aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
* Add BMI2 variants for SHA-512 and SHA-3Jack Lloyd2019-01-1810-10/+413
| | | | Both about 33% faster on Skylake
* Fix init ordering warningJack Lloyd2019-01-181-1/+1
|
* Remove use of std::filesystem / boost::filesystemJack Lloyd2019-01-172-69/+8
| | | | | | | | | Boost doesn't buy us anything here since we need to maintain Win32 and POSIX implementations for non-Boost builds, and Boost only supports those two APIs anyway. MSVC's implementation of std::filesystem does not help for similar reasons, as we have to maintain a Win32 version for MinGW.
* Define BOTAN_IF_CONSTEXPRJack Lloyd2019-01-174-8/+25
| | | | This lets us avoid some warnings under VC++ 2017
* Fix some warnings from PVS-StudioJack Lloyd2019-01-1711-14/+23
| | | | No real bugs, but pointed out some odd constructs and duplicated logic
* Merge GH #1808 Add sandbox feature to CLIJack Lloyd2019-01-141-0/+1
|\
| * Sandboxing feature from CLI pov.David Carlier2019-01-142-24/+0
| | | | | | | | | | No resources to free with actual OS features but might be of use for later.
| * Proposal of sandboxing feature.David Carlier2019-01-062-0/+25
| | | | | | | | For now only used by the TLS server.
* | Remove unused fieldsJack Lloyd2019-01-131-3/+0
| |
* | Remove trailing whitespaceJack Lloyd2019-01-1312-57/+55
|/
* Fix indent [ci skip]Jack Lloyd2019-01-051-7/+7
|
* Revert #1798Jack Lloyd2019-01-051-4/+14
| | | | | | | | The problem in #602 is not the use of mmap but the use of mmap with MAP_SHARED. Using MAP_PRIVATE creates a CoW mapping just like malloc or posix_memalign would. I'm not sure why it took me so long to figure this out ...
* Add a fast range check and inline some thingsJack Lloyd2019-01-052-78/+89
|
* Split up allocations into pagesJack Lloyd2019-01-056-169/+188
|
* New Memory_Pool implementationJack Lloyd2019-01-043-131/+335
| | | | | Quite a bit faster than the old version, and with better properties wrt alignment
* Some cleanups in McEliece keygenJack Lloyd2019-01-031-15/+17
| | | | Lots more of this needed in here
* Add cast for MSVCJack Lloyd2019-01-031-1/+4
|
* Use memcpy instead of strcpy here to shut up MSVC warningJack Lloyd2019-01-031-1/+1
| | | | Here the caller is assumed to have provided a buffer of sufficient size.
* Add VC 2019 preview buildJack Lloyd2019-01-023-2/+2
|
* Merge GH #1803 XLC fixesJack Lloyd2019-01-015-11/+19
|\
| * Fix use of macroJack Lloyd2018-12-311-1/+1
| | | | | | | | Assumed to be 0/1
| * Clean up define for inline asmJack Lloyd2018-12-312-3/+7
| | | | | | | | Also fix xlc macro
| * Use __builtin_bswapN builtins on XLCJack Lloyd2018-12-311-4/+4
| | | | | | | | Recent XLC is based on clang and has these
| * Fixes for XLCJack Lloyd2018-12-311-1/+1
| | | | | | | | | | | | XLC 16 changed which macros are used to identify it. Older versions of XLC didn't work correctly anyway (#1581 #1509 etc), so just drop support for recognizing those versions.
| * Fix generic 32-bit bswapJack Lloyd2018-12-311-2/+6
| | | | | | | | Was broken by removing inclusion of rotate header
* | Fix MSVC warningsJack Lloyd2018-12-312-2/+2
|/
* Add a fuzzer for Memory_PoolJack Lloyd2018-12-291-1/+1
| | | | | | | | | Basically, test that it works. Accepts a sequence of alloc+free operations and verify that each pointer returned does not overlap with any other outstanding allocation, that the memory returned is zeroed, and that alignment is respected. Intended for testing #1800 but no reason not to land this first.
* Improve PBKDF self-tuningJack Lloyd2018-12-294-65/+66
| | | | | | | | | Make the tune interval a build-time configurable instead of hardcoding it in each source file. Also use binary search in RFC4880_encode_count instead of linear search. Fix a bug in Timer
* Correct spellingJack Lloyd2018-12-291-0/+1
|
* Add OS::read_env_variableJack Lloyd2018-12-293-9/+22
| | | | Combines the priv check and the getenv call on one.
