[openssl-commits] Build completed: openssl OpenSSL_1_0_2-stable.19201
Build openssl OpenSSL_1_0_2-stable.19201 completed Commit 29d8bda90c by Andy Polyakov on 8/1/2018 2:33 PM: CHANGES: mention blinding reverting in ECDSA. Configure your notification preferences _ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] Build failed: openssl OpenSSL_1_1_0-stable.19200
Build openssl OpenSSL_1_1_0-stable.19200 failed Commit 24233a0f3c by Andy Polyakov on 8/1/2018 2:09 PM: asn1/tasn_utl.c: fix logical error in and overhaul asn1_do_lock. Configure your notification preferences _ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] [openssl] OpenSSL_1_0_2-stable update
The branch OpenSSL_1_0_2-stable has been updated
via 29d8bda90ce824263317eae5354388f79844dd51 (commit)
via 983e1ad235caa45d710eaa5f0d2de504d782a348 (commit)
via e3ab8cc460d1a43fe6310c8d9a92589db1d4f8a3 (commit)
via 6a815969776e3329fdffcc12c77e047e3a15be78 (commit)
via 83325a68ad5fdfc359ab9d82a0e0da8e5fe7ede1 (commit)
via c9046a05ec0fc3377e1077b401652d76ee5ce908 (commit)
via 327b2c011342280c7fd5e312a4fff2a01083d2d6 (commit)
via c1c0e4f1a358072767860764cd43335fc7316176 (commit)
via 7cca1f96bf82b22ab49f179bae7df1562d0a104b (commit)
from d69f31fcc38878769c8c917f8724c5aef10fd847 (commit)
- Log -
commit 29d8bda90ce824263317eae5354388f79844dd51
Author: Andy Polyakov
Date: Mon Jul 30 12:39:08 2018 +0200
CHANGES: mention blinding reverting in ECDSA.
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
commit 983e1ad235caa45d710eaa5f0d2de504d782a348
Author: Andy Polyakov
Date: Mon Jul 30 12:37:17 2018 +0200
ecdsa/ecs_ossl.c: switch to fixed-length Montgomery multiplication.
(back-ported from commit 37132c9702328940a99b1307f742ab094ef754a7)
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
commit e3ab8cc460d1a43fe6310c8d9a92589db1d4f8a3
Author: Billy Brumley
Date: Wed Jan 20 13:18:21 2016 +0200
Fix BN_gcd errors for some curves
Those even order that do not play nicely with Montgomery arithmetic
(back-ported from commit 3a6a4a93518fbb3d96632bfdcb538d340f29c56b)
Reviewed-by: Andy Polyakov
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
commit 6a815969776e3329fdffcc12c77e047e3a15be78
Author: Andy Polyakov
Date: Wed Jul 25 10:29:51 2018 +0200
bn/bn_mod.c: harmonize BN_mod_add_quick with original implementation.
New implementation failed to correctly reset r->neg flag. Spotted by
OSSFuzz.
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
(cherry picked from commit 70a579ae2f37437a1e02331eeaa84e1b68ba021e)
commit 83325a68ad5fdfc359ab9d82a0e0da8e5fe7ede1
Author: Andy Polyakov
Date: Fri Jul 6 15:55:34 2018 +0200
ecdsa/ecs_ossl.c: revert blinding in ECDSA signature.
Originally suggested solution for "Return Of the Hidden Number Problem"
is arguably too expensive. While it has marginal impact on slower
curves, none to ~6%, optimized implementations suffer real penalties.
Most notably sign with P-256 went more than 2 times[!] slower. Instead,
just implement constant-time BN_mod_add_quick.
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
(cherry picked from commit 3fc7a9b96cbed0c3da6f53c08e34d8d0c982745f)
Resolved onflicts:
crypto/ec/ecdsa_ossl.c
crypto/include/internal/bn_int.h
commit c9046a05ec0fc3377e1077b401652d76ee5ce908
Author: Andy Polyakov
Date: Fri Jul 6 15:13:15 2018 +0200
bn/bn_{mont|exp}.c: switch to zero-padded intermediate vectors.
Note that exported functions maintain original behaviour, so that
external callers won't observe difference. While internally we can
now perform Montogomery multiplication on fixed-length vectors, fixed
at modulus size. The new functions, bn_to_mont_fixed_top and
bn_mul_mont_fixed_top, are declared in bn_int.h, because one can use
them even outside bn, e.g. in RSA, DSA, ECDSA...
