oweals/openssl.git
4 years agorsa_padding_add_PKCS1_OAEP_mgf1_with_libctx(): fix check of |md|
Richard Levitte [Tue, 19 May 2020 10:52:07 +0000 (12:52 +0200)]
rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx(): fix check of |md|

In the FIPS module, the code as written generate an unconditional
error.

Fixes #11865

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11869)

4 years agoRefactor the provider side DER constants and writers
Richard Levitte [Tue, 19 May 2020 08:43:49 +0000 (10:43 +0200)]
Refactor the provider side DER constants and writers

This splits up all the providers/common/der/*.c.in so the generated
portion is on its own and all related DER writing routines are in
their own files.  This also ensures that the DIGEST consstants aren't
reproduced in several files (resulting in symbol clashes).

Finally, the production of OID macros is moved to the generated header
files, allowing other similar macros, or DER constant arrays, to be
built on top of them.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11868)

4 years agodeprecate EC_POINT_make_affine and EC_POINTs_make_affine
Billy Brumley [Tue, 19 May 2020 14:48:36 +0000 (17:48 +0300)]
deprecate EC_POINT_make_affine and EC_POINTs_make_affine

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11874)

4 years agot1_trce: Fix remaining places where the 24 bit shift overflow happens
Tomas Mraz [Tue, 19 May 2020 08:52:53 +0000 (10:52 +0200)]
t1_trce: Fix remaining places where the 24 bit shift overflow happens

[extended tests]

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11857)

4 years agoAvoid potential overflow to the sign bit when shifting left 24 places
Tomas Mraz [Tue, 19 May 2020 08:51:53 +0000 (10:51 +0200)]
Avoid potential overflow to the sign bit when shifting left 24 places

Although there are platforms where int is 64 bit, 2GiB large BIGNUMs
instead of 4GiB should be "big enough for everybody".

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11857)

4 years agoCast the unsigned char to unsigned int before shifting left
Tomas Mraz [Tue, 19 May 2020 08:51:19 +0000 (10:51 +0200)]
Cast the unsigned char to unsigned int before shifting left

This is needed to avoid automatic promotion to signed int.

Fixes #11853

[extended tests]

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11857)

4 years agoFix egd and devrandom source configs
Bernd Edlinger [Sun, 17 May 2020 00:08:56 +0000 (02:08 +0200)]
Fix egd and devrandom source configs

./config --with-rand-seed=egd

need to defines OPENSSL_RAND_SEED_EGD and OPENSSL_NO_EGD
so get rid of OPENSSL_NO_EGD (compiles but I did not really test EGD)

./config --with-rand-seed=devrandom

does not work since wait_random_seeded works under the assumption
that OPENSSL_RAND_SEED_GETRANDOM is supposed to be enabled as well,
that is usually the case, but not when only devrandom is enabled.
Skip the wait code in this special case.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11848)

4 years agoAdd OSSL_PROVIDER_do_all()
Richard Levitte [Mon, 18 May 2020 10:43:12 +0000 (12:43 +0200)]
Add OSSL_PROVIDER_do_all()

This allows applications to iterate over all loaded providers.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11858)

4 years agoUpdate early data exchange scenarios in doc
raja-ashok [Wed, 13 May 2020 18:07:14 +0000 (23:37 +0530)]
Update early data exchange scenarios in doc

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11816)

4 years agoUpdate limitation of psk_client_cb and psk_server_cb in usage with TLSv1.3
raja-ashok [Wed, 13 May 2020 18:02:44 +0000 (23:32 +0530)]
Update limitation of psk_client_cb and psk_server_cb in usage with TLSv1.3

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11816)

4 years agoTest for the SSL_OP_IGNORE_UNEXPECTED_EOF option
Dmitry Belyavskiy [Fri, 15 May 2020 20:03:41 +0000 (23:03 +0300)]
Test for the SSL_OP_IGNORE_UNEXPECTED_EOF option

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11735)

4 years agoIntroducing option SSL_OP_IGNORE_UNEXPECTED_EOF
Dmitry Belyavskiy [Tue, 5 May 2020 13:20:42 +0000 (16:20 +0300)]
Introducing option SSL_OP_IGNORE_UNEXPECTED_EOF

Partially fixes #11209.

Before OpenSSL 3.0 in case when peer does not send close_notify,
the behaviour was to set SSL_ERROR_SYSCALL error with errno 0.
This behaviour has changed. The SSL_OP_IGNORE_UNEXPECTED_EOF restores
the old behaviour for compatibility's sake.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11735)

4 years agoUse {module,install}-mac, not -checksum
Rich Salz [Fri, 24 Apr 2020 14:48:51 +0000 (10:48 -0400)]
Use {module,install}-mac, not -checksum

As the documentation points out, these fipsmodule.cnf fields are a MAC,
not a digest or checksum.  Rename them to be correct.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11369)

4 years agoRevise fips_install.pod
Rich Salz [Fri, 20 Mar 2020 15:10:15 +0000 (11:10 -0400)]
Revise fips_install.pod

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11369)

4 years agoRevise x509v3_config.pod
Rich Salz [Fri, 20 Mar 2020 01:53:11 +0000 (21:53 -0400)]
Revise x509v3_config.pod

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11369)

4 years agoRevise fips_config.pod
Rich Salz [Thu, 19 Mar 2020 14:19:41 +0000 (10:19 -0400)]
Revise fips_config.pod

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11369)

4 years agoAdd missing pragma weak declaration to lhash.h
Norm Green [Tue, 12 May 2020 00:22:47 +0000 (17:22 -0700)]
Add missing pragma weak declaration to lhash.h

The missing symbol caused a linker failure on solaris x86_64.

Fixes #11796

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11798)

4 years agodeprecate EC precomputation functionality
Billy Brumley [Sun, 17 May 2020 13:09:00 +0000 (16:09 +0300)]
deprecate EC precomputation functionality

Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11851)

4 years agoNew Russian TLS 1.2 implementation
Dmitry Belyavskiy [Mon, 30 Mar 2020 15:09:24 +0000 (18:09 +0300)]
New Russian TLS 1.2 implementation

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11442)

4 years agoGOST-related objects changes
Dmitry Belyavskiy [Fri, 8 May 2020 11:17:11 +0000 (14:17 +0300)]
GOST-related objects changes

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11442)

4 years agoConstants for new GOST TLS 1.2 ciphersuites
Dmitry Belyavskiy [Mon, 30 Mar 2020 15:04:07 +0000 (18:04 +0300)]
Constants for new GOST TLS 1.2 ciphersuites

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11442)

4 years agoCORE: query for operations only once per provider (unless no_store is true)
Richard Levitte [Fri, 15 May 2020 13:56:05 +0000 (15:56 +0200)]
CORE: query for operations only once per provider (unless no_store is true)

When a desired algorithm wasn't available, we didn't register anywhere
that an attempt had been made, with the result that next time the same
attempt was made, the whole process would be done again.

To avoid this churn, we register a bit for each operation that has
been queried in the libcrypto provider object, and test it before
trying the same query and method construction loop again.

If course, if the provider has told us not to cache, we don't register
this bit.

