Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update pre8

Browse Source
This commit is contained in:
Hakase
2018-06-07 20:13:07 +09:00
parent 5aee3a55b9
commit 7b0e27998c
21 changed files with 568 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INSTALL
+2 -1
View File
@@ -2,7 +2,8 @@
--------------------
This document describes installation on all supported operating
systems (the Linux/Unix family including Mac OS/X, OpenVMS and Windows)
systems (the Unix/Linux family (which includes Mac OS/X), OpenVMS,
and Windows).
To install OpenSSL, you will need:
apps/dsaparam.c
+6
View File
@@ -128,6 +128,12 @@ int dsaparam_main(int argc, char **argv)
goto end;
if (numbits > 0) {
if (numbits > OPENSSL_DSA_MAX_MODULUS_BITS)
BIO_printf(bio_err,
"Warning: It is not recommended to use more than %d bit for DSA keys.\n"
" Your key size is %d! Larger key size may behave not as expected.\n",
OPENSSL_DSA_MAX_MODULUS_BITS, numbits);
cb = BN_GENCB_new();
if (cb == NULL) {
BIO_printf(bio_err, "Error allocating BN_GENCB object\n");
apps/gendsa.c
+7
View File
@@ -117,6 +117,13 @@ int gendsa_main(int argc, char **argv)
goto end2;
DSA_get0_pqg(dsa, &p, NULL, NULL);
if (BN_num_bits(p) > OPENSSL_DSA_MAX_MODULUS_BITS)
BIO_printf(bio_err,
"Warning: It is not recommended to use more than %d bit for DSA keys.\n"
" Your key size is %d! Larger key size may behave not as expected.\n",
OPENSSL_DSA_MAX_MODULUS_BITS, BN_num_bits(p));
BIO_printf(bio_err, "Generating DSA key, %d bits\n", BN_num_bits(p));
if (!DSA_generate_key(dsa))
goto end;
apps/genrsa.c
+5
View File
@@ -123,6 +123,11 @@ opthelp:
if (argc == 1) {
if (!opt_int(argv[0], &num) || num <= 0)
goto end;
if (num > OPENSSL_RSA_MAX_MODULUS_BITS)
BIO_printf(bio_err,
"Warning: It is not recommended to use more than %d bit for RSA keys.\n"
" Your key size is %d! Larger key size may behave not as expected.\n",
OPENSSL_RSA_MAX_MODULUS_BITS, num);
} else if (argc > 0) {
BIO_printf(bio_err, "Extra arguments given.\n");
goto opthelp;
apps/req.c
+14
View File
@@ -517,6 +517,20 @@ int req_main(int argc, char **argv)
goto end;
}
if (pkey_type == EVP_PKEY_RSA && newkey > OPENSSL_RSA_MAX_MODULUS_BITS)
BIO_printf(bio_err,
"Warning: It is not recommended to use more than %d bit for RSA keys.\n"
" Your key size is %ld! Larger key size may behave not as expected.\n",
OPENSSL_RSA_MAX_MODULUS_BITS, newkey);
#ifndef OPENSSL_NO_DSA
if (pkey_type == EVP_PKEY_DSA && newkey > OPENSSL_DSA_MAX_MODULUS_BITS)
BIO_printf(bio_err,
"Warning: It is not recommended to use more than %d bit for DSA keys.\n"
" Your key size is %ld! Larger key size may behave not as expected.\n",
OPENSSL_DSA_MAX_MODULUS_BITS, newkey);
#endif
if (genctx == NULL) {
genctx = set_keygen_ctx(NULL, &pkey_type, &newkey,
&keyalgstr, gen_eng);
