Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update and remove TLSv1.3 draft

Browse Source
This commit is contained in:
Hakase
2019-02-09 20:33:39 +09:00
parent afcfc266de
commit d6aa4528fc
143 changed files with 3914 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGES
+15 -1
View File
@@ -9,6 +9,20 @@
Changes between 1.1.1 and 3.0.0 [xx XXX xxxx]
*) Add keyed BLAKE2 to EVP_MAC.
[Antoine Salon]
*) Fix a bug in the computation of the endpoint-pair shared secret used
by DTLS over SCTP. This breaks interoperability with older versions
of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime
switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling
interoperability with such broken implementations. However, enabling
this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a
re-used X509_PUBKEY object if the second PUBKEY is malformed.
[Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0().
[Richard Levitte]
@@ -63,7 +77,7 @@
implementations. This includes a generic EVP_PKEY to EVP_MAC bridge,
to facilitate the continued use of MACs through raw private keys in
functionality such as EVP_DigestSign* and EVP_DigestVerify*.
[Richard Levitte]
[Richard Levitte]
*) Deprecate ECDH_KDF_X9_62() and mark its replacement as internal. Users
should use the EVP interface instead (EVP_PKEY_CTX_set_ecdh_kdf_type).
CONTRIBUTING
+1 -1
View File
@@ -57,7 +57,7 @@ guidelines:
7. For user visible changes (API changes, behaviour changes, ...),
consider adding a note in CHANGES. This could be a summarising
description of the change, and could explain the grander details.
Have a look through existing entries for inspiration.
Have a look through existing entries for inspiration.
Please note that this is NOT simply a copy of git-log oneliners.
Also note that security fixes get an entry in CHANGES.
This file helps users get more in depth information of what comes
Configurations/00-base-templates.conf
+1 -1
View File
@@ -305,7 +305,7 @@ my %targets=(
sha1_asm_src => "sha1-armv4-large.S sha256-armv4.S sha512-armv4.S",
modes_asm_src => "ghash-armv4.S ghashv8-armx.S",
chacha_asm_src => "chacha-armv4.S",
poly1305_asm_src=> "poly1305-armv4.S",
poly1305_asm_src=> "poly1305-armv4.S",
keccak1600_asm_src => "keccak1600-armv4.S",
perlasm_scheme => "void"
},
Configurations/10-main.conf
+2
View File
@@ -1724,6 +1724,8 @@ my %targets = (
asflags => sub { vms_info()->{asflags} },
perlasm_scheme => sub { vms_info()->{perlasm_scheme} },
disable => add('pinshared'),
apps_aux_src => "vms_term_sock.c",
apps_init_src => "vms_decc_init.c",
},
Configurations/15-android.conf
+2 -1
View File
@@ -24,7 +24,8 @@
my $ndk_var;
my $ndk;
foreach $ndk_var (qw(ANDROID_NDK_HOME ANDROID_NDK)) {
foreach (qw(ANDROID_NDK_HOME ANDROID_NDK)) {
$ndk_var = $_;
$ndk = $ENV{$ndk_var};
last if defined $ndk;
}
Configurations/50-win-onecore.conf
+1 -1
View File
@@ -4,7 +4,7 @@
# Mobile[?] Windows editions. It's a set up "umbrella" libraries that
# export subset of Win32 API that are common to all Windows 10 devices.
#
# OneCore Configuration temporarly dedicated for console applications
# OneCore Configuration temporarly dedicated for console applications
# due to disabled event logging, which is incompatible with one core.
# Error messages are provided via standard error only.
# TODO: extend error handling to use ETW based eventing
Configurations/README
+1 -44
View File
@@ -118,7 +118,7 @@ In each table entry, the following keys are significant:
'<unistd.h>'. This is very rarely needed.
shared_extension => File name extension used for shared
libraries.
libraries.
obj_extension => File name extension used for object files.
On unix, this defaults to ".o" (NOTE: this
is here for future use, it's not
@@ -413,7 +413,6 @@ variables:
LIBS=libsomething
ENGINES=libeng
SCRIPTS=myhack
EXTRA=file1 file2
Note that the files mentioned for PROGRAMS, LIBS and ENGINES *must* be
without extensions. The build file templates will figure them out.
@@ -486,48 +485,6 @@ be used in that case:
NOTE: GENERATE lines are limited to one command only per GENERATE.