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
(cherry picked from commit 71883868ea5b33416ae8283bcc38dd2d97e5006b)
Resolved conflicts:
crypto/bn/bn_exp.c
crypto/bn/bn_lcl.h
crypto/bn/bn_mont.c
crypto/include/internal/bn_int.h
commit 327b2c011342280c7fd5e312a4fff2a01083d2d6
Author: Andy Polyakov
Date: Fri Jul 6 15:02:29 2018 +0200
bn/bn_lib.c: add BN_FLG_FIXED_TOP flag.
The new flag marks vectors that were not treated with bn_correct_top,
in other words such vectors are permitted to be zero padded. For now
it's BN_DEBUG-only flag, as initial use case for zero-padded vectors
would be controlled Montgomery multiplication/exponentiation, not
general purpose. For general purpose use another type might be more
appropriate. Advantage of this suggestion is that it's possible to
back-port it...
bn/bn_div.c: fix memory sanitizer problem.
bn/bn_sqr.c: harmonize with BN_mul.
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6810)
(cherry picked from commit 305b68f1a2b6d4d0aa07a6ab47ac372f067a40bb)
Resolved conflicts:
crypto/bn/bn_lcl.h
crypto/bn/bn_lib.c
commit c1c0e4f1a358072767860764cd43335fc7316176
Author: Andy Polyakov
Date: Fri Jul
[openssl-commits] [openssl] OpenSSL_1_1_0-stable update
The branch OpenSSL_1_1_0-stable has been updated
via 24233a0f3c491919ee3a38e2567271ccc041ee1d (commit)
from c0cc23af26d0363dbd164ceae97ed044e3fd8861 (commit)
- Log -
commit 24233a0f3c491919ee3a38e2567271ccc041ee1d
Author: Andy Polyakov
Date: Tue Jul 31 14:59:14 2018 +0200
asn1/tasn_utl.c: fix logical error in and overhaul asn1_do_lock.
CRYPTO_atomic_add was assumed to return negative value on error, while
it returns 0.
Reviewed-by: Rich Salz
(cherry picked from commit 680b9d45b005c2d0a48fd574db903bf4486b49ae)
---
Summary of changes:
crypto/asn1/tasn_utl.c | 35 +++
1 file changed, 23 insertions(+), 12 deletions(-)
diff --git a/crypto/asn1/tasn_utl.c b/crypto/asn1/tasn_utl.c
index f79d7d6..22e853d 100644
--- a/crypto/asn1/tasn_utl.c
+++ b/crypto/asn1/tasn_utl.c
@@ -57,8 +57,10 @@ int asn1_set_choice_selector(ASN1_VALUE **pval, int value,
int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it)
{
const ASN1_AUX *aux;
-int *lck, ret;
+CRYPTO_REF_COUNT *lck;
CRYPTO_RWLOCK **lock;
+int ret = -1;
+
if ((it->itype != ASN1_ITYPE_SEQUENCE)
&& (it->itype != ASN1_ITYPE_NDEF_SEQUENCE))
return 0;
@@ -67,25 +69,34 @@ int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM
*it)
return 0;
lck = offset2ptr(*pval, aux->ref_offset);
lock = offset2ptr(*pval, aux->ref_lock);
-if (op == 0) {
-*lck = 1;
+
+switch (op) {
+case 0:
+*lck = ret = 1;
*lock = CRYPTO_THREAD_lock_new();
if (*lock == NULL) {
ASN1err(ASN1_F_ASN1_DO_LOCK, ERR_R_MALLOC_FAILURE);
return -1;
}
-return 1;
-}
-if (CRYPTO_atomic_add(lck, op, , *lock) < 0)
-return -1; /* failed */
+break;
+case 1:
+if (!CRYPTO_UP_REF(lck, , *lock))
+return -1;
+break;
+case -1:
+if (!CRYPTO_DOWN_REF(lck, , *lock))
+return -1; /* failed */
#ifdef REF_PRINT
-fprintf(stderr, "%p:%4d:%s\n", it, *lck, it->sname);
+fprintf(stderr, "%p:%4d:%s\n", it, ret, it->sname);
#endif
-REF_ASSERT_ISNT(ret < 0);
-if (ret == 0) {
-CRYPTO_THREAD_lock_free(*lock);
-*lock = NULL;
+REF_ASSERT_ISNT(ret < 0);
+if (ret == 0) {
+CRYPTO_THREAD_lock_free(*lock);
+*lock = NULL;
+}
+break;
}
+
return ret;
}
_
openssl-commits mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] [openssl] master update
The branch master has been updated
via 680b9d45b005c2d0a48fd574db903bf4486b49ae (commit)
from f52292be10cb42c25ae83be969d3ad469ea7cb4e (commit)
- Log -
commit 680b9d45b005c2d0a48fd574db903bf4486b49ae
Author: Andy Polyakov
Date: Tue Jul 31 14:59:14 2018 +0200
asn1/tasn_utl.c: fix logical error in and overhaul asn1_do_lock.