crypto/chacha/asm/chacha-ppc.pl
+407 -8
View File
@@ -18,19 +18,31 @@
#
# ChaCha20 for PowerPC/AltiVec.
#
# June 2018
#
# Add VSX 2.07 code path. Original 3xAltiVec+1xIALU is well-suited for
# processors that can't issue more than one vector instruction per
# cycle. But POWER8 (and POWER9) can issue a pair, and vector-only 4x
# interleave would perform better. Incidentally PowerISA 2.07 (first
# implemented by POWER8) defined new usable instructions, hence 4xVSX
# code path...
#
# Performance in cycles per byte out of large buffer.
#
# IALU/gcc-4.x 3xAltiVec+1xIALU
# IALU/gcc-4.x 3xAltiVec+1xIALU 4xVSX
#
# Freescale e300 13.6/+115% -
# PPC74x0/G4e 6.81/+310% 3.81
# PPC970/G5 9.29/+160% ?
# POWER7 8.62/+61% 3.35
# POWER8 8.70/+51% 2.91
# POWER9 8.80/+29% 4.44(*)
# Freescale e300 13.6/+115% - -
# PPC74x0/G4e 6.81/+310% 3.81 -
# PPC970/G5 9.29/+160% ? -
# POWER7 8.62/+61% 3.35 -
# POWER8 8.70/+51% 2.91 2.09
# POWER9 8.80/+29% 4.44(*) 2.45(**)
#
# (*) this is trade-off result, it's possible to improve it, but
# then it would negatively affect all others;
# (**) POWER9 seems to be "allergic" to mixing vector and integer
# instructions, which is why switch to vector-only code pays
# off that much;
$flavour = shift;
@@ -893,7 +905,390 @@ Ldone_vmx:
.byte 0,12,0x04,1,0x80,18,5,0
.long 0
.size .ChaCha20_ctr32_vmx,.-.ChaCha20_ctr32_vmx
___
}}}
{{{
my ($xa0,$xa1,$xa2,$xa3, $xb0,$xb1,$xb2,$xb3,
$xc0,$xc1,$xc2,$xc3, $xd0,$xd1,$xd2,$xd3) = map("v$_",(0..15));
my @K = map("v$_",(16..19));
my $CTR = "v26";
my ($xt0,$xt1,$xt2,$xt3) = map("v$_",(27..30));
my ($sixteen,$twelve,$eight,$seven) = ($xt0,$xt1,$xt2,$xt3);
my $beperm = "v31";
my ($x00,$x10,$x20,$x30) = (0, map("r$_",(8..10)));
my $FRAME=$LOCALS+64+7*16; # 7*16 is for v26-v31 offload
sub VSX_lane_ROUND {
my ($a0,$b0,$c0,$d0)=@_;
my ($a1,$b1,$c1,$d1)=map(($_&~3)+(($_+1)&3),($a0,$b0,$c0,$d0));
my ($a2,$b2,$c2,$d2)=map(($_&~3)+(($_+1)&3),($a1,$b1,$c1,$d1));
my ($a3,$b3,$c3,$d3)=map(($_&~3)+(($_+1)&3),($a2,$b2,$c2,$d2));
my @x=map("\"v$_\"",(0..15));
(
"&vadduwm (@x[$a0],@x[$a0],@x[$b0])", # Q1
"&vadduwm (@x[$a1],@x[$a1],@x[$b1])", # Q2
"&vadduwm (@x[$a2],@x[$a2],@x[$b2])", # Q3
"&vadduwm (@x[$a3],@x[$a3],@x[$b3])", # Q4
"&vxor (@x[$d0],@x[$d0],@x[$a0])",
"&vxor (@x[$d1],@x[$d1],@x[$a1])",
"&vxor (@x[$d2],@x[$d2],@x[$a2])",
"&vxor (@x[$d3],@x[$d3],@x[$a3])",
"&vrlw (@x[$d0],@x[$d0],'$sixteen')",
"&vrlw (@x[$d1],@x[$d1],'$sixteen')",
"&vrlw (@x[$d2],@x[$d2],'$sixteen')",
"&vrlw (@x[$d3],@x[$d3],'$sixteen')",
"&vadduwm (@x[$c0],@x[$c0],@x[$d0])",
"&vadduwm (@x[$c1],@x[$c1],@x[$d1])",
"&vadduwm (@x[$c2],@x[$c2],@x[$d2])",
"&vadduwm (@x[$c3],@x[$c3],@x[$d3])",
"&vxor (@x[$b0],@x[$b0],@x[$c0])",
"&vxor (@x[$b1],@x[$b1],@x[$c1])",
"&vxor (@x[$b2],@x[$b2],@x[$c2])",
"&vxor (@x[$b3],@x[$b3],@x[$c3])",
"&vrlw (@x[$b0],@x[$b0],'$twelve')",
"&vrlw (@x[$b1],@x[$b1],'$twelve')",
"&vrlw (@x[$b2],@x[$b2],'$twelve')",
"&vrlw (@x[$b3],@x[$b3],'$twelve')",
"&vadduwm (@x[$a0],@x[$a0],@x[$b0])",
"&vadduwm (@x[$a1],@x[$a1],@x[$b1])",
"&vadduwm (@x[$a2],@x[$a2],@x[$b2])",
"&vadduwm (@x[$a3],@x[$a3],@x[$b3])",
"&vxor (@x[$d0],@x[$d0],@x[$a0])",
"&vxor (@x[$d1],@x[$d1],@x[$a1])",
"&vxor (@x[$d2],@x[$d2],@x[$a2])",
"&vxor (@x[$d3],@x[$d3],@x[$a3])",
"&vrlw (@x[$d0],@x[$d0],'$eight')",
"&vrlw (@x[$d1],@x[$d1],'$eight')",
"&vrlw (@x[$d2],@x[$d2],'$eight')",
"&vrlw (@x[$d3],@x[$d3],'$eight')",
"&vadduwm (@x[$c0],@x[$c0],@x[$d0])",
"&vadduwm (@x[$c1],@x[$c1],@x[$d1])",
"&vadduwm (@x[$c2],@x[$c2],@x[$d2])",
"&vadduwm (@x[$c3],@x[$c3],@x[$d3])",
"&vxor (@x[$b0],@x[$b0],@x[$c0])",
"&vxor (@x[$b1],@x[$b1],@x[$c1])",
"&vxor (@x[$b2],@x[$b2],@x[$c2])",
"&vxor (@x[$b3],@x[$b3],@x[$c3])",
"&vrlw (@x[$b0],@x[$b0],'$seven')",
"&vrlw (@x[$b1],@x[$b1],'$seven')",
"&vrlw (@x[$b2],@x[$b2],'$seven')",
"&vrlw (@x[$b3],@x[$b3],'$seven')"
);
}
$code.=<<___;
.globl .ChaCha20_ctr32_vsx
.align 5
.ChaCha20_ctr32_vsx:
$STU $sp,-$FRAME($sp)
mflr r0
li r10,`15+$LOCALS+64`
li r11,`31+$LOCALS+64`
mfspr r12,256
stvx v26,r10,$sp
addi r10,r10,32
stvx v27,r11,$sp
addi r11,r11,32
stvx v28,r10,$sp
addi r10,r10,32
stvx v29,r11,$sp
addi r11,r11,32
stvx v30,r10,$sp
stvx v31,r11,$sp