Fixes #11814

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11842)

4 years agoUse _get0_ functions instead of _get_.
Marc [Sat, 16 May 2020 18:31:03 +0000 (19:31 +0100)]
Use _get0_ functions instead of _get_.

Fix build error on some platforms

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/10757)

4 years agos_client: Show cert algorithms & validity period
Marc [Sat, 4 Jan 2020 15:27:17 +0000 (15:27 +0000)]
s_client: Show cert algorithms & validity period

Add certificate validity period (v) and public key & signature algorithms (a) to the "Certificate Chain" output.

Eg:
Certificate chain
 0 s:C = US, ST = California, L = Mountain View, O = Google LLC, CN = www.google.com
   i:C = US, O = Google Trust Services, CN = GTS CA 1O1
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Dec  3 14:49:26 2019 GMT; NotAfter: Feb 25 14:49:26 2020 GMT
 1 s:C = US, O = Google Trust Services, CN = GTS CA 1O1
   i:OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun 15 00:00:42 2017 GMT; NotAfter: Dec 15 00:00:42 2021 GMT

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/10757)

4 years agoFix some places where X509_up_ref is used
Bernd Edlinger [Sun, 17 May 2020 12:45:28 +0000 (14:45 +0200)]
Fix some places where X509_up_ref is used
without error handling.

This takes up the ball from #11278
without trying to solve everything at once.

[extended tests]

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/11850)

4 years agoTTY_get() in crypto/ui/ui_openssl.c open_console() can also return errno 1 (EPERM...
Maxim Zakharov [Fri, 8 May 2020 04:58:10 +0000 (14:58 +1000)]
TTY_get() in crypto/ui/ui_openssl.c open_console() can also return errno 1 (EPERM, Linux)

Signed-off-by: Maxim Zakharov <5158255+Maxime2@users.noreply.github.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11767)

4 years agoDelete the sslprovider test
Matt Caswell [Thu, 14 May 2020 14:45:38 +0000 (15:45 +0100)]
Delete the sslprovider test

This was added before the changes to the sslap/ssl_new/ssl_old tests which
run those tests with a non-default library context. It no longer adds
anything that those tests don't already do, so it can be deleted.

This also fixes a number of run-checker build failures which were failing
in this test if TLSv1.2 was disabled.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11832)

4 years agoFix small documentation issues
Nikolay Morozov [Thu, 14 May 2020 19:32:59 +0000 (22:32 +0300)]
Fix small documentation issues

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11835)

4 years agodeprecate EC_POINTs_mul function
Billy Brumley [Wed, 13 May 2020 04:33:59 +0000 (07:33 +0300)]
deprecate EC_POINTs_mul function

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11807)

4 years agoUpdate documentation following changes of various types
Matt Caswell [Thu, 7 May 2020 11:11:44 +0000 (12:11 +0100)]
Update documentation following changes of various types

The previous commit changed the types of various objects passed between
the core and providers. Therefore the documentation needs to be updated
to reflect that.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11758)

4 years agoMaintain strict type discipline between the core and providers
Matt Caswell [Wed, 6 May 2020 11:29:57 +0000 (12:29 +0100)]
Maintain strict type discipline between the core and providers

A provider could be linked against a different version of libcrypto than
the version of libcrypto that loaded the provider. Different versions of
libcrypto could define opaque types differently. It must never occur that
a type created in one libcrypto is used directly by the other libcrypto.
This will cause crashes.

We can "cheat" for "built-in" providers that are part of libcrypto itself,
because we know that the two libcrypto versions are the same - but not for
other providers.

To ensure this does not occur we use different types names for the handful
of opaque types that are passed between the core and providers.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11758)

4 years agoCORE: Fix a couple of bugs in algorithm_do_this()
Richard Levitte [Fri, 15 May 2020 05:50:43 +0000 (07:50 +0200)]
CORE: Fix a couple of bugs in algorithm_do_this()

The call of ossl_provider_query_operation() used |data->operation_id|,
when |cur_operation| should be used.

If any ossl_provider_query_operation() call returned NULL, the loop
was stopped, when it should just continue on to the next operation.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11837)

4 years agoTest TLSv1.3 out-of-band PSK with all 5 ciphersuites
raja-ashok [Sun, 10 May 2020 17:17:00 +0000 (22:47 +0530)]
Test TLSv1.3 out-of-band PSK with all 5 ciphersuites

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11785)

4 years agoFix crash in early data send with out-of-band PSK using AES CCM
raja-ashok [Fri, 8 May 2020 13:47:21 +0000 (19:17 +0530)]
Fix crash in early data send with out-of-band PSK using AES CCM

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11785)

4 years agoFix all MD036 (emphasis used instead of heading)
Rich Salz [Wed, 13 May 2020 15:16:50 +0000 (11:16 -0400)]
Fix all MD036 (emphasis used instead of heading)

The main fixes were errors in itemized lists "*)" instead of "*"

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11770)

4 years agoAdd "md-nits" make target
Rich Salz [Fri, 8 May 2020 14:34:22 +0000 (10:34 -0400)]
Add "md-nits" make target

Also fix a nit in recent CHANGES.md update.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11770)

4 years agoAdd 'methods' parameter to setup_engine() in apps.c for individual method defaults
David von Oheimb [Mon, 28 Aug 2017 17:14:47 +0000 (19:14 +0200)]
Add 'methods' parameter to setup_engine() in apps.c for individual method defaults

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4277)

4 years agoClean up macro definitions of openssl_fdset() in apps.h and sockets.h
Dr. David von Oheimb [Tue, 21 Apr 2020 12:08:49 +0000 (14:08 +0200)]
Clean up macro definitions of openssl_fdset() in apps.h and sockets.h

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/4277)

4 years agoUse OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c
Dr. David von Oheimb [Wed, 6 May 2020 11:51:50 +0000 (13:51 +0200)]
Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c

This also adds the more flexible and general load_key_cert_crl()
as well as helper functions get_passwd(), cleanse(), and clear_free()
to be used also in apps/cmp.c etc.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11755)

4 years agoNit-fix: remove whitespace in doc/man3/EVP_PKEY_fromdata.pod causing warning
Dr. David von Oheimb [Fri, 8 May 2020 08:56:14 +0000 (10:56 +0200)]
Nit-fix: remove whitespace in doc/man3/EVP_PKEY_fromdata.pod causing warning

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11755)

4 years agoGuard use of struct tms with #ifdef __TMS like done earlier in apps/lib/apps.c
Dr. David von Oheimb [Thu, 7 May 2020 19:37:28 +0000 (21:37 +0200)]
Guard use of struct tms with #ifdef __TMS like done earlier in apps/lib/apps.c

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11755)

4 years agoBuild: make apps/progs.c depend on configdata.pm
Richard Levitte [Thu, 14 May 2020 10:33:09 +0000 (12:33 +0200)]
Build: make apps/progs.c depend on configdata.pm

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11824)

4 years agoSSL: refactor ssl_cert_lookup_by_pkey() to work with provider side keys
Richard Levitte [Thu, 14 May 2020 12:04:41 +0000 (14:04 +0200)]
SSL: refactor ssl_cert_lookup_by_pkey() to work with provider side keys

Fixes #11720

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11828)