CRYPTO_atomic_add was assumed to return negative value on error, while
it returns 0.
Reviewed-by: Rich Salz
---
Summary of changes:
crypto/asn1/tasn_utl.c | 35 +++
1 file changed, 23 insertions(+), 12 deletions(-)
diff --git a/crypto/asn1/tasn_utl.c b/crypto/asn1/tasn_utl.c
index a93fd87..7ceecff 100644
--- a/crypto/asn1/tasn_utl.c
+++ b/crypto/asn1/tasn_utl.c
@@ -58,8 +58,10 @@ int asn1_set_choice_selector(ASN1_VALUE **pval, int value,
int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it)
{
const ASN1_AUX *aux;
-int *lck, ret;
+CRYPTO_REF_COUNT *lck;
CRYPTO_RWLOCK **lock;
+int ret = -1;
+
if ((it->itype != ASN1_ITYPE_SEQUENCE)
&& (it->itype != ASN1_ITYPE_NDEF_SEQUENCE))
return 0;
@@ -68,25 +70,34 @@ int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM
*it)
return 0;
lck = offset2ptr(*pval, aux->ref_offset);
lock = offset2ptr(*pval, aux->ref_lock);
-if (op == 0) {
-*lck = 1;
+
+switch (op) {
+case 0:
+*lck = ret = 1;
*lock = CRYPTO_THREAD_lock_new();
if (*lock == NULL) {
ASN1err(ASN1_F_ASN1_DO_LOCK, ERR_R_MALLOC_FAILURE);
return -1;
}
-return 1;
-}
-if (CRYPTO_atomic_add(lck, op, , *lock) < 0)
-return -1; /* failed */
+break;
+case 1:
+if (!CRYPTO_UP_REF(lck, , *lock))
+return -1;
+break;
+case -1:
+if (!CRYPTO_DOWN_REF(lck, , *lock))
+return -1; /* failed */
#ifdef REF_PRINT
-fprintf(stderr, "%p:%4d:%s\n", it, *lck, it->sname);
+fprintf(stderr, "%p:%4d:%s\n", it, ret, it->sname);
#endif
-REF_ASSERT_ISNT(ret < 0);
-if (ret == 0) {
-CRYPTO_THREAD_lock_free(*lock);
-*lock = NULL;
+REF_ASSERT_ISNT(ret < 0);
+if (ret == 0) {
+CRYPTO_THREAD_lock_free(*lock);
+*lock = NULL;
+}
+break;
}
+
return ret;
}
_
openssl-commits mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] [openssl] master update
The branch master has been updated via ed4fc85359d40bd06a53af9c8a058b8d3e4e3e39 (commit) from 43a0f2733a943799060ea275516fcce00d89eb38 (commit) - Log - commit ed4fc85359d40bd06a53af9c8a058b8d3e4e3e39 Author: Rich Salz Date: Tue Jul 31 11:36:44 2018 -0400 Some protocol versions are build-time Clarify docs to list that some protocol flags might not be available depending on how OpenSSL was build. Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/6816) --- Summary of changes: doc/man1/ciphers.pod | 28 +--- doc/man1/s_client.pod | 2 ++ doc/man1/s_server.pod | 2 ++ doc/man1/s_time.pod | 7 +-- 4 files changed, 14 insertions(+), 25 deletions(-) diff --git a/doc/man1/ciphers.pod b/doc/man1/ciphers.pod index e3278eb..3aea982 100644 --- a/doc/man1/ciphers.pod +++ b/doc/man1/ciphers.pod @@ -73,30 +73,12 @@ L. Like B<-v>, but include the official cipher suite values in hex. -=item B<-tls1_3> +=item B<-tls1_3>, B<-tls1_2>, B<-tls1_1>, B<-tls1>, B<-ssl3> -In combination with the B<-s> option, list the ciphers which would be used if -TLSv1.3 were negotiated. - -=item B<-tls1_2> - -In combination with the B<-s> option, list the ciphers which would be used if -TLSv1.2 were negotiated. - -=item B<-ssl3> - -In combination with the B<-s> option, list the ciphers which would be used if -SSLv3 were