stw r12,`$FRAME-4`($sp) # save vrsave
li r12,-4096+63
$PUSH r0, `$FRAME+$LRSAVE`($sp)
mtspr 256,r12 # preserve 29 AltiVec registers
bl Lconsts # returns pointer Lsigma in r12
lvx_4w @K[0],0,r12 # load sigma
addi r12,r12,0x50
li $x10,16
li $x20,32
li $x30,48
li r11,64
lvx_4w @K[1],0,$key # load key
lvx_4w @K[2],$x10,$key
lvx_4w @K[3],0,$ctr # load counter
vxor $xt0,$xt0,$xt0
lvx_4w $xt1,r11,r12
vspltw $CTR,@K[3],0
vsldoi @K[3],@K[3],$xt0,4
vsldoi @K[3],$xt0,@K[3],12 # clear @K[3].word[0]
vadduwm $CTR,$CTR,$xt1
be?lvsl $beperm,0,$x10 # 0x00..0f
be?vspltisb $xt0,3 # 0x03..03
be?vxor $beperm,$beperm,$xt0 # swap bytes within words
li r0,10 # inner loop counter
mtctr r0
b Loop_outer_vsx
.align 5
Loop_outer_vsx:
lvx $xa0,$x00,r12 # load [smashed] sigma
lvx $xa1,$x10,r12
lvx $xa2,$x20,r12
lvx $xa3,$x30,r12
vspltw $xb0,@K[1],0 # smash the key
vspltw $xb1,@K[1],1
vspltw $xb2,@K[1],2
vspltw $xb3,@K[1],3
vspltw $xc0,@K[2],0
vspltw $xc1,@K[2],1
vspltw $xc2,@K[2],2
vspltw $xc3,@K[2],3
vmr $xd0,$CTR # smash the counter
vspltw $xd1,@K[3],1
vspltw $xd2,@K[3],2
vspltw $xd3,@K[3],3
vspltisw $sixteen,-16 # synthesize constants
vspltisw $twelve,12
vspltisw $eight,8
vspltisw $seven,7
Loop_vsx:
___
foreach (&VSX_lane_ROUND(0, 4, 8,12)) { eval; }
foreach (&VSX_lane_ROUND(0, 5,10,15)) { eval; }
$code.=<<___;
bdnz Loop_vsx
vadduwm $xd0,$xd0,$CTR
vmrgew $xt0,$xa0,$xa1 # transpose data
vmrgew $xt1,$xa2,$xa3
vmrgow $xa0,$xa0,$xa1
vmrgow $xa2,$xa2,$xa3
vmrgew $xt2,$xb0,$xb1
vmrgew $xt3,$xb2,$xb3
vpermdi $xa1,$xa0,$xa2,0b00
vpermdi $xa3,$xa0,$xa2,0b11
vpermdi $xa0,$xt0,$xt1,0b00
vpermdi $xa2,$xt0,$xt1,0b11
vmrgow $xb0,$xb0,$xb1
vmrgow $xb2,$xb2,$xb3
vmrgew $xt0,$xc0,$xc1
vmrgew $xt1,$xc2,$xc3
vpermdi $xb1,$xb0,$xb2,0b00
vpermdi $xb3,$xb0,$xb2,0b11
vpermdi $xb0,$xt2,$xt3,0b00
vpermdi $xb2,$xt2,$xt3,0b11
vmrgow $xc0,$xc0,$xc1
vmrgow $xc2,$xc2,$xc3
vmrgew $xt2,$xd0,$xd1
vmrgew $xt3,$xd2,$xd3
vpermdi $xc1,$xc0,$xc2,0b00
vpermdi $xc3,$xc0,$xc2,0b11
vpermdi $xc0,$xt0,$xt1,0b00
vpermdi $xc2,$xt0,$xt1,0b11
vmrgow $xd0,$xd0,$xd1
vmrgow $xd2,$xd2,$xd3
vspltisw $xt0,4
vadduwm $CTR,$CTR,$xt0 # next counter value
vpermdi $xd1,$xd0,$xd2,0b00
vpermdi $xd3,$xd0,$xd2,0b11
vpermdi $xd0,$xt2,$xt3,0b00
vpermdi $xd2,$xt2,$xt3,0b11
vadduwm $xa0,$xa0,@K[0]
vadduwm $xb0,$xb0,@K[1]
vadduwm $xc0,$xc0,@K[2]
vadduwm $xd0,$xd0,@K[3]
be?vperm $xa0,$xa0,$xa0,$beperm
be?vperm $xb0,$xb0,$xb0,$beperm
be?vperm $xc0,$xc0,$xc0,$beperm
be?vperm $xd0,$xd0,$xd0,$beperm
${UCMP}i $len,0x40
blt Ltail_vsx
lvx_4w $xt0,$x00,$inp
lvx_4w $xt1,$x10,$inp
lvx_4w $xt2,$x20,$inp
lvx_4w $xt3,$x30,$inp
vxor $xt0,$xt0,$xa0
vxor $xt1,$xt1,$xb0
vxor $xt2,$xt2,$xc0
vxor $xt3,$xt3,$xd0
stvx_4w $xt0,$x00,$out
stvx_4w $xt1,$x10,$out
addi $inp,$inp,0x40
stvx_4w $xt2,$x20,$out
subi $len,$len,0x40
stvx_4w $xt3,$x30,$out
addi $out,$out,0x40
beq Ldone_vsx
vadduwm $xa0,$xa1,@K[0]
vadduwm $xb0,$xb1,@K[1]
vadduwm $xc0,$xc1,@K[2]
vadduwm $xd0,$xd1,@K[3]
be?vperm $xa0,$xa0,$xa0,$beperm
be?vperm $xb0,$xb0,$xb0,$beperm
be?vperm $xc0,$xc0,$xc0,$beperm
be?vperm $xd0,$xd0,$xd0,$beperm
${UCMP}i $len,0x40
blt Ltail_vsx
lvx_4w $xt0,$x00,$inp
lvx_4w $xt1,$x10,$inp
lvx_4w $xt2,$x20,$inp
lvx_4w $xt3,$x30,$inp
vxor $xt0,$xt0,$xa0
vxor $xt1,$xt1,$xb0
vxor $xt2,$xt2,$xc0
vxor $xt3,$xt3,$xd0
stvx_4w $xt0,$x00,$out
stvx_4w $xt1,$x10,$out
addi $inp,$inp,0x40
stvx_4w $xt2,$x20,$out
subi $len,$len,0x40
stvx_4w $xt3,$x30,$out
addi $out,$out,0x40
beq Ldone_vsx
vadduwm $xa0,$xa2,@K[0]
vadduwm $xb0,$xb2,@K[1]
vadduwm $xc0,$xc2,@K[2]
vadduwm $xd0,$xd2,@K[3]
be?vperm $xa0,$xa0,$xa0,$beperm
be?vperm $xb0,$xb0,$xb0,$beperm
be?vperm $xc0,$xc0,$xc0,$beperm
be?vperm $xd0,$xd0,$xd0,$beperm
${UCMP}i $len,0x40
blt Ltail_vsx
lvx_4w $xt0,$x00,$inp
lvx_4w $xt1,$x10,$inp
lvx_4w $xt2,$x20,$inp
lvx_4w $xt3,$x30,$inp
vxor $xt0,$xt0,$xa0
vxor $xt1,$xt1,$xb0
vxor $xt2,$xt2,$xc0
vxor $xt3,$xt3,$xd0
stvx_4w $xt0,$x00,$out
stvx_4w $xt1,$x10,$out
addi $inp,$inp,0x40
stvx_4w $xt2,$x20,$out
subi $len,$len,0x40
stvx_4w $xt3,$x30,$out
addi $out,$out,0x40
beq Ldone_vsx
vadduwm $xa0,$xa3,@K[0]
vadduwm $xb0,$xb3,@K[1]
vadduwm $xc0,$xc3,@K[2]
vadduwm $xd0,$xd3,@K[3]
be?vperm $xa0,$xa0,$xa0,$beperm
