | Convert to using standard uintN_t integer typesJack Lloyd2016-12-18100-954/+954
|/ | | | | | Renames a couple of functions for somewhat better name consistency, eg make_u32bit becomes make_uint32. The old typedefs remain for now since probably lots of application code uses them.
* Public_Key derived class ctors take an std::vector<byte>René Korthaus2016-12-1123-37/+37
| | | | | | | Changes all the Public_Key derived classes ctors to take a std::vector instead of a secure_vector for the DER encoded public key bits. There is no point in transporting a public key in secure storage. (GH #768)
* Another rename in the service of filename uniquenessJack Lloyd2016-12-081-0/+0
|
* Remove <source> block from info.txt filesJack Lloyd2016-12-083-33/+0
| | | | | | Kind of a vestigial thing from an earlier iteration of the module design, and never useful to specify anymore since taking all the cpp files is what you want exactly 100% of the time.
* Rename both DL and EC named group files.Jack Lloyd2016-12-082-0/+0
| | | | | | | Avoid having any files within src/lib (in any subdirs) with the same name. That seems worth avoiding even just on the basis of avoiding basic confusion (looked in named.cpp - no the other one...) and may allow simplifying the build in various ways.
* Add Private_Key::private_key_info()René Korthaus2016-12-0516-25/+36
| | | | | | | Adds new Private_Key::private_key_info() that returns a PKCS#8 PrivateKeyInfo structure. Renames the current Private_Key::pkcs8_private_key() to private_key_bits(). BER_encode() just invokes private_key_info().
* Add Public_Key::subject_public_key()René Korthaus2016-12-0518-29/+39
| | | | | | | Adds new Public_Key::subject_public_key() that returns a X.509 SubjectPublicKey structure. Renames the current Public_Key::x509_subject_public_key() to public_key_bits(). BER_encode() just invokes subject_public_key().
* Expose pk_ops.h as public interface againJack Lloyd2016-12-0412-11/+22
| | | | | | | | | | | | I was initially thinking of Botan as somewhat closed system, but @cordney has a legit use case of wanting to expose a TPM sign operation, but using their internal TPM library and TPM key type. This requires the API be exposed so the derivation can occur. Add a comment in the header explaining that the header is not for normal application use and directing them to pubkey.h This basically reverts 2747e8e23aec43162
* Merge GH #718 Add XMSS WOTS schemeJack Lloyd2016-11-2616-43/+563
|\
| * Adds changes from XMSS Review & resolves conflictsMatthias Gierlings2016-11-1210-120/+32
| |
| * Adds optional XMSS WOTS stand-alone componentsMatthias Gierlings2016-11-1213-8/+566
| | | | | | | | | | | | | | | | | | | | | | The main XMSS implementation does not expose stand-alone access to XMSS Winternitz One Time Signatures through the Botan::PK_Ops interfaces. XMSS WOTS is used by XMSS internally though. This PR implements a possible XMSS WOTS interface for stand-alone use. XMSS WOTS is tested through the XMSS tests, therefore there are no dedicated XMSS WOTS test vectors and test bench components implemented in this PR.
| * Added Extended Hash-Based Signatures (XMSS)Matthias Gierlings2016-11-125-3/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [1] XMSS: Extended Hash-Based Signatures, draft-itrf-cfrg-xmss-hash-based-signatures-06 Release: July 2016. https://datatracker.ietf.org/doc/ draft-irtf-cfrg-xmss-hash-based-signatures/?include_text=1 Provides XMSS_PublicKey and XMSS_PrivateKey classes as well as implementations for the Botan interfaces PK_Ops::Signature and PK_Ops::Verification. XMSS has been integrated into the Botan test bench, signature generation and verification can be tested independently by invoking "botan-test xmss_sign" and "botan-test xmss_verify" - Some headers that are not required to be exposed to users of the library have to be declared as public in `info.txt`. Declaring those headers private will cause the amalgamation build to fail. The following headers have been declared public inside `info.txt`, even though they are only intended for internal use: * atomic.h * xmss_hash.h * xmss_index_registry.h * xmss_address.h * xmss_common_ops.h * xmss_tools.h * xmss_wots_parameters.h * xmss_wots_privatekey.h * xmss_wots_publickey.h - XMSS_Verification_Operation Requires the "randomness" parameter out of the XMSS signature. "Randomness" is part of the prefix that is hashed *before* the message. Since the signature is unknown till sign() is called, all message content has to be buffered. For large messages this can be inconvenient or impossible. **Possible solution**: Change PK_Ops::Verification interface to take the signature as constructor argument, and provide a setter method to be able to update reuse the instance on multiple signatures. Make sign a parameterless member call. This solution requires interface changes in botan. **Suggested workaround** for signing large messages is to not sign the message itself, but to precompute the message hash manually using Botan::HashFunctio and sign the message hash instead of the message itself. - Some of the available test vectors for the XMSS signature verification have been commented out in order to reduce testbench runtime.