As a last resort, it's possible to have raw build file lines, between
BEGINRAW and ENDRAW lines as follows:
BEGINRAW[Makefile(unix)]
haha.h: {- $builddir -}/Makefile
echo "/* haha */" > haha.h
ENDRAW[Makefile(unix)]
The word within square brackets is the build_file configuration item
or the build_file configuration item followed by the second word in the
build_scheme configuration item for the configured target within
parenthesis as shown above. For example, with the following relevant
configuration items:
build_file => "build.ninja"
build_scheme => [ "unified", "unix" ]
... these lines will be considered:
BEGINRAW[build.ninja]
build haha.h: echo "/* haha */" > haha.h
ENDRAW[build.ninja]
BEGINRAW[build.ninja(unix)]
build hoho.h: echo "/* hoho */" > hoho.h
ENDRAW[build.ninja(unix)]
Should it be needed because the recipes within a RAW section might
clash with those generated by Configure, it's possible to tell it
not to generate them with the use of OVERRIDES, for example:
SOURCE[libfoo]=foo.c bar.c
OVERRIDES=bar.o
BEGINRAW[Makefile(unix)]
bar.o: bar.c
$(CC) $(CFLAGS) -DSPECIAL -c -o $@ $<
ENDRAW[Makefile(unix)]
See the documentation further up for more information on configuration
items.
Finally, you can have some simple conditional use of the build.info
information, looking like this:
Configurations/README.design
+4 -15
View File
@@ -87,7 +87,7 @@ depends on the library 'libssl' to function properly.
LIBS=../libcrypto
SOURCE[../libcrypto]=aes.c evp.c cversion.c
DEPEND[cversion.o]=buildinf.h
GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(CFLAGS)" "$(PLATFORM)"
DEPEND[buildinf.h]=../Makefile
DEPEND[../util/mkbuildinf.pl]=../util/Foo.pm
@@ -102,7 +102,7 @@ show that duplicate information isn't an issue.
This build.info file informs us that 'libcrypto' is built from a few
source files, 'crypto/aes.c', 'crypto/evp.c' and 'crypto/cversion.c'.
It also shows us that building the object file inferred from
'crypto/cversion.c' depends on 'crypto/buildinf.h'. Finally, it
'crypto/cversion.c' depends on 'crypto/buildinf.h'. Finally, it
also shows the possibility to declare how some files are generated
using some script, in this case a perl script, and how such scripts
can be declared to depend on other files, in this case a perl module.
@@ -112,9 +112,6 @@ Two things are worth an extra note:
'DEPEND[cversion.o]' mentions an object file. DEPEND indexes is the
only location where it's valid to mention them
Lines in 'BEGINRAW'..'ENDRAW' sections must always mention files as
seen from the top directory, no exception.
# ssl/build.info
LIBS=../libssl
SOURCE[../libssl]=tls.c
@@ -153,7 +150,7 @@ information comes down to this:
SOURCE[libssl]=ssl/tls.c
INCLUDE[libssl]=include
DEPEND[libssl]=libcrypto
PROGRAMS=apps/openssl
SOURCE[apps/openssl]=apps/openssl.c
INCLUDE[apps/openssl]=. include
@@ -168,7 +165,7 @@ information comes down to this:
SOURCE[engines/ossltest]=engines/e_ossltest.c
DEPEND[engines/ossltest]=libcrypto.a
INCLUDE[engines/ossltest]=include
GENERATE[crypto/buildinf.h]=util/mkbuildinf.pl "$(CC) $(CFLAGS)" "$(PLATFORM)"
DEPEND[crypto/buildinf.h]=Makefile
DEPEND[util/mkbuildinf.pl]=util/Foo.pm
@@ -234,11 +231,6 @@ indexes:
programs => a list of programs. These are directly inferred from
the PROGRAMS variable in build.info files.
rawlines => a list of build-file lines. These are a direct copy of
the BEGINRAW..ENDRAW lines in build.info files. Note:
only the BEGINRAW..ENDRAW section for the current
platform are copied, the rest are ignored.
scripts => a list of scripts. There are directly inferred from
the SCRIPTS variable in build.info files.
