| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
| |
Previously RSA and ElGamal stripped off leading zeros which were then
assumed by the padding decoders. Instead have them produce ciphertexts
with leading zeros. Changes EME_Raw to strip leading zeros to match
existing behavior.
|
|
|
|
|
| |
Performs content checks on the value (expected length, expected bytes)
and in constant time returns either the decrypted value or a random value.
|
|
|
|
|
|
|
|
|
| |
Remove support for weak ECC curves (anything under P-256) from TLS.
This includes secp256k1 since we don't take advantage of the special
form for any performance advantage; might as well use P-256.
The manual still mentioned that it was possible to use MD5 in
Policy::allowed_macs, but all HMAC-MD5 suites are already removed.
|
|
|
|
|
| |
Otherwise a MITM who can in real time break any supported ECC curve can
downgrade us.
|
|
|
|
| |
Avoids the test vector contortions in RSA-KEM
|
|\ |
|
| | |
|
| | |
|
| |
| |
| |
| |
| |
| | |
Add flags --policy, --print-certs, --tls1.0, --tls1.1, --tls1.2
Update todo
|
| |
| |
| |
| |
| | |
Could attempt to allocate (size_t)-1 words with predicably bad_alloc
results.
|
|\ \ |
|
| | |
| | |
| | |
| | |
| | |
| | | |
get_system_timestamp_ns()
GH #422
|
|\ \ \ |
|
| | | | |
|
| |/ /
| | |
| | |
| | | |
equivalent to mlock on Unix to prevent swapping out of memory
|
|/ / |
|
|\ \ |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
A module policy is a file specifying three types of modules: ones which
are required, ones which are prohibited, and ones which should be used
if otherwise available (this is mostly for platform specific modules).
Finally there are whatever modules which exist in the library of which
the policy makes no mention. These will be included if an explicit
dependency of some other module pulls them in (so there is no reason
to mention base, utils, ... in the file) but skipped otherwise.
For example policy 'sane' does not mention 'utils' or 'twofish' either
way. Since utils is a dependency of other modules which are included,
but Twofish does not. However unlike an explicitly prohibited module,
not mentioned can still be requested as part of the build (here with
--enable-module=twofish)
Also fixes some test bugs noticed by compiling in different build
configs. DLIES test didn't check that the KDF and MAC existed. Adds a
typedef for MessageAuthenticationCode because typing it twice in a
single line in the DLIES test made me think it's way too long. :) Also
fix some fuzzer build problems. Due to a copy and paste bug the PKCS
certificate (it was not).
Inspired by GH #439
|
|\ \ \
| | | |
| | | |
| | | | |
The Intel RNG may fail if heavily contended, so retry as needed.
|
| | | |
| | | |
| | | |
| | | | |
prevents filtering out any 0x00000000 outputs from RDRAND/RDSEED
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* no spaces around if(), for() etc
* snake_case for plain functions
* anonymous namespace function instead private and static
* don't propagate failed poll to the calling application
* RdRand retires configurable in build.h
|
| | | |
| | | |
| | | |
| | | |
| | | | |
* Make it configurable how often RdRand and RdSeed is polled
* Make it configurable how many RdSeed retries are executed
|
| | | | |
|
|\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | | |
Makes it possible for an application to interpret some extension not
supported by the library.
|
| | |_|/
| |/| |
| | | |
| | | | |
+Extensions now uses std::unique_ptr
|
|\ \ \ \ |
|
| |\ \ \ \ |
|
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
division by zero found by clang-analyzer
|
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
in aes_schedule_transform found by clang-analyzer
|
| | |/ / /
| |/| | |
| | | | |
| | | | | |
clang-analyzer
|
| |/ / /
|/| | |
| | | |
| | | |
| | | |
| | | | |
Previously the signature hashes and algos info was used to set the v1.2
signature_algorithms extension, but if the counterparty ignored the
extension and sent something else, we wouldn't notice.
|
| | | |
| | | |
| | | |
| | | | |
GH #438
|
| |_|/
|/| | |
|
| | |
| | |
| | |
| | |
| | |
| | | |
I think we maybe want these to be converting constructors, and adding
explicit here breaks code like ECDSA_PrivateKey(rng, "secp256r1")
which seems like a reasonable thing to support IMO
|
| | |
| | |
| | |
| | | |
explicit.
|
|/ /
| |
| |
| | |
windows
|
|\ \
| | |
| | | |
Improvements in X.509 cert handling for python bindings. Add Python code coverage report.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Add implementation for ffi botan_x509_cert_get_public_key().
Add subject_dn() function to python x509_cert class.
Have python x509_cert constructor take a buffer alternatively.
Have python x509_cert functions time_starts() and time_expires() return
a python timestamp.
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
In GCC 4.7 and 4.8, Wshadow also warns if a local variable conflicts
with a member function. This was changed in GCC 4.9 (GCC bugzilla
57709) but causes a lot of warnings on Travis which is on 4.8. Clang's
Wshadow behaves like GCC 4.9
The worst offendor was Exception's constructor argument being named
`what` which conflicts with the member function of the same name,
being in a public header this causes so many warnings the Travis log
files are truncated.
This fixes Exception and a couple of others. Fixing all cases would be
a slog that I'm not up for right at the moment.
|
| |
| |
| |
| | |
Also adds a (not const time) implementation of almost Montgomery reduction.
|
| | |
|
|\ \ |
|
| | | |
|
|/ / |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Not optimized and relies on asm support for const time word_add/word_sub
instructions.
Fix a bug introduced in 46e9a89 - unpoison needs to call the valgrind
API with the pointer rather than the reference. Caused values not to
be unpoisoned.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Later checks on the record length in CCS and record handling already
rejected a zero length record but when reading an empty record,
readbuf.size() == TLS_HEADER_SIZE and so creating the pointer
byte* record_contents = &readbuf[TLS_HEADER_SIZE];
would trigger when running under (at least) GCC'S iterator debugging,
and likely other iterator checkers also.
Since no completely empty record is defined, reject it immediately at
the record layer.
Found by Juraj Somorovsky
Also correct DTLS record handling for large messages: a zero length or
too-long packet should be dropped rather than an exception being thrown.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Previously MCEIES used KEM with a raw SHA-512 hash. When the KDF
oriented KEM interface was added in 72f0f0ad2a it switched to using
KDF1(SHA-512) since for a 64-byte output and no salt, the output
matches the original hash. This avoids breaking the format.
Prevents runtime failures when MCEIES is enabled in the build but KDF1
is not. GH #369
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If malloc fails, don't save the size that was attempted. Otherwise a
failing malloc followed by a free(nullptr) would zero a block of
memory equal to the failed allocation starting from the null address.
It's not clear if zlib,bzip2,lzma expect the return of the malloc
function to be zero but LZMA at least seems to read from it before
writing. Zero it.
|
| |
| |
| |
| |
| |
| |
| |
| | |
Initialize variables in constructor in gf2m_decomp_rootfind_state
Add asserts on the degree where a positive value was assumed. How
polyn_gf2m handles the degree needs some work but this should do for
now.
|
| |
| |
| |
| |
| |
| | |
It somehow deduces an input that is both > 0 and for which high_bit
never finds a bit set and returns 0. In both cases that would lead to
block being 0 and a negative shift.
|