negotiated. - -=item B<-tls1> - -In combination with the B<-s> option, list the ciphers which would be used if -TLSv1 were negotiated. - -=item B<-tls1_1> - -In combination with the B<-s> option, list the ciphers which would be used if -TLSv1.1 were negotiated. +In combination with the B<-s> option, list the ciphers which could be used if +the specified protocol were negotiated. +Note that not all protocols and flags may be available, depending on how +OpenSSL was built. =item B<-stdname> diff --git a/doc/man1/s_client.pod b/doc/man1/s_client.pod index 7d92dd8..80152e1 100644 --- a/doc/man1/s_client.pod +++ b/doc/man1/s_client.pod @@ -473,6 +473,8 @@ By default B will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be offered to and accepted from the server. +Note that not all protocols and flags may be available, depending on how +OpenSSL was built. =item B<-dtls>, B<-dtls1>, B<-dtls1_2> diff --git a/doc/man1/s_server.pod b/doc/man1/s_server.pod index 5399096..07016fc 100644 --- a/doc/man1/s_server.pod +++ b/doc/man1/s_server.pod @@ -532,6 +532,8 @@ By default B will negotiate the highest mutually supported protocol version. When a specific TLS version is required, only that version will be accepted from the client. +Note that not all protocols and flags may be available, depending on how +OpenSSL was built. =item B<-bugs> diff --git a/doc/man1/s_time.pod b/doc/man1/s_time.pod index e5b8af4..d17e137 100644 --- a/doc/man1/s_time.pod +++ b/doc/man1/s_time.pod @@ -112,16 +112,19 @@ specified, they are both on by default and executed in sequence. =item B<-ssl3> -These options disable the use of certain SSL or TLS protocols. By default +This option disables the use of SSL version 3. By default the initial handshake uses a method which should be compatible with all servers and permit them to use SSL v3 or TLS as appropriate. + The timing program is not as rich in options to turn protocols on and off as the L program and may not connect to all servers. - Unfortunately there are a lot of ancient and broken servers in use which cannot handle this technique and will fail to connect. Some servers only work if TLS is turned off with the B<-ssl3> option. +Note that this option may not be available, depending on how +OpenSSL was built. + =item B<-bugs> There are several known bug in SSL and TLS implementations. Adding this _ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] [openssl] master update
The branch master has been updated
via 43a0f2733a943799060ea275516fcce00d89eb38 (commit)
from 50db81633ece00593b245afed0ed9480d7ffb334 (commit)
- Log -
commit 43a0f2733a943799060ea275516fcce00d89eb38
Author: Matt Caswell
Date: Mon Jul 30 09:13:14 2018 +0100
Fix some TLSv1.3 alert issues
Ensure that the certificate required alert actually gets sent (and doesn't
get translated into handshake failure in TLSv1.3).
Ensure that proper reason codes are given for the new TLSv1.3 alerts.
Remove an out of date macro for TLS13_AD_END_OF_EARLY_DATA. This is a left
over from an earlier TLSv1.3 draft that is no longer used.