@@ -352,9 +344,6 @@ section above would be digested into a %unified_info table:
[
"apps/openssl",
],
"rawlines" =>
[
],
"sources" =>
{
"apps/openssl" =>
Configurations/common.tmpl
-4
View File
@@ -217,8 +217,4 @@
foreach (@{$unified_info{scripts}}) { doscript($_); }
foreach (sort keys %{$unified_info{dirinfo}}) { dodir($_); }
# Finally, should there be any applicable BEGINRAW/ENDRAW sections,
# they are added here.
$OUT .= $_."\n" foreach @{$unified_info{rawlines}};
-}
Configurations/descrip.mms.tmpl
+25 -17
View File
@@ -102,9 +102,6 @@
return "$target : build_generated\n\t\pipe \$(MMS) \$(MMSQUALIFIERS) depend && \$(MMS) \$(MMSQUALIFIERS) _$target\n_$target";
}
#use Data::Dumper;
#print STDERR "DEBUG: before:\n", Dumper($unified_info{before});
#print STDERR "DEBUG: after:\n", Dumper($unified_info{after});
"";
-}
PLATFORM={- $config{target} -}
@@ -698,7 +695,10 @@ reconfigure reconf :
# Depending on shared libraries:
# On Windows POSIX layers, we depend on {libname}.dll.a
# On Unix platforms, we depend on {shlibname}.so
return map { platform->sharedlib($_) // platform->staticlib($_) } @_;
return map {
{ lib => platform->sharedlib($_) // platform->staticlib($_),
attrs => $unified_info{attributes}->{$_} }
} @_;
}
# Helper function to deal with inclusion directory specs.
@@ -968,7 +968,7 @@ EOF
@{$args{objs}};
my @deps = compute_lib_depends(@{$args{deps}});
die "More than one symbol vector" if scalar @defs > 1;
my $deps = join(", -\n\t\t", @objs, @defs, @deps);
my $deps = join(", -\n\t\t", @objs, @defs, map { $_->{lib} } @deps);
my $shlib_target = $disabled{shared} ? "" : $target{shared_target};
my $translatesyms_pl = abs2rel(rel2abs(catfile($config{sourcedir},
"VMS", "translatesyms.pl")),
@@ -982,7 +982,8 @@ EOF
"WRITE OPT_FILE \"$x" } @objs).
"\"";
my $write_opt2 =
join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
join("\n\t", map { my $x = $_->{lib} =~ /\[/
? $_->{lib} : "[]".$_->{lib};
$x =~ s|(\.EXE)|$1/SHARE|;
$x =~ s|(\.OLB)|$1/LIB|;
"WRITE OPT_FILE \"$x\"" } @deps)
@@ -1015,7 +1016,7 @@ EOF
grep { platform->isdef($_) }
@{$args{objs}};
my @deps = compute_lib_depends(@{$args{deps}});
my $deps = join(", -\n\t\t", @objs, @defs, @deps);
my $deps = join(", -\n\t\t", @objs, @defs, map { $_->{lib} } @deps);
die "More than one symbol vector" if scalar @defs > 1;
my $shlib_target = $disabled{shared} ? "" : $target{shared_target};
# The "[]" hack is because in .OPT files, each line inherits the
@@ -1027,7 +1028,8 @@ EOF
"WRITE OPT_FILE \"$x" } @objs).
"\"";
my $write_opt2 =
join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
join("\n\t", map { my $x = $_->{lib} =~ /\[/
? $_->{lib} : "[]".$_->{lib};
$x =~ s|(\.EXE)|$1/SHARE|;
$x =~ s|(\.OLB)|$1/LIB|;
"WRITE OPT_FILE \"$x\"" } @deps)
@@ -1071,9 +1073,9 @@ EOF
@{$args{objs}};
my $objs = join(",", @objs);
my @deps = compute_lib_depends(@{$args{deps}});
my $deps = join(", -\n\t\t", @objs, @deps);
my $deps = join(", -\n\t\t", @objs, map { $_->{lib} } @deps);
my $olb_count = scalar grep(m|\.OLB$|, @deps);
my $olb_count = scalar grep(m|\.OLB$|, map { $_->{lib} } @deps);
my $analyse_objs = "@ !";
if ($olb_count > 0) {
my $analyse_quals =
@@ -1089,16 +1091,22 @@ EOF
"\@ WRITE OPT_FILE \"$x" } @objs).