* | Correct XMSS crash when a hash was disabledJack Lloyd2016-11-254-12/+20
| | | | | | | | Require SHA-256 in XMSS since that is mandatory for the index registry.
* | Make XMSS more friendly about invalid params.Jack Lloyd2016-11-255-31/+54
| | | | | | | | | | | | Previously just throw an exception from map.at Add an XMSS keygen test, and add default params for create_private_key
* | Merge GH #736 Add SHAKE support to XMSSJack Lloyd2016-11-254-102/+94
|\ \
| * | Adds SHAKE support for XMSSMatthias Gierlings2016-11-254-102/+94
| | | | | | | | | | | | | | | | | | | | | - Enables code for shake support - Creating SHAKE hash function by name now allows to select output size of 256 Bit for SHAKE128 and 512 Bit for SHAKE256. - Adds *self-generated*, unverified test vectors for XMSS/SHAKE.
* | | Avoid having source files start with /**Jack Lloyd2016-11-2541-42/+42
|/ / | | | | | | | | | | | | This caused Doxygen to dump the copyright notices for those files into the Botan namespace description, which is not helpful. [ci skip]
* | Export work factor functionsRené Korthaus2016-11-221-4/+4
| | | | | | | | | | | | | | Now that users can implement custom PK ops via Private_Key and Public_Key outside the library, it makes very much sense to provide the work factor functions to them.
* | Fix class vs struct declaration.Jack Lloyd2016-11-191-4/+6
| | | | | | | | | | Recent Clang complains about forward decl as 'class X' when X was actually declared as a struct.
* | Merge GH #729 Add CECPQ1 (x25519+NewHope) TLS ciphersuitesJack Lloyd2016-11-198-27/+143
|\ \
| * | Add CECPQ1 TLS ciphersuitesJack Lloyd2016-11-178-27/+143
| |/ | | | | | | | | | | | | | | | | | | | | | | | | Tested against BoringSSL (as client + server) and google.com (as client). Fix a stupid crashing bug in NewHope's BoringSSL mode. Remove unneeded error return from curve25519_donna - always returned 0. Default policy prefers ChaChaPoly1305 over GCM and CECPQ1 over ECDH/DH, which means the default no-extra-configuration ciphersuite (for Botan client speaking to Botan server) is a ciphersuite which is both implemented in constant time on all platforms and (hopefully) provides post quantum security. Good Things.
* / Don't force HMAC_DRBG to be enabledJack Lloyd2016-11-182-2/+1
|/ | | | | No need to strictly require it, and some applications may only want system RNG or RDRAND.
* Remove unused Key_Type typedefsJack Lloyd2016-11-122-4/+0
| | | | [ci skip]
* Fixes for XMSS wrt 9c72dabc9Jack Lloyd2016-11-125-31/+6
|
* Merge GH #717 Add XMSS signaturesJack Lloyd2016-11-1231-0/+4057
|\
| * Implements changes from XMSS reviewMatthias Gierlings2016-11-1113-82/+18
| | | | | | | | | | | | | | | | | | - Removes custom XMSS_Hash assignment operator. - Changes mutex type used in XMSS_Index_Registryfrom std::mutex to Botan::mutex_type, changes lock_guard accordingly. - Removes singleton and endianess detection from XMSS_Tools, changes XMSS_Tools::concat() to be a static method. - XMSS/XMSS_WOTS check_key() now always returns true.