Fixes #6804
Reviewed-by: Tim Hudson
(Merged from https://github.com/openssl/openssl/pull/6809)
---
Summary of changes:
crypto/err/openssl.ec | 2 ++
include/openssl/sslerr.h| 2 ++
include/openssl/tls1.h | 1 -
ssl/ssl_err.c | 4
ssl/tls13_enc.c | 3 ++-
test/ssl-tests/04-client_auth.conf | 2 +-
test/ssl-tests/04-client_auth.conf.in | 4 +++-
test/ssl-tests/26-tls13_client_auth.conf| 2 +-
test/ssl-tests/26-tls13_client_auth.conf.in | 2 +-
test/ssl_test_ctx.c | 1 +
10 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/crypto/err/openssl.ec b/crypto/err/openssl.ec
index 7fc5788..3e092ea 100644
--- a/crypto/err/openssl.ec
+++ b/crypto/err/openssl.ec
@@ -67,10 +67,12 @@ R SSL_R_TLSV1_ALERT_INTERNAL_ERROR 1080
R SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK 1086
R SSL_R_TLSV1_ALERT_USER_CANCELLED 1090
R SSL_R_TLSV1_ALERT_NO_RENEGOTIATION1100
+R SSL_R_TLSV13_ALERT_MISSING_EXTENSION 1109
R SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110
R SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE
R SSL_R_TLSV1_UNRECOGNIZED_NAME 1112
R SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE 1113
R SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE1114
R TLS1_AD_UNKNOWN_PSK_IDENTITY 1115
+R SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED 1116
R TLS1_AD_NO_APPLICATION_PROTOCOL 1120
diff --git a/include/openssl/sslerr.h b/include/openssl/sslerr.h
index a5b2c55..87b295c 100644
--- a/include/openssl/sslerr.h
+++ b/include/openssl/sslerr.h
@@ -695,6 +695,8 @@ int ERR_load_SSL_strings(void);
# define SSL_R_SSL_SESSION_ID_TOO_LONG408
# define SSL_R_SSL_SESSION_VERSION_MISMATCH 210
# define SSL_R_STILL_IN_INIT 121
+# define SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED 1116
+# define SSL_R_TLSV13_ALERT_MISSING_EXTENSION 1109
# define SSL_R_TLSV1_ALERT_ACCESS_DENIED 1049
# define SSL_R_TLSV1_ALERT_DECODE_ERROR 1050
# define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED 1021
diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
index 37bdc7d..761a86a 100644
--- a/include/openssl/tls1.h
+++ b/include/openssl/tls1.h
@@ -70,7 +70,6 @@ extern "C" {
# define TLS1_AD_USER_CANCELLED 90
# define TLS1_AD_NO_RENEGOTIATION100
/* TLSv1.3 alerts */
-# define TLS13_AD_END_OF_EARLY_DATA 1
# define TLS13_AD_MISSING_EXTENSION 109 /* fatal */
# define TLS13_AD_CERTIFICATE_REQUIRED 116 /* fatal */
/* codes 110-114 are from RFC3546 */
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index d3e8056..11331ce 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -1137,6 +1137,10 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_SESSION_VERSION_MISMATCH),
"ssl session version mismatch"},
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_STILL_IN_INIT), "still in init"},
+{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED),
+"tlsv13 alert certificate required"},
+{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV13_ALERT_MISSING_EXTENSION),
+"tlsv13 alert missing extension"},
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_ALERT_ACCESS_DENIED),
"tlsv1 alert access denied"},
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_ALERT_DECODE_ERROR),
diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index 264381b..48990fd 100644
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -701,7 +701,8 @@ int tls13_update_key(SSL *s, int sending)
int tls13_alert_code(int code)
{
-if (code == SSL_AD_MISSING_EXTENSION)
+/* There are 2 additional alerts in TLSv1.3 compared to TLSv1.2 */
+if (code == SSL_AD_MISSING_EXTENSION || code ==
SSL_AD_CERTIFICATE_REQUIRED)
return code;
return tls1_alert_code(code);
diff --git a/test/ssl-tests/04-client_auth.conf
b/test/ssl-tests/04-client_auth.conf
index 5696394..8debb66 100644
--- a/test/ssl-tests/04-client_auth.conf
+++
[openssl-commits] Still FAILED build of OpenSSL branch master with options -d --strict-warnings no-md5
Platform and configuration command: $ uname -a Linux run 4.4.0-119-generic #143-Ubuntu SMP Mon Apr 2 16:08:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux $ CC=clang ../openssl/config -d --strict-warnings no-md5 Commit log since last time: bff0f2b Ensure symbols don't get deprecated too early ed4fc85 Some protocol versions are build-time 43a0f27 Fix some TLSv1.3 alert issues 50db816 Deprecate the EC curve type specific functions in 1.2.0 9cc570d Use the new non-curve type specific EC functions internally de34e45 Add documentation for the new non-curve type specific EC functions 8e3cced Provide EC functions that are not curve type specific 3d3cbce Check return from BN_sub 35c9408 Check conversion return in ASN1_INTEGER_print_bio. Build log ended with (last 100 lines): $ CC=clang ../openssl/config -d --strict-warnings no-md5 Operating system: x86_64-whatever-linux2 Failure! build file wasn't produced. Please read INSTALL and associated NOTES files. You may also have to look over your available compiler tool chain or change your configuration. * Unsupported options: no-md5 $ make clean make: *** No rule to make target 'clean'. Stop. _ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] [openssl] master update