"\"";
my $write_opt2 =
join("\n\t", map { my @lines = (
"\ WRITE OPT_FILE \"CASE_SENSITIVE=YES\""
);
my $x = $_ =~ /\[/ ? $_ : "[]".$_;
join("\n\t", "WRITE OPT_FILE \"CASE_SENSITIVE=YES\"",
map { my @lines = ();
use Data::Dumper;
my $x = $_->{lib} =~ /\[/
? $_->{lib} : "[]".$_->{lib};
if ($x =~ m|\.EXE$|) {
push @lines, "\@ WRITE OPT_FILE \"$x/SHARE\"";
} elsif ($x =~ m|\.OLB$|) {
(my $l = $x) =~ s/\W/_/g;
push @lines,
"\@ IF nomain THEN WRITE OPT_FILE \"$x/LIB\$(INCLUDE_MAIN_$l)\"",
# Special hack to include the MAIN object
# module explicitly. This will only be done
# if there isn't a 'main' in the program's
# object modules already.
my $main = $_->{attrs}->{has_main}
? '/INCLUDE=main' : '';
push @lines,
"\@ IF nomain THEN WRITE OPT_FILE \"$x/LIB$main\"",
"\@ IF .NOT. nomain THEN WRITE OPT_FILE \"$x/LIB\""
}
@lines
Configurations/unix-Makefile.tmpl
+1 -1
View File
@@ -800,7 +800,7 @@ errors:
include/internal/o_str.h
include/internal/err.h
include/internal/sslconf.h );
our @cryptoskipheaders = ( @sslheaders,
our @cryptoskipheaders = ( @sslheaders,
qw( include/openssl/conf_api.h
include/openssl/ebcdic.h
include/openssl/opensslconf.h
Configure
+2 -41
View File
@@ -1713,10 +1713,6 @@ if ($builder eq "unified") {
my @libraries = ();
my @engines = ();
my @scripts = ();
my @extra = ();
my @overrides = ();
my @intermediates = ();
my @rawlines = ();
my %attributes = ();
my %sources = ();
@@ -1806,7 +1802,6 @@ if ($builder eq "unified") {
$attributes{$p}->{$ak} = $av;
}
}
push @programs, @p;
}
},
qr/^\s*LIBS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
@@ -1826,7 +1821,6 @@ if ($builder eq "unified") {
$attributes{$l}->{$ak} = $av;
}
}
push @libraries, @l;
}
},
qr/^\s*ENGINES(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
@@ -1846,7 +1840,6 @@ if ($builder eq "unified") {
$attributes{$e}->{$ak} = $av;
}
}
push @engines, @e;
}
},
qr/^\s*SCRIPTS(?:{([\w=]+(?:\s*,\s*[\w=]+)*)})?\s*=\s*(.*)\s*$/
@@ -1866,15 +1859,8 @@ if ($builder eq "unified") {
$attributes{$s}->{$ak} = $av;
}
}
push @scripts, @s;
}
},
qr/^\s*EXTRA\s*=\s*(.*)\s*$/
=> sub { push @extra, tokenize($1)
if !@skip || $skip[$#skip] > 0 },
qr/^\s*OVERRIDES\s*=\s*(.*)\s*$/
=> sub { push @overrides, tokenize($1)
if !@skip || $skip[$#skip] > 0 },
qr/^\s*ORDINALS\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/,
=> sub { push @{$ordinals{$1}}, tokenize($2)
@@ -1897,27 +1883,6 @@ if ($builder eq "unified") {
qr/^\s*GENERATE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { push @{$generate{$1}}, $2
if !@skip || $skip[$#skip] > 0 },
qr/^\s*RENAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { warn "RENAME is no longer supported\n" },
qr/^\s*SHARED_NAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
=> sub { warn "SHARED_NAME is no longer supported\n" },
qr/^\s*BEGINRAW\[((?:\\.|[^\\\]])+)\]\s*$/
=> sub {
my $lineiterator = shift;
my $target_kind = $1;
while (defined $lineiterator->()) {
s|\R$||;
if (/^\s*ENDRAW\[((?:\\.|[^\\\]])+)\]\s*$/) {
die "ENDRAW doesn't match BEGINRAW"
if $1 ne $target_kind;
last;
}
next if @skip && $skip[$#skip] <= 0;
push @rawlines, $_
if ($target_kind eq $target{build_file}
|| $target_kind eq $target{build_file}."(".$builder_platform.")");
}
},
qr/^\s*(?:#.*)?$/ => sub { },
"OTHERWISE" => sub { die "Something wrong with this line:\n$_\nat $sourced/$f" },
"BEFORE" => sub {
@@ -1952,9 +1917,7 @@ EOF
my %infos = ( programs => [ @programs ],
libraries => [ @libraries ],
engines => [ @engines ],
scripts => [ @scripts ],
extra => [ @extra ],
overrides => [ @overrides ] );
scripts => [ @scripts ] );
foreach my $k (keys %infos) {
foreach (@{$infos{$k}}) {
my $item = cleanfile($buildd, $_, $blddir);
@@ -1963,8 +1926,6 @@ EOF
}
}
push @{$unified_info{rawlines}}, @rawlines;