be?vperm $xb0,$xb0,$xb0,$beperm
be?vperm $xc0,$xc0,$xc0,$beperm
be?vperm $xd0,$xd0,$xd0,$beperm
${UCMP}i $len,0x40
blt Ltail_vsx
lvx_4w $xt0,$x00,$inp
lvx_4w $xt1,$x10,$inp
lvx_4w $xt2,$x20,$inp
lvx_4w $xt3,$x30,$inp
vxor $xt0,$xt0,$xa0
vxor $xt1,$xt1,$xb0
vxor $xt2,$xt2,$xc0
vxor $xt3,$xt3,$xd0
stvx_4w $xt0,$x00,$out
stvx_4w $xt1,$x10,$out
addi $inp,$inp,0x40
stvx_4w $xt2,$x20,$out
subi $len,$len,0x40
stvx_4w $xt3,$x30,$out
addi $out,$out,0x40
mtctr r0
bne Loop_outer_vsx
Ldone_vsx:
lwz r12,`$FRAME-4`($sp) # pull vrsave
li r10,`15+$LOCALS+64`
li r11,`31+$LOCALS+64`
$POP r0, `$FRAME+$LRSAVE`($sp)
mtspr 256,r12 # restore vrsave
lvx v26,r10,$sp
addi r10,r10,32
lvx v27,r11,$sp
addi r11,r11,32
lvx v28,r10,$sp
addi r10,r10,32
lvx v29,r11,$sp
addi r11,r11,32
lvx v30,r10,$sp
lvx v31,r11,$sp
mtlr r0
addi $sp,$sp,$FRAME
blr
.align 4
Ltail_vsx:
addi r11,$sp,$LOCALS
mtctr $len
stvx_4w $xa0,$x00,r11 # offload block to stack
stvx_4w $xb0,$x10,r11
stvx_4w $xc0,$x20,r11
stvx_4w $xd0,$x30,r11
subi r12,r11,1 # prepare for *++ptr
subi $inp,$inp,1
subi $out,$out,1
Loop_tail_vsx:
lbzu r6,1(r12)
lbzu r7,1($inp)
xor r6,r6,r7
stbu r6,1($out)
bdnz Loop_tail_vsx
stvx_4w $K[0],$x00,r11 # wipe copy of the block
stvx_4w $K[0],$x10,r11
stvx_4w $K[0],$x20,r11
stvx_4w $K[0],$x30,r11
b Ldone_vsx
.long 0
.byte 0,12,0x04,1,0x80,0,5,0
.long 0
.size .ChaCha20_ctr32_vsx,.-.ChaCha20_ctr32_vsx
___
}}}
$code.=<<___;
.align 5
Lconsts:
mflr r0
@@ -919,10 +1314,14 @@ $code.=<<___ if (!$LITTLE_ENDIAN); # flipped words
.long 0x01020300,0x05060704,0x090a0b08,0x0d0e0f0c
___
$code.=<<___;
.long 0x61707865,0x61707865,0x61707865,0x61707865
.long 0x3320646e,0x3320646e,0x3320646e,0x3320646e
.long 0x79622d32,0x79622d32,0x79622d32,0x79622d32
.long 0x6b206574,0x6b206574,0x6b206574,0x6b206574
.long 0,1,2,3
.asciz "ChaCha20 for PowerPC/AltiVec, CRYPTOGAMS by <appro\@openssl.org>"
.align 2
___
}}}
foreach (split("\n",$code)) {
s/\`([^\`]*)\`/eval $1/ge;
crypto/perlasm/ppc-xlate.pl
+2
View File
@@ -256,6 +256,8 @@ my $vsubudm = sub { vcrypto_op(@_, 1216); };
my $vaddcuq = sub { vcrypto_op(@_, 320); };
my $vaddeuqm = sub { vfour(@_,60); };
my $vaddecuq = sub { vfour(@_,61); };
my $vmrgew = sub { vfour(@_,0,1932); };
my $vmrgow = sub { vfour(@_,0,1676); };
my $mtsle = sub {
my ($f, $arg) = @_;
crypto/ppccap.c
+6 -1
View File
@@ -90,11 +90,16 @@ void ChaCha20_ctr32_int(unsigned char *out, const unsigned char *inp,
void ChaCha20_ctr32_vmx(unsigned char *out, const unsigned char *inp,
size_t len, const unsigned int key[8],
const unsigned int counter[4]);
void ChaCha20_ctr32_vsx(unsigned char *out, const unsigned char *inp,
size_t len, const unsigned int key[8],
const unsigned int counter[4]);
void ChaCha20_ctr32(unsigned char *out, const unsigned char *inp,
size_t len, const unsigned int key[8],
const unsigned int counter[4])
{
OPENSSL_ppccap_P & PPC_ALTIVEC
OPENSSL_ppccap_P & PPC_CRYPTO207
? ChaCha20_ctr32_vsx(out, inp, len, key, counter)
: OPENSSL_ppccap_P & PPC_ALTIVEC
? ChaCha20_ctr32_vmx(out, inp, len, key, counter)
: ChaCha20_ctr32_int(out, inp, len, key, counter);
}
crypto/sha/asm/sha512p8-ppc.pl
+1 -2
View File
@@ -92,8 +92,7 @@ $idx="r7";
$lrsave="r8";
$offload="r11";
$vrsave="r12";
@I = ($x00,$x10,$x20,$x30,$x40,$x50,$x60,$x70)=map("r$_",(0,10,26..31));
$x00=0 if ($flavour =~ /osx/);
@I = ($x00,$x10,$x20,$x30,$x40,$x50,$x60,$x70) = (0,map("r$_",(10,26..31)));
@V=($A,$B,$C,$D,$E,$F,$G,$H)=map("v$_",(0..7));
@X=map("v$_",(8..19,24..27));
crypto/sm2/sm2_za.c
+1
View File
@@ -15,6 +15,7 @@
#include <openssl/evp.h>
#include <openssl/bn.h>
#include <string.h>
#include "internal/numbers.h"
int sm2_compute_userid_digest(uint8_t *out,
const EVP_MD *digest,
include/openssl/ssl.h
-1
View File
@@ -48,7 +48,6 @@ extern "C" {
# define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8)
# define SSL_MAX_KEY_ARG_LENGTH 8
# define SSL_MAX_MASTER_KEY_LENGTH 48
# define TLS13_MAX_RESUMPTION_MASTER_LENGTH 64
/* The maximum number of encrypt/decrypt pipelines we can support */
# define SSL_MAX_PIPELINES 32
ssl/s3_lib.c
+3 -1
View File
@@ -33,7 +33,9 @@ const unsigned char tls12downgrade[] = {
/* The list of available TLSv1.3 ciphers */