The branch master has been updated
via 50db81633ece00593b245afed0ed9480d7ffb334 (commit)
via 9cc570d4c419e2ca97e2173dc14c484195502dd4 (commit)
via de34e45a64f0865264b826255adbe7aee7470780 (commit)
via 8e3cced75fb5fee5da59ebef9605d403a999391b (commit)
from 3d3cbce550ff5d6172cf28dbbf80bda93f6577a9 (commit)
- Log -
commit 50db81633ece00593b245afed0ed9480d7ffb334
Author: Matt Caswell
Date: Mon Jul 30 16:56:41 2018 +0100
Deprecate the EC curve type specific functions in 1.2.0
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6815)
commit 9cc570d4c419e2ca97e2173dc14c484195502dd4
Author: Matt Caswell
Date: Mon Jul 30 16:40:18 2018 +0100
Use the new non-curve type specific EC functions internally
Fixes #6646
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6815)
commit de34e45a64f0865264b826255adbe7aee7470780
Author: Matt Caswell
Date: Mon Jul 30 16:06:12 2018 +0100
Add documentation for the new non-curve type specific EC functions
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6815)
commit 8e3cced75fb5fee5da59ebef9605d403a999391b
Author: Matt Caswell
Date: Mon Jul 30 15:39:41 2018 +0100
Provide EC functions that are not curve type specific
Some EC functions exist in *_GFp and *_GF2m forms, in spite of the
implementations between the two curve types being identical. This
commit provides equivalent generic functions with the *_GFp and *_GF2m
forms just calling the generic functions.
Reviewed-by: Rich Salz
(Merged from https://github.com/openssl/openssl/pull/6815)
---
Summary of changes:
apps/ecparam.c| 2 +-
crypto/ec/ec2_oct.c | 11 ++-
crypto/ec/ec2_smpl.c | 12 ++--
crypto/ec/ec_asn1.c | 22 ++
crypto/ec/ec_curve.c | 2 +-
crypto/ec/ec_cvt.c| 4 +-
crypto/ec/ec_err.c| 8 +++
crypto/ec/ec_key.c| 29 ++--
crypto/ec/ec_lcl.h| 9 ++-
crypto/ec/ec_lib.c| 125 --
crypto/ec/ec_oct.c| 46 +
crypto/ec/ecdh_ossl.c | 17 +
crypto/ec/ecdsa_ossl.c| 39 +++
crypto/ec/eck_prn.c | 17 ++---
crypto/ec/ecp_nistp224.c | 2 +-
crypto/ec/ecp_nistp256.c | 2 +-
crypto/ec/ecp_nistp521.c | 2 +-
crypto/ec/ecp_oct.c | 11 ++-
crypto/ec/ecp_smpl.c | 4 +-
crypto/err/openssl.txt| 5 ++
crypto/sm2/sm2_crypt.c| 12 ++--
crypto/sm2/sm2_sign.c | 4 +-
crypto/sm2/sm2_za.c | 10 +--
doc/man3/EC_GROUP_new.pod | 48 -
doc/man3/EC_POINT_new.pod | 64 +-
include/openssl/ec.h | 167 +++---
include/openssl/ecerr.h | 5 ++
test/ecstresstest.c | 11 ++-
test/ectest.c | 131
test/sm2_internal_test.c | 4 +-
util/libcrypto.num| 25 ---
31 files changed, 450 insertions(+), 400 deletions(-)
diff --git a/apps/ecparam.c b/apps/ecparam.c
index 2290242..917f1a8 100644
--- a/apps/ecparam.c
+++ b/apps/ecparam.c
@@ -299,7 +299,7 @@ int ecparam_main(int argc, char **argv)
goto end;
}
-if (!EC_GROUP_get_curve_GFp(group, ec_p, ec_a, ec_b, NULL))
+if (!EC_GROUP_get_curve(group, ec_p, ec_a, ec_b, NULL))
goto end;
if ((point = EC_GROUP_get0_generator(group)) == NULL)
diff --git a/crypto/ec/ec2_oct.c b/crypto/ec/ec2_oct.c
index 24c32ae..d515dab 100644
--- a/crypto/ec/ec2_oct.c
+++ b/crypto/ec/ec2_oct.c
@@ -94,7 +94,7 @@ int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP
*group,
}
}
-if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx))
+if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
goto err;
ret = 1;
@@ -166,7 +166,7 @@ size_t ec_GF2m_simple_point2oct(const EC_GROUP *group,
const EC_POINT *point,
if (yxi == NULL)
goto err;
-if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx))
+if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
goto err;
buf[0] = form;
@@ -301,8 +301,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group,
EC_POINT *point,
}
if (form == POINT_CONVERSION_COMPRESSED) {
-if (!EC_POINT_set_compressed_coordinates_GF2m
-(group, point, x, y_bit, ctx))
+if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
goto err;
} else {
if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
@@ -321,10 +320,10 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group,
EC_POINT *point,
}
/*
- *
[openssl-commits] [openssl] master update
The branch master has been updated
via bff0f2badc4e692c50757b5632badcba5d94fa04 (commit)
from ed4fc85359d40bd06a53af9c8a058b8d3e4e3e39 (commit)
- Log -
commit bff0f2badc4e692c50757b5632badcba5d94fa04
Author: Richard Levitte
Date: Tue Jul 31 07:19:06 2018 +0200
Ensure symbols don't get deprecated too early
There are symbols we've marked for deprecation in OpenSSL 1.2.0. We
must ensure that they don't actually become deprecated before that.