4 years agoIgnore some auto-generated DER files
Matt Caswell [Thu, 14 May 2020 13:21:40 +0000 (14:21 +0100)]
Ignore some auto-generated DER files

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11830)

4 years agoPrepare for 3.0 alpha 3
Matt Caswell [Fri, 15 May 2020 13:35:04 +0000 (14:35 +0100)]
Prepare for 3.0 alpha 3

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoPrepare for release of 3.0 alpha 2 openssl-3.0.0-alpha2
Matt Caswell [Fri, 15 May 2020 13:33:29 +0000 (14:33 +0100)]
Prepare for release of 3.0 alpha 2

Reviewed-by: Richard Levitte <levitte@openssl.org>
4 years agoUpdate copyright year
Matt Caswell [Fri, 15 May 2020 13:09:49 +0000 (14:09 +0100)]
Update copyright year

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11839)

4 years agoIf SOURCE_DATE_EPOCH is defined, use it for copyright year
Nicolas Vigier [Thu, 5 Mar 2020 19:39:05 +0000 (20:39 +0100)]
If SOURCE_DATE_EPOCH is defined, use it for copyright year

Using the date from SOURCE_DATE_EPOCH instead of the current date makes
it possible to reproduce a build that was built on a different year:
https://reproducible-builds.org/specs/source-date-epoch/

This is fixing an issue we had while building Tor Browser:
https://trac.torproject.org/projects/tor/ticket/33535

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11296)

4 years agoCorrect alignment calculation in ssl3_setup_write
Matt Caswell [Fri, 8 May 2020 10:12:10 +0000 (11:12 +0100)]
Correct alignment calculation in ssl3_setup_write

The alignment calculation in ssl3_setup_write incorrectly results in an
alignment allowance of
(-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1) bytes. This equals 3
in almost all cases. The maximum alignment actually used in do_ssl3_write
is (SSL3_ALIGN_PAYLOAD - 1). This equals 7 bytes in almost all cases. So
there is a potential to overrun the buffer by up to 4 bytes.

Fortunately, the encryption overhead allowed for is 80 bytes which
consists of 16 bytes for the cipher block size and 64 bytes for the MAC
output. However the biggest MAC that we ever produce is HMAC-384 which is
48 bytes - so we have a headroom of 16 bytes (i.e. more than the 4 bytes
of potential overrun).

Thanks to Nagesh Hegde for reporting this.

Fixes #11766

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11768)

4 years agoConfigure: Avoid SIXTY_FOUR_BIT for linux-mips64
Orgad Shaneh [Mon, 24 Feb 2020 07:02:31 +0000 (09:02 +0200)]
Configure: Avoid SIXTY_FOUR_BIT for linux-mips64

This is a 32-bit ABI build (as opposed to linux64-mips64).
Setting SIXTY_FOUR_BIT breaks hardware optimizations, at least on
octeon processors.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11725)

4 years agodev/release.sh: Add --reviewer to set reviewers
Richard Levitte [Fri, 24 Apr 2020 09:03:28 +0000 (11:03 +0200)]
dev/release.sh: Add --reviewer to set reviewers

Doing this is kind of contrary to how we normally do things, as this
constitutes a kind of pre-approval.  However, without this, the normal
review process will modify the reviewed commits, and render the
annotated release tag invalid, which forces the person doing the
release to re-tag manually.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11630)

4 years agoPass "-z defs" to the linker via "-Wl,-z,defs" rather than with gcc's -z
Thomas Dwyer III [Wed, 13 May 2020 17:32:47 +0000 (10:32 -0700)]
Pass "-z defs" to the linker via "-Wl,-z,defs" rather than with gcc's -z
flag (which is not supported by older compilers).

CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11815)

4 years agotest/evp_extra_test.c: Add OPENSSL_NO_CMAC around CMAC test
Richard Levitte [Thu, 14 May 2020 15:15:05 +0000 (17:15 +0200)]
test/evp_extra_test.c: Add OPENSSL_NO_CMAC around CMAC test

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11833)

4 years agoPROV: make some DER AID arrays non-static, to avoid clang complaints
Richard Levitte [Tue, 12 May 2020 08:27:46 +0000 (10:27 +0200)]
PROV: make some DER AID arrays non-static, to avoid clang complaints

The problem encountered is that some arrays were deemed unnecessary by
clang, for example:

    providers/common/der/der_rsa.c:424:28: error: variable 'der_aid_sha224Identifier' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
    static const unsigned char der_aid_sha224Identifier[] = {
                               ^

However, these arrays are used in sizeof() expressions in other parts
of the code that's actually used, making that warning-turned-error a
practical problem.  We solve this by making the array non-static,
which guarantees that the arrays will be emitted, even though
unnecessarily.  Fortunately, they are very small.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years ago.travis.yml: never use -Werror, use --strict-warnings instead
Richard Levitte [Tue, 12 May 2020 07:54:04 +0000 (09:54 +0200)]
.travis.yml: never use -Werror, use --strict-warnings instead

There are a few things in the OpenSSL code that are known to give
warnings that we know are harmless.  We test our builds accordingly.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agotest/recipes/15-test_rsapss.t: Add test with unrestricted signature
Richard Levitte [Mon, 11 May 2020 16:27:04 +0000 (18:27 +0200)]
test/recipes/15-test_rsapss.t: Add test with unrestricted signature

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agotest/ssl-tests/20-cert-select.cnf.in: Re-enable RSA-PSS related tests
Richard Levitte [Fri, 8 May 2020 17:39:44 +0000 (19:39 +0200)]
test/ssl-tests/20-cert-select.cnf.in: Re-enable RSA-PSS related tests

There were a few RSA-PSS related tests that were disabled for non-default
library contexts.  We now re-enable them.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agotest/evp_pkey_provided_test.c: Display first, compare after
Richard Levitte [Thu, 7 May 2020 07:56:52 +0000 (09:56 +0200)]
test/evp_pkey_provided_test.c: Display first, compare after

To make it easier to check the generated key manually, display it
before comparing diverse other serializations.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoPROV & ASYM_CIPHER: Adapt the RSA asymmetric cipher code for PSS-parameters
Richard Levitte [Wed, 6 May 2020 19:52:12 +0000 (21:52 +0200)]
PROV & ASYM_CIPHER: Adapt the RSA asymmetric cipher code for PSS-parameters

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoEVP: Refactor the RSA-PSS key generation controls for providers
Richard Levitte [Tue, 5 May 2020 08:29:34 +0000 (10:29 +0200)]
EVP: Refactor the RSA-PSS key generation controls for providers

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoPROV & SIGNATURE: Adapt the RSA signature code for PSS-parameters
Richard Levitte [Sun, 3 May 2020 04:02:52 +0000 (06:02 +0200)]
PROV & SIGNATURE: Adapt the RSA signature code for PSS-parameters

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoEVP: For SIGNATURE operations, pass the propquery early
Richard Levitte [Wed, 6 May 2020 19:44:58 +0000 (21:44 +0200)]
EVP: For SIGNATURE operations, pass the propquery early