/* Since nginx can not set the TLS 1.3 cipher, remove it temporarily. */
static SSL_CIPHER tls13_ciphers[] = {
{
0,
}
};
/*
ssl/ssl_asn1.c
+3 -21
View File
@@ -41,7 +41,6 @@ typedef struct {
uint64_t flags;
uint32_t max_early_data;
ASN1_OCTET_STRING *alpn_selected;
ASN1_OCTET_STRING *tick_nonce;
uint32_t tlsext_max_fragment_len_mode;
ASN1_OCTET_STRING *ticket_appdata;
} SSL_SESSION_ASN1;
@@ -73,9 +72,8 @@ ASN1_SEQUENCE(SSL_SESSION_ASN1) = {
ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_tick_age_add, ZUINT32, 14),
ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, max_early_data, ZUINT32, 15),
ASN1_EXP_OPT(SSL_SESSION_ASN1, alpn_selected, ASN1_OCTET_STRING, 16),
ASN1_EXP_OPT(SSL_SESSION_ASN1, tick_nonce, ASN1_OCTET_STRING, 17),
ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 18),
ASN1_EXP_OPT(SSL_SESSION_ASN1, ticket_appdata, ASN1_OCTET_STRING, 19)
ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 17),
ASN1_EXP_OPT(SSL_SESSION_ASN1, ticket_appdata, ASN1_OCTET_STRING, 18)
} static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
@@ -124,7 +122,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
ASN1_OCTET_STRING psk_identity, psk_identity_hint;
#endif
ASN1_OCTET_STRING alpn_selected;
ASN1_OCTET_STRING tick_nonce;
ASN1_OCTET_STRING ticket_appdata;
long l;
@@ -195,12 +192,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
ssl_session_oinit(&as.alpn_selected, &alpn_selected,
in->ext.alpn_selected, in->ext.alpn_selected_len);
if (in->ext.tick_nonce == NULL)
as.tick_nonce = NULL;
else
ssl_session_oinit(&as.tick_nonce, &tick_nonce,
in->ext.tick_nonce, in->ext.tick_nonce_len);
as.tlsext_max_fragment_len_mode = in->ext.max_fragment_len_mode;
if (in->ticket_appdata == NULL)
@@ -299,7 +290,7 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
goto err;
if (!ssl_session_memcpy(ret->master_key, &tmpl,
as->master_key, TLS13_MAX_RESUMPTION_MASTER_LENGTH))
as->master_key, TLS13_MAX_RESUMPTION_PSK_LENGTH))
goto err;
ret->master_key_length = tmpl;
@@ -374,15 +365,6 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
ret->ext.alpn_selected_len = 0;
}
if (as->tick_nonce != NULL) {
ret->ext.tick_nonce = as->tick_nonce->data;
ret->ext.tick_nonce_len = as->tick_nonce->length;
as->tick_nonce->data = NULL;
} else {
ret->ext.tick_nonce = NULL;
ret->ext.tick_nonce_len = 0;
}
ret->ext.max_fragment_len_mode = as->tlsext_max_fragment_len_mode;
if (as->ticket_appdata != NULL) {
ssl/ssl_locl.h
+8 -6
View File
@@ -470,6 +470,8 @@ struct ssl_method_st {
long (*ssl_ctx_callback_ctrl) (SSL_CTX *s, int cb_id, void (*fp) (void));
};
# define TLS13_MAX_RESUMPTION_PSK_LENGTH 64
/*-
* Lets make this into an ASN.1 type structure as follows
* SSL_SESSION_ID ::= SEQUENCE {
@@ -505,9 +507,9 @@ struct ssl_session_st {
unsigned char early_secret[EVP_MAX_MD_SIZE];
/*
* For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
* master secret
* PSK
*/
unsigned char master_key[TLS13_MAX_RESUMPTION_MASTER_LENGTH];
unsigned char master_key[TLS13_MAX_RESUMPTION_PSK_LENGTH];
/* session_id - valid? */
size_t session_id_length;
unsigned char session_id[SSL_MAX_SSL_SESSION_ID_LENGTH];
@@ -567,8 +569,6 @@ struct ssl_session_st {
/* Session lifetime hint in seconds */
unsigned long tick_lifetime_hint;
uint32_t tick_age_add;
unsigned char *tick_nonce;
size_t tick_nonce_len;
int tick_identity;
/* Max number of bytes that can be sent as early data */
uint32_t max_early_data;
@@ -1162,12 +1162,12 @@ struct ssl_st {
*/
uint32_t mac_flags;
/*
* The TLS1.3 secrets. The resumption master secret is stored in the
* session.
* The TLS1.3 secrets.
*/
unsigned char early_secret[EVP_MAX_MD_SIZE];
unsigned char handshake_secret[EVP_MAX_MD_SIZE];
unsigned char master_secret[EVP_MAX_MD_SIZE];
unsigned char resumption_master_secret[EVP_MAX_MD_SIZE];
unsigned char client_finished_secret[EVP_MAX_MD_SIZE];
unsigned char server_finished_secret[EVP_MAX_MD_SIZE];
unsigned char server_finished_hash[EVP_MAX_MD_SIZE];
@@ -1459,6 +1459,8 @@ struct ssl_st {
size_t num_tickets;
/* The number of TLS1.3 tickets actually sent so far */
size_t sent_tickets;
/* The next nonce value to use when we send a ticket on this connection */