Fixes #6814
Reviewed-by: Paul Dale
(Merged from https://github.com/openssl/openssl/pull/6824)
---
Summary of changes:
include/openssl/opensslconf.h.in | 10 +-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/openssl/opensslconf.h.in b/include/openssl/opensslconf.h.in
index b793d48..bc98cad 100644
--- a/include/openssl/opensslconf.h.in
+++ b/include/openssl/opensslconf.h.in
@@ -9,6 +9,8 @@
* https://www.openssl.org/source/license.html
*/
+#include
+
#ifdef __cplusplus
extern "C" {
#endif
@@ -97,7 +99,13 @@ extern "C" {
# define OPENSSL_API_COMPAT OPENSSL_MIN_API
#endif
-#if OPENSSL_API_COMPAT < 0x1020L
+/*
+ * Do not deprecate things to be deprecated in version 1.2.0 before the
+ * OpenSSL version number matches.
+ */
+#if OPENSSL_VERSION_NUMBER < 0x1020L
+# define DEPRECATEDIN_1_2_0(f) f;
+#elif OPENSSL_API_COMPAT < 0x1020L
# define DEPRECATEDIN_1_2_0(f) DECLARE_DEPRECATED(f)
#else
# define DEPRECATEDIN_1_2_0(f)
_
openssl-commits mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] [openssl] master update
The branch master has been updated
via f52292be10cb42c25ae83be969d3ad469ea7cb4e (commit)
from bff0f2badc4e692c50757b5632badcba5d94fa04 (commit)
- Log -
commit f52292be10cb42c25ae83be969d3ad469ea7cb4e
Author: Pauli
Date: Wed Aug 1 11:58:39 2018 +1000
Add OIDs for HMAC SHA512/224 and HMAC SHA512/256.
Reviewed-by: Tim Hudson
(Merged from https://github.com/openssl/openssl/pull/6830)
---
Summary of changes:
crypto/evp/evp_pbe.c | 2 ++
crypto/objects/obj_dat.h | 20 +++-
crypto/objects/obj_mac.num | 2 ++
crypto/objects/objects.txt | 4
fuzz/oids.txt | 2 ++
include/openssl/obj_mac.h | 8
6 files changed, 33 insertions(+), 5 deletions(-)
diff --git a/crypto/evp/evp_pbe.c b/crypto/evp/evp_pbe.c
index 7a3c61d..0cebd2d 100644
--- a/crypto/evp/evp_pbe.c
+++ b/crypto/evp/evp_pbe.c
@@ -73,6 +73,8 @@ static const EVP_PBE_CTL builtin_pbe[] = {
NID_id_GostR3411_2012_256, 0},
{EVP_PBE_TYPE_PRF, NID_id_tc26_hmac_gost_3411_2012_512, -1,
NID_id_GostR3411_2012_512, 0},
+{EVP_PBE_TYPE_PRF, NID_hmacWithSHA512_224, -1, NID_sha512_224, 0},
+{EVP_PBE_TYPE_PRF, NID_hmacWithSHA512_256, -1, NID_sha512_256, 0},
{EVP_PBE_TYPE_KDF, NID_id_pbkdf2, -1, -1, PKCS5_v2_PBKDF2_keyivgen},
#ifndef OPENSSL_NO_SCRYPT
{EVP_PBE_TYPE_KDF, NID_id_scrypt, -1, -1, PKCS5_v2_scrypt_keyivgen}
diff --git a/crypto/objects/obj_dat.h b/crypto/objects/obj_dat.h
index 6d66d07..e931f7f 100644
--- a/crypto/objects/obj_dat.h
+++ b/crypto/objects/obj_dat.h
@@ -10,7 +10,7 @@
*/
/* Serialized OID's */
-static const unsigned char so[7746] = {
+static const unsigned char so[7762] = {
0x2A,0x86,0x48,0x86,0xF7,0x0D, /* [0] OBJ_rsadsi */
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,/* [6] OBJ_pkcs */
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x02, /* [ 13] OBJ_md2 */
@@ -1074,9 +1074,11 @@ static const unsigned char so[7746] = {
0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x02, /* [ 7718]
OBJ_id_tc26_gost_3410_2012_256_paramSetB */