Instead of passing it with signature->digest_verify_init() and
signature->digest_sign_init(), we pass it with signature->newctx().
This allows the digests that are indicated by RSA PSS parameters
to have a useful propquery.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoPROV & SERIALIZER: Adapt the RSA serializers for PSS-parameters
Richard Levitte [Sat, 2 May 2020 11:39:40 +0000 (13:39 +0200)]
PROV & SERIALIZER: Adapt the RSA serializers for PSS-parameters

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoPROV & KEYMGMT: Add PSS-parameter support in the RSA KEYMGMT implementation
Richard Levitte [Sat, 2 May 2020 11:31:47 +0000 (13:31 +0200)]
PROV & KEYMGMT: Add PSS-parameter support in the RSA KEYMGMT implementation

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoPROV: Refactor the RSA SIGNATURE implementation for better param control
Richard Levitte [Thu, 7 May 2020 06:51:09 +0000 (08:51 +0200)]
PROV: Refactor the RSA SIGNATURE implementation for better param control

We want to catch errors in passed parameters early, which requires
kowledge of the ongoing operation.  Fortunately, that's possible by
re-using the EVP_PKEY_OP macros in specific init functions.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoPROV: Refactor the RSA DER support
Richard Levitte [Sat, 2 May 2020 11:25:52 +0000 (13:25 +0200)]
PROV: Refactor the RSA DER support

We separate out the NIST arc OIDs to a separate file, so it can be
re-used, and also the DIGEST OIDs.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoDER writer: Add the possibility to abandon empty SEQUENCEs
Richard Levitte [Sat, 2 May 2020 11:33:24 +0000 (13:33 +0200)]
DER writer: Add the possibility to abandon empty SEQUENCEs

In some cases, a SEQUENCE that contains only optional fields may end
up empty.  In some cases, this may be represented by dropping the
SEQUENCE entirely from the encoded DER.

To do this, we detect the case where WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH
is used, and adapt accordingly.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoRSA: Add PSS-parameter processing in EVP_PKEY_ASN1_METHOD functions
Richard Levitte [Sat, 2 May 2020 11:14:04 +0000 (13:14 +0200)]
RSA: Add PSS-parameter processing in EVP_PKEY_ASN1_METHOD functions

The import and export functions are affected.  We also refactor them
to assign the RSA key type more carefully.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoRSA: Add a less loaded PSS-parameter structure
Richard Levitte [Sat, 2 May 2020 10:46:55 +0000 (12:46 +0200)]
RSA: Add a less loaded PSS-parameter structure

RSA_PSS_PARAMS carries with it a lot of baggage in form of X509_ALGOR
and ASN1_INTEGER, which we would rather avoid in our providers.
Therefore, we create a parallell structure - RSA_PSS_PARAMS_30 - that
contains the same information, but uses numeric identities (*) and C
integers (**).  This makes it simpler to handle.

Note that neither this structure nor its contents are passed between
libcrypto and the providers.  Instead, the numeric identities are
translated to and from names, which are then passed over that
boundary.

For future considerations, we might consider dropping RSA_PSS_PARAMS
entirely.  For now, it's still reserved for EVP_PKEY_ASN1_METHOD code,
which RSA_PSS_PARAMS_30 is (almost entirely) reserved for use in our
providers.

(*) We use NIDs in this case, because we already have them and because
only algorithms that libcrypto knows about are permitted in PSS
restrictions.  We could use any number series we want, as long as we
know for sure what they represent.

(**) That's for saltlen and for trailerfield, which are never expect
to surpass the set of numbers that fit in a regular 'int'.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoRSA: Add rsa_schemes.c, to store scheme data and translator functions
Richard Levitte [Sat, 2 May 2020 10:41:39 +0000 (12:41 +0200)]
RSA: Add rsa_schemes.c, to store scheme data and translator functions

The scheme currently added is OAEP-PSSDigestAlgorithms codified.
The translator functions translate an EVP_MD into a NID, and a NID
into a name, to support the creation and parsing of OSSL_PARAM items.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoRSA: Extract much of the rsa_pkey_export_to() code to a separate function
Richard Levitte [Sat, 2 May 2020 11:02:29 +0000 (13:02 +0200)]
RSA: Extract much of the rsa_pkey_export_to() code to a separate function

The resulting function, rsa_todata(), is designed to be usable by
providers as well.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agoRSA: Add RSA key types
Richard Levitte [Sat, 2 May 2020 09:22:23 +0000 (11:22 +0200)]
RSA: Add RSA key types

The support of restricted RSA key types (OAEP and PSS) was lacking, or
dependent on the presence of restriction parameters.  For example,
this means that even though an RSA-PSS key may have been generated, it
may appear as a plain unrestricted RSA key if parameters weren't
present (which is the case when default restriction parameters are
used)

To make it clearer what an RSA key is intended for, and avoid
depending in an EVP_PKEY, we introduce RSA key types.  This is done by
reserving a section of the RSA flags (4 bits, which allows a total of
16 different types).

This isn't terribly important for EVP_PKEY_ASN1_METHOD code, as that
has access to the wrapping EVP_PKEY.  This is very important for
provider code, which has no access to the wrapping EVP_PKEY.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11710)

4 years agotest/evp_extra_test.c: Add test for CMAC keygen with a NULL engine
Richard Levitte [Tue, 12 May 2020 13:27:32 +0000 (15:27 +0200)]
test/evp_extra_test.c: Add test for CMAC keygen with a NULL engine

Verifies that #11671 is fixed

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11674)

4 years agoEVP: Only use the engine when one is defined, in pkey_mac_ctrl()
Richard Levitte [Wed, 29 Apr 2020 04:55:40 +0000 (06:55 +0200)]
EVP: Only use the engine when one is defined, in pkey_mac_ctrl()

Fixes #11671

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11674)

4 years agoAdd documentation for ASN1_INTEGER_new() and ASN1_INTEGER_free()
Nikolay Morozov [Mon, 11 May 2020 17:51:31 +0000 (20:51 +0300)]
Add documentation for ASN1_INTEGER_new() and ASN1_INTEGER_free()

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11795)

4 years agoRename OSSL_CMP_CTX_set1_clCert() to OSSL_CMP_CTX_set1_cert()
Dr. David von Oheimb [Fri, 8 May 2020 11:30:44 +0000 (13:30 +0200)]
Rename OSSL_CMP_CTX_set1_clCert() to OSSL_CMP_CTX_set1_cert()

Also update documentation and example code in openssl-cmp.pod.in

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoAdd -reqin_new_tid option to apps/cmp.c and OSSL_CMP_MSG_update_transactionID()
Dr. David von Oheimb [Wed, 29 Apr 2020 16:06:43 +0000 (18:06 +0200)]
Add -reqin_new_tid option to apps/cmp.c and OSSL_CMP_MSG_update_transactionID()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoImprove CMP documentation regarding use of untrusted certs
Dr. David von Oheimb [Thu, 30 Apr 2020 17:38:58 +0000 (19:38 +0200)]
Improve CMP documentation regarding use of untrusted certs

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoChunk 11 of CMP contribution to OpenSSL: CMP command-line interface
Dr. David von Oheimb [Fri, 3 Apr 2020 08:43:58 +0000 (10:43 +0200)]
Chunk 11 of CMP contribution to OpenSSL: CMP command-line interface

Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL
Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712).
Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI.
Adds extensive documentation and tests.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoPreliminary fix of memory leak in try_decode_PKCS12() - full fix is in #11733
Dr. David von Oheimb [Tue, 12 May 2020 08:14:00 +0000 (10:14 +0200)]
Preliminary fix of memory leak in try_decode_PKCS12() - full fix is in #11733

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoImprove description of algorithm NIDs in doc/man3/OSSL_CMP_CTX_new.pod
Dr. David von Oheimb [Tue, 28 Apr 2020 09:00:07 +0000 (11:00 +0200)]
Improve description of algorithm NIDs in doc/man3/OSSL_CMP_CTX_new.pod

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoReflect constifications of 62dcd2aa in doc/man3/OSSL_CRMF_MSG_get0_tmpl.pod
Dr. David von Oheimb [Fri, 3 Apr 2020 17:54:45 +0000 (19:54 +0200)]
Reflect constifications of 62dcd2aa in doc/man3/OSSL_CRMF_MSG_get0_tmpl.pod

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11470)

4 years agoOSSL_STORE: Make the 'file' scheme loader handle MSBLOB and PVK files
Richard Levitte [Fri, 12 Oct 2018 14:56:44 +0000 (16:56 +0200)]
OSSL_STORE: Make the 'file' scheme loader handle MSBLOB and PVK files

This involves exposing two pvkfmt.c functions, but only internally.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11756)

4 years agoOSSL_STORE: Better information when prompting for pass phrases
Richard Levitte [Fri, 12 Oct 2018 14:52:15 +0000 (16:52 +0200)]
OSSL_STORE: Better information when prompting for pass phrases

The prompt includes the URI, to make it clear which object needs a
pass phrase.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11756)

4 years agoOSSL_STORE: Make it possible to attach an OSSL_STORE to an opened BIO
Richard Levitte [Fri, 12 Oct 2018 14:46:41 +0000 (16:46 +0200)]
OSSL_STORE: Make it possible to attach an OSSL_STORE to an opened BIO

This capability existed internally, and is now made public.

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/11756)

4 years agoPROV: Adapt all our providers to use the new PROV_CTX structure
Richard Levitte [Tue, 12 May 2020 07:02:25 +0000 (09:02 +0200)]
PROV: Adapt all our providers to use the new PROV_CTX structure

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11803)

4 years agoPROV: Add a proper provider context structure for OpenSSL providers
Richard Levitte [Tue, 12 May 2020 06:46:23 +0000 (08:46 +0200)]
PROV: Add a proper provider context structure for OpenSSL providers

The provider context structure is made to include the following information:

- The core provider handle (first argument to the provider init
  function).  This handle is meant to be used in all upcalls that need
  it.

- A library context, used for any libcrypto calls that need it, done in
  the provider itself.

Regarding the library context, that's generally only needed if the
provider makes any libcrypto calls, i.e. is linked with libcrypto.  That
happens to be the case for all OpenSSL providers, but is applicable for
other providers that use libcrypto internally as well.

The normal thing to do for a provider init function is to create its own
library context.  For a provider that's meant to become a dynamically
loadable module, this is what MUST be done.
However, we do not do that in the default provider; it uses the library
context associated with the core provider handle instead.  This is
permissible, although generally discouraged, as long as the provider in
question is guaranteed to be built-in, into libcrypto or into the
application that uses it.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11803)

4 years agoRemove explicit dependency on configdata.pm when processing .in files
Richard Levitte [Mon, 11 May 2020 09:40:33 +0000 (11:40 +0200)]
Remove explicit dependency on configdata.pm when processing .in files

For those files, the dependence on configdata.pm is automatic, adding
it explicitly only results in having that dependency twice.

Fixes #11786

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11790)

4 years agoFix FreeBSD build with --strict-warnings
Benjamin Kaduk [Mon, 11 May 2020 16:29:24 +0000 (09:29 -0700)]
Fix FreeBSD build with --strict-warnings

apps/lib/http_server.c needs to include string.h in order to get a prototype
for strerror().

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11797)

4 years agoFix rsa8192.pem
Bernd Edlinger [Sun, 10 May 2020 04:37:12 +0000 (06:37 +0200)]
Fix rsa8192.pem

Q: How did I do that?

A: That's a long story.

Precondition: I used sage 8.1 for the math, it could probably
done with simple python as well but I did not try.

First I extract numbers from rsa8192.pem:

openssl rsa -in rsa8192.pem -noout -text | sed "s/://g; s/ //g;"

cut&paste the numbers into sage:

modulus
00890d9fd57e81b5ed43283d0ea020
4a1229333d6fb9c37a179375b09c4f
7b5b1cf2eb025979b6d90b709928a0
6725e04caf2b0f7fe94afbdf9f3fa5
66f1ba75c2f6dc488039f410eb5fa8
ab152b8cfdb76791bb853059438edf
ae56bc70a32a9f3e2d883e8b751d08
3797999dc81a9c4d6bdb3a75362fd1
d9c497cf5028dfcdd4cc3eb318e79f
c0db45cbeed955da8a447f0872dee5
65bde4013340e767731441fae4fa54
51356bfbc84e1271b39f111f5f8ef3
a6c8973765b39addef80306194f4ea
89fdfc8e9744866323f6936de89b2f
e2741578b8eb3c41676702fabc50ec
c376e6b7b6e7f94e7d7b5c1bab3c9f
23bb0c8f04d8aca64c309fc063c406
553e1c1421cc45060df7f48c49f5c5
b459d572e273402d6a3ff008657fe9
1936714d1823c5cad53d80630b3216
9bf70feb2ebc1af6a35ee0bf059aed
49c4e367d567e130e2846859b271fd
a8949b182e050819866b8e762ed29f
fb3f7ca14cebfc2488662be4b3980f
c8d31890a05f38ae9690cc7d9d3efc
4808e03da104a8c28bb480bb814995
a6e8b8978ab8350d90b3894e3abf7d
c4ad0956335752c8d6944b38a1715e
7d9950f49e6cdba171fbe651a2ca26
65a7c70b6e8cf3a02c2f93dad8aa95
06481cdb032d04082a5a6c6a733b65
20fa80e2ef57b9cf858ca5ea11e084
bc31a386fc6b099f069786207f80d6
1f2bef294400d59394ad1006431366
a54ae09b0ecd3377dcd8af8fde9b94
fd559b0b7adc5113ba66fc4b3dc842
ee562cfcfd39b4ffc31576635873fc
59535b7aa98605772436c251834e23
4fb2347cc970a49818cac2a9ee95eb
b55fa2da66edd53e11245c6732140a
ae41491288cbf462eef8a807b46d0d
affa38d9ccfe8033d2d4a3cf5c5b82
9df12183f7a05d3650153cd317a017
083ac641c2c3ad11305de0a032be45
c439bd7bbbe3cb97850f9d2c66f72a
4a66e9d434544fc6d294ca3c92627b
e518bfa44e3017ac8ad9c0a26a227d
2e8677da0a4de8edb53ac9530adb63
83c72dbf562dc4d0fea4e492f09eb1
74548381a8686db3aeaaa3a9960cff
25e8c64701115da54fa7a1fb2c566a
fcb4b2a63268d818c3391a62885d13
41b3492c4f0167291b3d026a44e68c
02f2d4d255d4c0906b92a2ced0c0bb
f2bcdceaec1189895af4232dc386c9
75bf3477e5a70d3ab0ac0e5dc37024
0e34a276b155d5e290f77416a1986d
ec47f8c78236ac7df249df9ba21a80
2e6bd75b4fb1c6ffe0f4cf548761a5
6a1fcccee156523a718987f3fdaedc
7171c9050db89a83f24c5a283695b9
c28de6d3b69fc1714b0add335a0ce6
fbbdbd0bbdb01e44969d775105bba3
d2947dca2f291250f9b851e76f514d
dc5a3aa4498e6521314991568860eb
ff1258d8b4aee9ee4159153684c0c0
16c60b17537a50b53cd59aad60678b
d73f0714ab4ccae7416bab417b4907
36d59b2e9f