uint64_t next_ticket_nonce;
};
/*
ssl/ssl_sess.c
-9
View File
@@ -133,7 +133,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
#endif
dest->peer_chain = NULL;
dest->peer = NULL;
dest->ext.tick_nonce = NULL;
dest->ticket_appdata = NULL;
memset(&dest->ex_data, 0, sizeof(dest->ex_data));
@@ -230,13 +229,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
}
}
if (src->ext.tick_nonce != NULL) {
dest->ext.tick_nonce = OPENSSL_memdup(src->ext.tick_nonce,
src->ext.tick_nonce_len);
if (dest->ext.tick_nonce == NULL)
goto err;
}
#ifndef OPENSSL_NO_SRP
if (src->srp_username) {
dest->srp_username = OPENSSL_strdup(src->srp_username);
@@ -824,7 +816,6 @@ void SSL_SESSION_free(SSL_SESSION *ss)
OPENSSL_free(ss->srp_username);
#endif
OPENSSL_free(ss->ext.alpn_selected);
OPENSSL_free(ss->ext.tick_nonce);
OPENSSL_free(ss->ticket_appdata);
CRYPTO_THREAD_lock_free(ss->lock);
OPENSSL_clear_free(ss, sizeof(*ss));
ssl/statem/extensions.c
+10 -25
View File
@@ -1421,13 +1421,11 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
EVP_MD_CTX *mctx = NULL;
unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE];
unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE];
unsigned char tmppsk[EVP_MAX_MD_SIZE];
unsigned char *early_secret, *psk;
const char resumption_label[] = "res binder";
const char external_label[] = "ext binder";
const char nonce_label[] = "resumption";
const char *label;
size_t bindersize, labelsize, psklen, hashsize;
unsigned char *early_secret;
static const unsigned char resumption_label[] = "res binder";
static const unsigned char external_label[] = "ext binder";
const unsigned char *label;
size_t bindersize, labelsize, hashsize;
int hashsizei = EVP_MD_size(md);
int ret = -1;
int usepskfored = 0;
@@ -1454,21 +1452,6 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
labelsize = sizeof(resumption_label) - 1;
}
if (external) {
psk = sess->master_key;
psklen = sess->master_key_length;
} else {
psk = tmppsk;
psklen = hashsize;
if (!tls13_hkdf_expand(s, md, sess->master_key,
(const unsigned char *)nonce_label,
sizeof(nonce_label) - 1, sess->ext.tick_nonce,
sess->ext.tick_nonce_len, psk, hashsize)) {
/* SSLfatal() already called */
goto err;
}
}
/*
* Generate the early_secret. On the server side we've selected a PSK to
* resume with (internal or external) so we always do this. On the client
@@ -1481,7 +1464,9 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
early_secret = (unsigned char *)s->early_secret;
else
early_secret = (unsigned char *)sess->early_secret;
if (!tls13_generate_secret(s, md, NULL, psk, psklen, early_secret)) {
if (!tls13_generate_secret(s, md, NULL, sess->master_key,
sess->master_key_length, early_secret)) {
/* SSLfatal() already called */
goto err;
}
@@ -1500,8 +1485,8 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
}
/* Generate the binder key */
if (!tls13_hkdf_expand(s, md, early_secret, (unsigned char *)label,
labelsize, hash, hashsize, binderkey, hashsize)) {
if (!tls13_hkdf_expand(s, md, early_secret, label, labelsize, hash,
hashsize, binderkey, hashsize)) {
/* SSLfatal() already called */
goto err;
}
ssl/statem/statem_clnt.c
+32 -6
View File
@@ -22,6 +22,7 @@
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/engine.h>
#include <internal/cryptlib.h>
static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt);
static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt);
@@ -2558,16 +2559,15 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
RAW_EXTENSION *exts = NULL;
PACKET nonce;
PACKET_null_init(&nonce);
if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint)
|| (SSL_IS_TLS13(s)
&& (!PACKET_get_net_4(pkt, &age_add)
|| !PACKET_get_length_prefixed_1(pkt, &nonce)
|| !PACKET_memdup(&nonce, &s->session->ext.tick_nonce,
&s->session->ext.tick_nonce_len)))
|| !PACKET_get_length_prefixed_1(pkt, &nonce)))
|| !PACKET_get_net_2(pkt, &ticklen)
|| (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) != ticklen)
|| (SSL_IS_TLS13(s)
&& (ticklen == 0 || PACKET_remaining(pkt) < ticklen))) {
|| (SSL_IS_TLS13(s) ? (ticklen == 0 || PACKET_remaining(pkt) < ticklen)