0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x03, /* [ 7727]
OBJ_id_tc26_gost_3410_2012_256_paramSetC */
0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x04, /* [ 7736]
OBJ_id_tc26_gost_3410_2012_256_paramSetD */
+0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x0C, /* [ 7745]
OBJ_hmacWithSHA512_224 */
+0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x0D, /* [ 7753]
OBJ_hmacWithSHA512_256 */
};
-#define NUM_NID 1193
+#define NUM_NID 1195
static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"UNDEF", "undefined", NID_undef},
{"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, [0]},
@@ -2271,9 +2273,11 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"magma-cbc", "magma-cbc", NID_magma_cbc},
{"magma-cfb", "magma-cfb", NID_magma_cfb},
{"magma-mac", "magma-mac", NID_magma_mac},
+{"hmacWithSHA512-224", "hmacWithSHA512-224", NID_hmacWithSHA512_224, 8,
[7745]},
+{"hmacWithSHA512-256", "hmacWithSHA512-256", NID_hmacWithSHA512_256, 8,
[7753]},
};
-#define NUM_SN 1184
+#define NUM_SN 1186
static const unsigned int sn_objs[NUM_SN] = {
364,/* "AD_DVCS" */
419,/* "AES-128-CBC" */
@@ -2757,6 +2761,8 @@ static const unsigned int sn_objs[NUM_SN] = {
799,/* "hmacWithSHA256" */
800,/* "hmacWithSHA384" */
801,/* "hmacWithSHA512" */
+1193,/* "hmacWithSHA512-224" */
+1194,/* "hmacWithSHA512-256" */
432,/* "holdInstructionCallIssuer" */
430,/* "holdInstructionCode" */
431,/* "holdInstructionNone" */
@@ -3461,7 +3467,7 @@ static const unsigned int sn_objs[NUM_SN] = {
1093,/* "x509ExtAdmission" */
};
-#define NUM_LN 1184
+#define NUM_LN 1186
static const unsigned int ln_objs[NUM_LN] = {
363,/* "AD Time Stamping" */
405,/* "ANSI X9.62" */
@@ -3981,6 +3987,8 @@ static const unsigned int ln_objs[NUM_LN] = {
799,/* "hmacWithSHA256" */
800,/* "hmacWithSHA384" */
801,/* "hmacWithSHA512" */
+1193,/* "hmacWithSHA512-224" */
+1194,/* "hmacWithSHA512-256" */
486,/* "homePostalAddress" */
473,/* "homeTelephoneNumber" */
466,/* "host" */
@@ -4649,7 +4657,7 @@ static const unsigned int ln_objs[NUM_LN] = {
125,/* "zlib compression" */
};
-#define NUM_OBJ 1069
+#define NUM_OBJ 1071
static const unsigned int obj_objs[NUM_OBJ] = {
0,/* OBJ_undef0 */
181,/* OBJ_iso 1 */
@@ -5161,6 +5169,8 @@ static const unsigned int obj_objs[NUM_OBJ] = {
799,/* OBJ_hmacWithSHA256 1 2 840 113549 2 9 */
800,/* OBJ_hmacWithSHA384 1 2 840 113549 2 10 */
801,/* OBJ_hmacWithSHA512 1 2 840 113549 2
[openssl-commits] Build failed: openssl master.19190
Build openssl master.19190 failed Commit 2c5ce0c981 by Rich Salz on 7/31/2018 4:08 PM: Rename internal _CONF_xxx to conf_xxx Configure your notification preferences _ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
[openssl-commits] Build completed: openssl master.19191
Build openssl master.19191 completed Commit c8de417d7b by Rich Salz on 7/31/2018 4:08 PM: Rename internal _CONF_xxx to conf_xxx Configure your notification preferences _ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