I used echo `echo "<paste>" ` | sed "s/ //g"
to get everything in one line, put that again
into the clipboard and
then start sage, type N=0x<paste><CR>

sage: N=0x00890d9fd57e81b5ed43283d0ea0204a1229333d6fb9c37a179375b09c4f7b5b1cf2eb025979b6d90b709928a06725e04caf2b0f7fe94afbdf9f3fa566f1ba75c2f6dc488039f410eb5fa8ab152b8cfdb76791bb853059438edfae56bc70a32a9f3e2d883e8b751d083797999dc81a9c4d6bdb3a75362fd1d9c497cf5028dfcdd4cc3eb318e79fc0db45cbeed955da8a447f0872dee565bde4013340e767731441fae4fa5451356bfbc84e1271b39f111f5f8ef3a6c8973765b39addef80306194f4ea89fdfc8e9744866323f6936de89b2fe2741578b8eb3c41676702fabc50ecc376e6b7b6e7f94e7d7b5c1bab3c9f23bb0c8f04d8aca64c309fc063c406553e1c1421cc45060df7f48c49f5c5b459d572e273402d6a3ff008657fe91936714d1823c5cad53d80630b32169bf70feb2ebc1af6a35ee0bf059aed49c4e367d567e130e2846859b271fda8949b182e050819866b8e762ed29ffb3f7ca14cebfc2488662be4b3980fc8d31890a05f38ae9690cc7d9d3efc4808e03da104a8c28bb480bb814995a6e8b8978ab8350d90b3894e3abf7dc4ad0956335752c8d6944b38a1715e7d9950f49e6cdba171fbe651a2ca2665a7c70b6e8cf3a02c2f93dad8aa9506481cdb032d04082a5a6c6a733b6520fa80e2ef57b9cf858ca5ea11e084bc31a386fc6b099f069786207f80d61f2bef294400d59394ad1006431366a54ae09b0ecd3377dcd8af8fde9b94fd559b0b7adc5113ba66fc4b3dc842ee562cfcfd39b4ffc31576635873fc59535b7aa98605772436c251834e234fb2347cc970a49818cac2a9ee95ebb55fa2da66edd53e11245c6732140aae41491288cbf462eef8a807b46d0daffa38d9ccfe8033d2d4a3cf5c5b829df12183f7a05d3650153cd317a017083ac641c2c3ad11305de0a032be45c439bd7bbbe3cb97850f9d2c66f72a4a66e9d434544fc6d294ca3c92627be518bfa44e3017ac8ad9c0a26a227d2e8677da0a4de8edb53ac9530adb6383c72dbf562dc4d0fea4e492f09eb174548381a8686db3aeaaa3a9960cff25e8c64701115da54fa7a1fb2c566afcb4b2a63268d818c3391a62885d1341b3492c4f0167291b3d026a44e68c02f2d4d255d4c0906b92a2ced0c0bbf2bcdceaec1189895af4232dc386c975bf3477e5a70d3ab0ac0e5dc370240e34a276b155d5e290f77416a1986dec47f8c78236ac7df249df9ba21a802e6bd75b4fb1c6ffe0f4cf548761a56a1fcccee156523a718987f3fdaedc7171c9050db89a83f24c5a283695b9c28de6d3b69fc1714b0add335a0ce6fbbdbd0bbdb01e44969d775105bba3d2947dca2f291250f9b851e76f514ddc5a3aa4498e6521314991568860ebff1258d8b4aee9ee4159153684c0c016c60b17537a50b53cd59aad60678bd73f0714ab4ccae7416bab417b490736d59b2e9f

likewise for prime1 (P), prime2 (Q) and
privateExponent (D) and publicExponent (E)