* Merge GH #1798 Use posix_memalign instead of mmap for page locked poolJack Lloyd2018-12-291-17/+9
|\
| * Use posix_memalign instead of mmap for creating the locking poolJack Lloyd2018-12-281-17/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | As described in #602, using mmap with fork causes problems because the mmap remains shared in the child instead of being copy-on-write, then the parent and child stomp on each others memory. However we really do not need mmap semantics, we just want a block of memory that is page-aligned, which can be done with posix_memalign instead. This was added in POSIX.1-2001 and seems to be implemented by all modern systems. Closes #602
* | Avoid const-time modulo in DSA verificationJack Lloyd2018-12-291-1/+11
| | | | | | | | | | | | It has a substantial perf hit and is not necessary. It may not be really necessary for signatures either but leave that as it, with a comment explaining.
* | Simplifications in BigIntJack Lloyd2018-12-291-7/+1
|/ | | | | Use ct_is_zero instead of more complicated construction, and avoid duplicated size check/resize - Data::set_word will handle it.
* Make bigint_sub_abs const timeJack Lloyd2018-12-272-6/+26
|
* Fix Barrett reduction input boundJack Lloyd2018-12-263-13/+23
| | | | | | | | | | | | In the long ago when I wrote the Barrett code I must have missed that Barrett works for any input < 2^2k where k is the word size of the modulus. Fixing this has several nice effects, it is faster because it replaces a multiprecision comparison with a single size_t compare, and now the branch does not reveal information about the input or modulus, but only their word lengths, which is not considered sensitive. Fixing this allows reverting the change make in a57ce5a4fd2 and now RSA signing is even slightly faster than in 2.8, rather than 30% slower.
* Avoid size-based bypass of the comparison in Barrett reduction.Jack Lloyd2018-12-241-1/+1
| | | | As it would leak if an input was > p^2, or just close to it in size.
* Avoid conditional branch in Barrett for negative inputsJack Lloyd2018-12-241-4/+27
|
* Always use const-time modulo during DSA signingJack Lloyd2018-12-241-1/+2
| | | | | | | | | | | Since we are reducing a mod-p integer down to mod-q this would nearly always use ct_modulo in any case. And, in the case where Barrett did work, it would reveal that g^k mod p was <= q*q which would likely be useful for searching for k. This should actually be slightly faster (if anything) since it avoids the unnecessary comparison against q*q and jumps directly to ct_modulo.
* Address a side channel in RSA and SM2Jack Lloyd2018-12-242-8/+4
| | | | | | | | | | | | | | | | | Barrett will branch to a different (and slower) algorithm if the input is larger than the square of the modulus. This branch can be detected by a side channel. For RSA we need to compute m % p and m % q to get CRT started. Being able to detect if m > q*q (assuming q is the smaller prime) allows a binary search on the secret prime. This attack is blocked by input blinding, but still seems dangerous. Unfortunately changing to use the generic const time modulo instead of Barrett introduces a rather severe performance regression in RSA signing. In SM2, reduce k-r*x modulo the order before multiplying it with (x-1)^-1. Otherwise the need for slow modulo vs Barrett leaks information about k and/or x.
* In NIST P-xxx reductions unpoison S before using itJack Lloyd2018-12-241-8/+10
| | | | | | | | Was already done in P-256 but not in P-{192,224,384}. This is a cache-based side channel which would be good to address. It seems like it would be very difficult to exploit even with perfect recovery, but crazier things have worked.
* Unpoison result of high_bits_freeJack Lloyd2018-12-241-0/+1
| | | | | Previously we unpoisoned the input to high_bit but this is no longer required. But still the output should be unpoisoned.
* Another try at silencing Coverity on thisJack Lloyd2018-12-231-1/+1
|
* Initialize System_Error::m_error_codeJack Lloyd2018-12-231-1/+2
| | | | Actual bug, flagged by Coverity
* Avoid double return of unique_ptrJack Lloyd2018-12-231-1/+3
| | | | Flagged by Coverity
* Rename OS::get_processor_timestamp to OS::get_cpu_cycle_counterJack Lloyd2018-12-233-6/+7
| | | | | Using phrase "timestamp" makes it sound like it has some relation to wall clock which it does not.
* Now Timer does not need to include an internal headerJack Lloyd2018-12-231-1/+0
|
* De-inline more of TimerJack Lloyd2018-12-232-41/+37
| | | | No reason for these to be inlined
* Make significant_words const time alsoJack Lloyd2018-12-233-40/+25
| | | | | | Only used in one place, where const time doesn't matter, but can't hurt. Remove low_bit, can be replaced by ctz.
* In Timer, grab CPU clock firstJack Lloyd2018-12-231-9/+9
| | | | | | Reading the system timestamp first causes every event to get a few hundred cycles tacked onto it. Only mattered when the thing being tested was very fast.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 15:01:31 +0000