| * Added Extended Hash-Based Signatures (XMSS)Matthias Gierlings2016-11-1132-0/+4121
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [1] XMSS: Extended Hash-Based Signatures, draft-itrf-cfrg-xmss-hash-based-signatures-06 Release: July 2016. https://datatracker.ietf.org/doc/ draft-irtf-cfrg-xmss-hash-based-signatures/?include_text=1 Provides XMSS_PublicKey and XMSS_PrivateKey classes as well as implementations for the Botan interfaces PK_Ops::Signature and PK_Ops::Verification. XMSS has been integrated into the Botan test bench, signature generation and verification can be tested independently by invoking "botan-test xmss_sign" and "botan-test xmss_verify" - Some headers that are not required to be exposed to users of the library have to be declared as public in `info.txt`. Declaring those headers private will cause the amalgamation build to fail. The following headers have been declared public inside `info.txt`, even though they are only intended for internal use: * atomic.h * xmss_hash.h * xmss_index_registry.h * xmss_address.h * xmss_common_ops.h * xmss_tools.h * xmss_wots_parameters.h * xmss_wots_privatekey.h * xmss_wots_publickey.h - XMSS_Verification_Operation Requires the "randomness" parameter out of the XMSS signature. "Randomness" is part of the prefix that is hashed *before* the message. Since the signature is unknown till sign() is called, all message content has to be buffered. For large messages this can be inconvenient or impossible. **Possible solution**: Change PK_Ops::Verification interface to take the signature as constructor argument, and provide a setter method to be able to update reuse the instance on multiple signatures. Make sign a parameterless member call. This solution requires interface changes in botan. **Suggested workaround** for signing large messages is to not sign the message itself, but to precompute the message hash manually using Botan::HashFunctio and sign the message hash instead of the message itself. - Some of the available test vectors for the XMSS signature verification have been commented out in order to reduce testbench runtime.
* | Pubkey cleanupsJack Lloyd2016-11-1229-205/+119
|/ | | | | | | | | | Add Public_Key::key_length usable for policy checking (as in TLS::Policy::check_peer_key_acceptable) Remove Public_Key::max_input_bits because it didn't make much sense for most algorithms actually. Remove message_parts and message_part_size from PK_Ops
* NewHope cleanupJack Lloyd2016-11-091-63/+300
| | | | Remove old style casts, wrap some very long lines.
* Correct comment [ci skip]Jack Lloyd2016-11-081-1/+1
|
* Remove Key_Type typedefsJack Lloyd2016-11-0811-23/+0
| | | | Also part of Algo_Registry and not needed after #668
* Remove Spec typedef from pk_opsJack Lloyd2016-11-081-35/+0
| | | | Was used by Algo_Registry lookups, no longer needed after #668
* Update Doxygen comment [ci skip]Jack Lloyd2016-11-061-1/+0
|
* Merge GH #710 Allow custom EC curve to be specified at build timeJack Lloyd2016-11-041-0/+5
|\
| * Add an in-house EC curve for TLS at compile-timeRené Korthaus2016-11-031-0/+5
| | | | | | | | | | | | One additional, application-specific curve can be added at compile time, using the new configure.py --house-curve=curve.pem,funky311,1.2.3.4,FEFF.
* | Merge GH #714 Use pk_ops_fwd headerJack Lloyd2016-11-041-12/+1
|\ \
| * | use "forward declare header" pk_ops_fwd.h instead of self forward declaring themDaniel Neus2016-11-041-12/+1
| |/
* / Fix PKCS11 test errorJack Lloyd2016-11-042-12/+51
|/ | | | | | | | | | | | | | Previously PKCS11_ECDSA_PrivateKey::check_key failed because no verification is possible using this key type (does not derive from public key). Split keypair consistency to allow two key arguments. ECDSA keypair consistency disabled in the tests still, because SoftHSMv2 gives mechanism invalid errors. I think this is a SoftHSMv2 issue with the signature mechanism. Remove no longer used Key_Type typedefs (need to be removed everywhere). GH #712
* Simplify some code by using T::create_or_throwJack Lloyd2016-11-032-21/+7
|
* Merge GH #706 Remove ability to add OIDs at runtime. Remove OID lockJack Lloyd2016-11-033-3/+0
|\
| * Remove ability to add OIDS at runtime. Remove global OID lock.Jack Lloyd2016-11-033-3/+0
| | | | | | | | | | | | | | | | | | | | | | OID map is now generated from an input file on an as needed basis. Just uses a sequence of ifs - simple, fast, and small code size. Merges oid_lookup sub-module which was already required by asn1 anyway, so completely non-optional. Removes @neusdan's nice OID tests since without any runtime adds the tests are moot.
* | Remove automatic self-testing of public and private keysJack Lloyd2016-11-0316-131/+36
|/ | | | | | | | | | | | | Rarely expected and often causes performance problems, especially for private keys. Instead applications should call check_key explicitly to validate keys when necessary. Note this removal doesn't apply to tests like ECDH on-the-curve tests, where a check on the public key is required for security of our own key. Updates most APIs to remove RNG calls, where they are no longer required. Exception is PKCS8 interface, pending further work there (see GH #685) it just ignores the RNG argument now.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-14 23:03:20 +0000