sage: P=0x00c6d6eb9c0f93f8b8de74b2799798c1c1ed47549426a0d76af61f04f0b455184acfeec354c1703709e8727ea0213001738e395b5ca5ed4deec30f8b1ae0e54a516777c5ae897a5562e77dfe378dbba32ee30bcdb275ab7f87f8b9af02712d371a6aa671b44e0f667a6f2d406e5099d942f592ff5c517d452d58cf3f51120062a878fb77066650275b897caf078a5353f1d714963ff90818b6b87c6db438681b4b315c4fd256c1bd383fcf8e67b49a3ee077373a66d77e4c02eebe9350478a51cdfa395d60d905c1189ed7041373f1609075faf9d9f39d3d7b0e7fc8b1d36cb8c5c48731ef5cd87e11f480cdfa4b3ee6cf7eebd3e13f4244647396d52030b82c39d69a3a4075ee90531d1ddb5f1284dc7ab09a3892de5c0ddeed115c7c9ee5fc008658830b0e6f7f366a72f215192498474ade046fc10e92591dfa133e4beff98758e0e92c05f999504a486e3f71c15b73adf7fe0d311f0d0dc1a8e2aff92572475a92e60f970174c80c4948a0cb86635cb438519b18c260ff9f212925e684ef151cc91fa1c4c8dbbc337c9b46f9a93c88cce49e49a670762186e8858051f93ebff7b0b50caadd9b32f93e396b5a6d1cd7f77b2e50e83fae5f3928433268f6cc28810071ce334025a24c7ebf92e631df0d26e99923018946de4ea5e30e868c33ea3d408d8c58815ecf9892fa3afa5f6fbef9a1dfda2da51b6f01f3dae588bdf17b
sage: Q=0x00b073b35a3bba0954b242961630e8e0af8d3ea8aad80d55669e9e79c388983363d96fe471205743001b4798b81de1be3fb06353fd0c9c4fd43f91f9cb2162b00583cc94ff791a615348d01977ca05f4796d5bff41d94dda1cb3ef2433ff4f6500d15ab290a14e651efa91b7df5d5e50f8356188d9842dcdd67c89eb7d40baa78f045969b804f7a985d35a8a8ac32715cb212a34fb89e85e538275e53663fe675944d2b5dba77b7b7abfacd8fbddee4427db6460b728952af882992750c2542d2122247d7f431ec2fe64c0311b0de5290eb619c6ab476308d59f3efff7255d07ebb51fe64ac5967c0b79bae07d36283cf768c8eee2054349cefe90876da66a52e9e0ff20cc00a40fb0c69524e7a01e5c2f07239831a0fa2f56ad405b3a25537907d990e8f5a3e4f3df99dda6afc30d4565aa5881f64adcc6f6be4077893c7e7710623e6158359c3facfef5036779903065fd0d0a2ed8bf2e53a46758dbff06284670bf10bd2e13cba4323ce50fa43df373bd0940011c424f41c5035a10b8095f420ddb67189f6dad62f1257b0f46e353a90eacc145c7db74998a5d0d8772ba1286eb582504465290171e4db87f2e89564214a2317953a7307b1b4c8dad5920866087d7ae80845478813bdf5f6740d0f3b975a344272804b036e4fef09e91d60d1a730fda2f5c222f7636bbe252f9a6caa86d5e8be7e7db2cf912817a0898a4742d
sage: D=0x3b900240c4a416aeb09b123e02f5457bb31023c9249081c5313edaac741686388492020964ce4471a653c9c63c4dc7b74c0188d0ec50bc3a29797da6c9b3616e83dea45ba5d41e6e4cba7eefca6791f45d3c86a491a899a5c42c7e61930a3681d281f34e4b49707e9bba74f68f7a91274c92904b546b5fe6267c5b8ad8d8bb199a523d7fbb5a40748b56dfccf074f3d664e705153dd903b7cd95bac556be3ab59a165d7cbb765e21a4a1d97e34b412baf1caacb57543d2bd8e5ae5cd2a86dc41e256f3f5c0073052859d1c8a12f4973caa88de2e5eb2eef8d6ebdb66fe154d8e383cba74693753affaf4dbc8e2988c08f947b1f8473a7163775656448572c325250ad2cd75c9f5d42721b91ae8fb427773605afa2f4297daf7ab34f5d71144185f3f5cbc94041081fae19fd5d47fc49421080edc5d658b5f223fb1e9b172f4da1a92263fa922225d4c0231e35d94d276fcb0e0999f5f26068528c83f49b0dd79fb157c49fe8b3d80e7cd2b3da76478ebd2ae2c8164583bee2f96591e2f41ad799ae0e2855a5699996fb2c7efb69f86874bca58628e512d579b247e43ee8db04b424e84e44cf753f86e12dd8d2e0ea0b800e6c313317c14658993b8e04c7fb5de1cba0829123dc518957be2a46f76f8ff305fee17b2310bfdd66a93c8b050451f8ceb26c518b7abb72faf08fca0bf6df8a80de511ffc00dc350cd87e52c9cf5771892300e420929da698b6b973da849c89410f089e9b39de79fc1a01a27d2f879ce5cd80ca0a3899d9f480c68d7a5f8c8b3c74936b19f0c7174987df437658046adaffdaddc3540be7fc06a1d2290f58ad9a2992d32e9ecbadf2eed961b4e68c8a89a5709a334082ad297348c4c31c54a3dadccb93afaa9f1786c4167021d4a16dd78afb41131bdd651357bd44f42cfee5d03fdfae087255d18a6a41c03aa6408b6097d8a6848cbbf05a7f20207d5673ea5e6dc849d5d3009c6e8a6c41285cd64f71b536d8345d61f404079278facde0d6e2264cbe655e877468bd3e76380d91f282f26ae17e41a1bac76c148c4c75dd22656816ab259e2c79920e27e6bcfa83732ac6e0a245dcd9cc82f69e45019cf53ac39bebca3ddea0f55ef97b6d8f7b7eadaae792fb1b55c73cf2ed644e651a22c60ed9c0bb063c50fadda6beccbf6c88c41ef1546bab5f21dbe4fbeeb11f3c5c40fa1cc3df2c11bfe7910d1d36a5ec6e66462c7e216481008931039299d23f2be4d838fb010b661a8541a8b7f7bf7d6c8032895e82133e24c835e5a3491249ec69f28e22cf9b0fab9be9ea17026fbadd470eee4676d7ac79976a1c6807e89b5dabab815ffa076caeaeb53f505a31129dac1e9f0b5d919f17aced63574c8524000022b6bc6cb9c8d6a06e44c72e055a1e2706e736af241ab3084fa56cf942aa139440f74e230be31cd8dd4bf0cbdd657f1
sage: E=0x10001

check:
sage: is_pseudoprime(P)
True
sage: gcd(N,P)
811194519730394220204949383061971492284209477134487451053533919242408334468793875483685418435472924384137737409878754330061341487239404629370463160720071782806016579636145456953095810661706004899017496722730291178259805745059054744795252171022091469940626116746608128441399036310378334222880519662696558703165249434265697658704322903051581598088400258377253583825209022558177374913570364047051007093402547387492492645729748176160840842076964161794363721255756097675823463557162877865622894488049720201680509519072521257128596878592149455958732762099800396648453225220977153025222265023206761554302369499402146842619059859650958489842850140873473393484632985863967898676228674751576699965523367097641503814266418957281198265955430221973482931544501209059788536033857660452959160612655542331433647351037413298986228798018950712662579341162832440884265576141868775326408627532047094505284395403786932363148262901839514736964209136867574532808481484592060405175685831168554790879720280778881035860464184791941816702480873202940903024652495084770128062224279875598826600084633389722629461385386069921483006677287847102371176994910369378323222717613076771700378608286670543729473076010314569999636269167049088093674649352610884381826740603
sage: N%P
0

>> P seems to be a prime, and is indeed a factor of N.

sage: is_pseudoprime(Q)
False
sage: gcd(N,Q)
1
sage: ecm(Q)
Found composite factor of 3 digits: 675
Composite cofactor ... has 1231 digits.
Q has a small factor.  The large cofactor
is way too large to be factorized (today).

>> Q must be wrong.

sage: pow(pow(2,E,N),D,N)
2
sage: pow(pow(3,E,N),D,N)
3
sage: pow(pow(5,E,N),D,N)
5
sage: pow(pow(7,E,N),D,N)
7
sage: pow(pow(11,E,N),D,N)
11
sage: pow(pow(1000,E,N),D,N)
1000

>> x^D mod N is indeed the inverse of x^E mod N
>> D seems to be correct.

>> now compute
sage: Qcorrect = N/P
sage: is_prime(Qcorrect)
False
sage: is_pseudoprime(Qcorrect)
True

>> surprise, this is a sage artefact.
>> is_prime is supposed to tell if Qcorrect
>> is a provable prime, but these numbers are
>> too large for a proof.

sage: help(Qcorrect)
class Rational
...

>> oops, it is of course not a rational number.

sage: Qcorrect = Integer(N/P)
class Integer
...

>> okay now it is an integer.

sage: is_prime(Qcorrect)
>> takes way too long: press CTRL-C
sage: is_pseudoprime(Qcorrect)
True

>> so the correct Q seems to be a prime.

sage: Q-Qcorrect
4468358315186607582623830645994123175323958284313904132666602205502546750542721902065776801908141680869902222733839989940221831332787838985874881107673910358472026239723185949529735314601712865712198736991916521419325287976337589177915143787138292689484229106140251936135768934015263941567159094923493376
sage: hex(Q-Qcorrect)
'1a10400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'

>> interesting, now figure out the bits that are flipped in Q:

Q         ...20ddb67189f6dad...
Qcorrect  ...20dd9c6149f6dad...