: PACKET_remaining(pkt) != ticklen)) {
SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEW_SESSION_TICKET,
SSL_R_LENGTH_MISMATCH);
goto err;
@@ -2674,6 +2674,32 @@ MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
/* This is a standalone message in TLSv1.3, so there is no more to read */
if (SSL_IS_TLS13(s)) {
const EVP_MD *md = ssl_handshake_md(s);
int hashleni = EVP_MD_size(md);
size_t hashlen;
static const unsigned char nonce_label[] = "resumption";
/* Ensure cast to size_t is safe */
if (!ossl_assert(hashleni >= 0)) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_TLS_PROCESS_NEW_SESSION_TICKET,
ERR_R_INTERNAL_ERROR);
goto err;
}
hashlen = (size_t)hashleni;
if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
nonce_label,
sizeof(nonce_label) - 1,
PACKET_data(&nonce),
PACKET_remaining(&nonce),
s->session->master_key,
hashlen)) {
/* SSLfatal() already called */
goto err;
}
s->session->master_key_length = hashlen;
OPENSSL_free(exts);
ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
return MSG_PROCESS_FINISHED_READING;
ssl/statem/statem_srvr.c
+42 -15
View File
@@ -24,6 +24,8 @@
#include <openssl/bn.h>
#include <openssl/md5.h>
#define TICKET_NONCE_SIZE 8
static int tls_construct_encrypted_extensions(SSL *s, WPACKET *pkt);
/*
@@ -3752,6 +3754,7 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
unsigned char iv[EVP_MAX_IV_LENGTH];
unsigned char key_name[TLSEXT_KEYNAME_LENGTH];
int iv_len;
unsigned char tick_nonce[TICKET_NONCE_SIZE];
size_t macoffset, macendoffset;
union {
unsigned char age_add_c[sizeof(uint32_t)];
@@ -3759,14 +3762,27 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
} age_add_u;
if (SSL_IS_TLS13(s)) {
size_t i, hashlen;
uint64_t nonce;
static const unsigned char nonce_label[] = "resumption";
const EVP_MD *md = ssl_handshake_md(s);
void (*cb) (const SSL *ssl, int type, int val) = NULL;
int hashleni = EVP_MD_size(md);
/* Ensure cast to size_t is safe */
if (!ossl_assert(hashleni >= 0)) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
ERR_R_INTERNAL_ERROR);
goto err;
}
hashlen = (size_t)hashleni;
if (s->info_callback != NULL)
cb = s->info_callback;
else if (s->ctx->info_callback != NULL)
cb = s->ctx->info_callback;
if (cb != NULL) {
/*
* We don't start and stop the handshake in between each ticket when
@@ -3807,20 +3823,25 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
goto err;
}
s->session->ext.tick_age_add = age_add_u.age_add;
/*
* ticket_nonce is set to a single 0 byte because we only ever send a
* single ticket per connection. IMPORTANT: If we ever support multiple
* tickets per connection then this will need to be changed.
*/
OPENSSL_free(s->session->ext.tick_nonce);
s->session->ext.tick_nonce = OPENSSL_zalloc(sizeof(char));
if (s->session->ext.tick_nonce == NULL) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
ERR_R_MALLOC_FAILURE);
nonce = s->next_ticket_nonce;
for (i = TICKET_NONCE_SIZE; i > 0; i--) {
tick_nonce[i - 1] = (unsigned char)(nonce & 0xff);
nonce >>= 8;
}
if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
nonce_label,
sizeof(nonce_label) - 1,
tick_nonce,
TICKET_NONCE_SIZE,
s->session->master_key,
hashlen)) {
/* SSLfatal() already called */
goto err;
}
s->session->ext.tick_nonce_len = 1;
s->session->master_key_length = hashlen;
s->session->time = (long)time(NULL);
if (s->s3->alpn_selected != NULL) {
OPENSSL_free(s->session->ext.alpn_selected);
@@ -3963,8 +3984,8 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
? 0 : s->session->timeout)
|| (SSL_IS_TLS13(s)
&& (!WPACKET_put_bytes_u32(pkt, age_add_u.age_add)
|| !WPACKET_sub_memcpy_u8(pkt, s->session->ext.tick_nonce,
s->session->ext.tick_nonce_len)))
|| !WPACKET_sub_memcpy_u8(pkt, tick_nonce,
TICKET_NONCE_SIZE)))
/* Now the actual ticket data */
|| !WPACKET_start_sub_packet_u16(pkt)
|| !WPACKET_get_total_written(pkt, &macoffset)
@@ -4003,7 +4024,13 @@ int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)
/* SSLfatal() already called */
goto err;
}
/*
* Increment both |sent_tickets| and |next_ticket_nonce|. |sent_tickets|
* gets reset to 0 if we send more tickets following a post-handshake
* auth, but |next_ticket_nonce| does not.