$ openssl rsa -in rsa8192.pem -outform der -out rsa8192.der
writing RSA key
$ xxd -ps < rsa8192.der > rsa8192.hex
$ sed "s/20ddb67189f6dad/20dd9c6149f6dad/" < rsa8192.hex > rsa8192.out
$ diff rsa8192.hex rsa8192.out
100c100
10b8095f420ddb67189f6dad62f1257b0f46e353a90eacc145c7db74998a
---
10b8095f420dd9c6149f6dad62f1257b0f46e353a90eacc145c7db74998a

>> et voila

$ xxd -ps -r < rsa8192.out > rsa8192.der
$ openssl rsa -inform der -in rsa8192.der -out rsa8192.pem
writing RSA key
$ openssl rsa -check -noout -in rsa8192.pem
RSA key ok
$ git diff
diff --git a/apps/rsa8192.pem b/apps/rsa8192.pem
index 946a6e5..83d962f 100644
--- a/apps/rsa8192.pem
+++ b/apps/rsa8192.pem
@@ -1,5 +1,4 @@
 -----BEGIN RSA PRIVATE KEY-----
-
 MIISKAIBAAKCBAEAiQ2f1X6Bte1DKD0OoCBKEikzPW+5w3oXk3WwnE97Wxzy6wJZ
 ebbZC3CZKKBnJeBMrysPf+lK+9+fP6Vm8bp1wvbcSIA59BDrX6irFSuM/bdnkbuF
 MFlDjt+uVrxwoyqfPi2IPot1HQg3l5mdyBqcTWvbOnU2L9HZxJfPUCjfzdTMPrMY
@@ -62,7 +61,7 @@ JH1/Qx7C/mTAMRsN5SkOthnGq0djCNWfPv/3JV0H67Uf5krFlnwLebrgfTYoPPdo
 yO7iBUNJzv6Qh22malLp4P8gzACkD7DGlSTnoB5cLwcjmDGg+i9WrUBbOiVTeQfZ
 kOj1o+Tz35ndpq/DDUVlqliB9krcxva+QHeJPH53EGI+YVg1nD+s/vUDZ3mQMGX9
 DQou2L8uU6RnWNv/BihGcL8QvS4Ty6QyPOUPpD3zc70JQAEcQk9BxQNaELgJX0IN
-22cYn22tYvElew9G41OpDqzBRcfbdJmKXQ2HcroShutYJQRGUpAXHk24fy6JVkIU
+2cYUn22tYvElew9G41OpDqzBRcfbdJmKXQ2HcroShutYJQRGUpAXHk24fy6JVkIU
 ojF5U6cwextMja1ZIIZgh9eugIRUeIE7319nQNDzuXWjRCcoBLA25P7wnpHWDRpz
 D9ovXCIvdja74lL5psqobV6L5+fbLPkSgXoImKR0LQKCAgAIC9Jk8kxumCyIVGCP
 PeM5Uby9M3GMuKrfYsn0Y5e97+kSJF1dpojTodBgR2KQar6eVrvXt+8uZCcIjfx8
@@ -98,4 +97,3 @@ TwEgE67iOb2iIoUpon/NyP4LesMzvdpsu2JFlfz13PmmQ34mFI7tWvOb3NA5DP3c
 rMlMLtKfp2w8HlMZpsUlToNCx6CI+tJrohzcs3BAVAbjFAXRKWGijB1rxwyDdHPv
 I+/wJTNaRNPQ1M0SwtEL/zJd21y3KSPn4eL+GP3efhlDSjtlDvZqkdAUsU8=
 -----END RSA PRIVATE KEY-----
-

>> DONE.

Fixes #11776

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/11783)

4 years agoReplace misleading error message when loading PEM
Tomas Mraz [Mon, 11 May 2020 15:15:40 +0000 (17:15 +0200)]
Replace misleading error message when loading PEM

The error message "short header" when the end line
of PEM data cannot be identified is misleading.
Replace it with already existing "bad end line" error.

Fixes #8815

Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11793)

4 years agoCORE: Attach the provider context to the provider late
Richard Levitte [Mon, 11 May 2020 09:10:41 +0000 (11:10 +0200)]
CORE: Attach the provider context to the provider late

There are concerns that if |prov->provctx| is populated early,
sensitive information may leak from the provider.  Therefore, we use a
temporary variable, and only assign it to |prov->provctx| when the
provider init function has returned successfully.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11777)

4 years agoFix some misunderstandings in our providers' main modules
Richard Levitte [Sat, 9 May 2020 08:11:14 +0000 (10:11 +0200)]
Fix some misunderstandings in our providers' main modules

This started with adding forward declarations of all provider side
interface functions, and fixing all compiler errors.

Furthermore, diminish the faulty assumption that the provider context
is and always will be just a library context.  That means adding a
teardown function in all providers that aren't necessarily built into
libcrypto.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11777)

4 years agoCORE: Fix the signature of OSSL_provider_query_operation_fn
Richard Levitte [Sat, 9 May 2020 07:59:05 +0000 (09:59 +0200)]
CORE: Fix the signature of OSSL_provider_query_operation_fn

For some reason, the 'no_cache' parameter was declare 'const', when
it's in fact supposed to be modifiable.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11777)

4 years agoFix d2i_PrivateKey_ex() to work as documented
Richard Levitte [Mon, 11 May 2020 07:14:11 +0000 (09:14 +0200)]
Fix d2i_PrivateKey_ex() to work as documented

d2i_PrivateKey(), and thereby d2i_PrivateKey_ex(), is documented to
return keys of the type given as first argument |type|, unconditionally.
Most specifically, the manual says this:

> An error occurs if the decoded key does not match type.

However, when faced of a PKCS#8 wrapped key, |type| was ignored, which
may lead to unexpected results.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11787)

4 years agoFix CHANGES.md issues reported by markdownlint
Richard Levitte [Mon, 11 May 2020 07:55:53 +0000 (09:55 +0200)]
Fix CHANGES.md issues reported by markdownlint

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11788)

4 years agodoc: fix two invalid <B> tags
Beat Bolli [Thu, 7 May 2020 12:19:22 +0000 (14:19 +0200)]
doc: fix two invalid <B> tags

Signed-off-by: Beat Bolli <dev@drbeat.li>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/11759)

4 years agoExtract HTTP server code from apps/ocsp.c to apps/lib/http_server.c
Dr. David von Oheimb [Mon, 4 May 2020 18:29:25 +0000 (20:29 +0200)]
Extract HTTP server code from apps/ocsp.c to apps/lib/http_server.c

Also adds apps/include/http_server.h.
This is used so far by apps/ocsp.c and is going to be used for apps/cmp.c
and will be helpful also for any future app acting as HTTP server.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11736)

4 years agoFix bio_wait() in crypto/bio/bio_lib.c in case OPENSSL_NO_SOCK
Dr. David von Oheimb [Mon, 4 May 2020 18:21:34 +0000 (20:21 +0200)]
Fix bio_wait() in crypto/bio/bio_lib.c in case OPENSSL_NO_SOCK

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11736)

4 years agoConstify 'req' parameter of OSSL_HTTP_post_asn1()
Dr. David von Oheimb [Mon, 4 May 2020 17:54:43 +0000 (19:54 +0200)]
Constify 'req' parameter of OSSL_HTTP_post_asn1()

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11736)