*/
s->sent_tickets++;
s->next_ticket_nonce++;
ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
}
EVP_CIPHER_CTX_free(ctx);
ssl/t1_lib.c
+2
View File
@@ -1487,12 +1487,14 @@ SSL_TICKET_STATUS tls_decrypt_ticket(SSL *s, const unsigned char *etick,
}
}
if (s->ext.session_secret_cb == NULL || SSL_IS_TLS13(s)) {
switch (ret) {
case SSL_TICKET_NO_DECRYPT:
case SSL_TICKET_SUCCESS_RENEW:
case SSL_TICKET_EMPTY:
s->ext.ticket_expected = 1;
}
}
*psess = sess;
ssl/tls13_enc.c
+1 -2
View File
@@ -602,12 +602,11 @@ int tls13_change_cipher_state(SSL *s, int which)
if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
resumption_master_secret,
sizeof(resumption_master_secret) - 1,
hashval, hashlen, s->session->master_key,
hashval, hashlen, s->resumption_master_secret,
hashlen)) {
/* SSLfatal() already called */
goto err;
}
s->session->master_key_length = hashlen;
}
if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
test/session.pem
+9 -9
View File
@@ -1,7 +1,7 @@
-----BEGIN SSL SESSION PARAMETERS-----
MIIFRAIBAQICAwQEAhMCBCDom190ggLdEV9HNhMrbc8/MLs9NS3nqoWFoIJLgQqS
tgQwzskkzvykWInToBTKeUhVYe4BidOBYHdHZ65Z2ETBf63lz1dMKRraxwl6K07f
BUyBoQYCBFlct3qiBAICHCCjggPrMIID5zCCAs+gAwIBAgIJALnu1NlVpZ6zMA0G
MIIFSgIBAQICAwQEAhMCBCAUv8MKab5ruWM6I8xtEH++u+bb2B1OznYnDrRcpLll
6AQwzwJoGXOQ3uCa7bCy07owBiH4Bf13MiDtwaHSnNTEyfLEZBy3SgCE06wa5TJk
Fx8aoQYCBFsWdRqiBAICHCCjggPrMIID5zCCAs+gAwIBAgIJALnu1NlVpZ6zMA0G
CSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAlVLMRYwFAYDVQQKDA1PcGVuU1NMIEdy
b3VwMSIwIAYDVQQLDBlGT1IgVEVTVElORyBQVVJQT1NFUyBPTkxZMSUwIwYDVQQD
DBxPcGVuU1NMIFRlc3QgSW50ZXJtZWRpYXRlIENBMB4XDTExMTIwODE0MDE0OFoX
@@ -22,10 +22,10 @@ Wz9qoeoFZax+QBpIZYjROU3TS3fpyLsrnlr0CDQ5R7kCCDGa8dkXxemmpZZLbUCp
W2Uoy8sAA4JjN9OtsZY7dvUXFgJ7vVNTRnI01ghknbtD+2SxSQd3CWF6QhcRMAzZ
J1z1cbbwGDDzfvGFPzJ+Sq+zEPdsxoVLLSetCiBc+40ZcDS5dV98h9XD7JMTQfxz
A7mNGv73JoZJA6nFgj+ADSlJsY/tJBv+z1iQRueoh9Qeee+ZbRifPouCB8FDx+Al
tvHTANdAq0t/K3o+pplMVKQCBAClAwIBFakEAgIcIKqBwwSBwFNYKC1r6z0zp+wI
V+A8n63Wh4X/0HtKa7dJCGhvLxjI+BL9QK8JB2Qrs3OR32VjVyVWD9K0atHwhyTR
wwFJfBEfgv9reCtOiQg2oHadD3iCbHjhhGCvbj+zCChMGSEE8NtqkBpwGATtwgN7
qoLShh+JyHwhfXWKhKlEibr8W0ipe6R3VUW9+wsW8nTGs4FmvQSIkLI1WCr226LN
wkRIx5+3Q3mZB39Epco4srvyLy8J/B+x2lhUdIpov7VBz++C864GAgRYHFWqrwQC
AkAAsQMEAQA=
tvHTANdAq0t/K3o+pplMVKQCBAClAwIBFakEAgIcIKqB0wSB0EMQ5938LY/ASVsV
0kStjTVOps9p3VT071bTjD3RR211+gLzBwGCk8gWNH1glJXjLAenh9E2ivDK1tYQ
3ODRdB3V46t9E78r0uAmSG/WMJ9OvkFlXyIhseYwvWW0P1cAYPI/j3Evgcyu9GIs
HSDVEKbBy9CJYCkW/SrT+2A3ouqp+wSW0XgDLFFB+mBte2Hg7wv2uILrYZ4Y0fNe
CUcTq8B+0EFEiq7p0KRGXwpSKYxNw7qZgg/Us3W85BYMnzYjfDzN0KHf+BI28VRT
Rjxuud2uBwIFANHVD/k=
-----END SSL SESSION PARAMETERS-----