# Check that we haven't defined any library as both shared and
# explicitly static. That is forbidden.
my @doubles = ();
@@ -2259,7 +2220,7 @@ EOF
### Make unified_info a bit more efficient
# One level structures
foreach (("programs", "libraries", "engines", "scripts", "extra", "overrides")) {
foreach (("programs", "libraries", "engines", "scripts")) {
$unified_info{$_} = [ sort keys %{$unified_info{$_}} ];
}
# Two level structures
INSTALL
+5 -5
View File
@@ -973,10 +973,10 @@
* COMPILING existing applications
OpenSSL 1.1.0 hides a number of structures that were previously
open. This includes all internal libssl structures and a number
of EVP types. Accessor functions have been added to allow
controlled access to the structures' data.
Starting with version 1.1.0, OpenSSL hides a number of structures
that were previously open. This includes all internal libssl
structures and a number of EVP types. Accessor functions have
been added to allow controlled access to the structures' data.
This means that some software needs to be rewritten to adapt to
the new ways of doing things. This often amounts to allocating
@@ -1079,7 +1079,7 @@
depend
Rebuild the dependencies in the Makefiles. This is a legacy
option that no longer needs to be used in OpenSSL 1.1.0.
option that no longer needs to be used since OpenSSL 1.1.0.
install
Install all OpenSSL components.
NOTES.ANDROID
+1 -1
View File
@@ -26,7 +26,7 @@
you need to set ANDROID_NDK_HOME environment to point at NDK directory
as /some/where/android-ndk-<ver>. Both variables are significant at both
configuration and compilation times. NDK customarily supports multiple
Android API levels, e.g. android-14, android-21, etc. By default latest
Android API levels, e.g. android-14, android-21, etc. By default latest
one available is chosen. If you need to target older platform, pass
additional -D__ANDROID_API__=N to Configure. N is numeric value of the
target platform version. For example, to compile for ICS on ARM with
NOTES.DJGPP
+2 -2
View File
@@ -1,5 +1,5 @@
INSTALLATION ON THE DOS PLATFORM WITH DJGPP
-------------------------------------------
@@ -29,7 +29,7 @@
running "./Configure" with appropriate arguments:
./Configure no-threads --prefix=/dev/env/DJDIR DJGPP
And finally fire up "make". You may run out of DPMI selectors when
running in a DOS box under Windows. If so, just close the BASH
shell, go back to Windows, and restart BASH. Then run "make" again.
NOTES.VMS
+1 -1
View File
@@ -42,7 +42,7 @@
for now is to rename the OpenSSL source directory, as follows (please
adjust for the actual source directory name you have):
$ rename openssl-1^.1^.0.DIR openssl-1_1_0.DIR
$ rename openssl-1^.1^.0.DIR openssl-1_1_0.DIR
About MMS and DCL
apps/ct_log_list.cnf
+2 -2
View File
@@ -2,8 +2,8 @@
# that are to be trusted.
# Google's list of logs can be found here:
# www.certificate-transparency.org/known-logs
# www.certificate-transparency.org/known-logs
# A Python program to convert the log list to OpenSSL's format can be
# found here:
# https://github.com/google/certificate-transparency/blob/master/python/utilities/log_list/print_log_list.py
# https://github.com/google/certificate-transparency/blob/master/python/utilities/log_list/print_log_list.py
# Use the "--openssl_output" flag.
apps/demoSRP/srp_verifier.txt
+1 -1
View File
@@ -3,4 +3,4 @@
# records starting with a I followed by the g and N values and the id.
# The exact values ... you have to dig this out from the source of srp.c
# or srp_vfy.c
# The last value of an I is used as the default group for new users.
# The last value of an I is used as the default group for new users.
apps/dh1024.pem
+1 -1
View File
@@ -4,7 +4,7 @@ Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL
/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC
-----END DH PARAMETERS-----
These are the 1024-bit DH parameters from "Internet Key Exchange
These are the 1024-bit DH parameters from "Internet Key Exchange
Protocol Version 2 (IKEv2)": https://tools.ietf.org/html/rfc5996
See https://tools.ietf.org/html/rfc2412 for how they were generated.
apps/dh2048.pem
+2 -2
View File
@@ -7,8 +7,8 @@ fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==
-----END DH PARAMETERS-----
These are the 2048-bit DH parameters from "More Modular Exponential
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
These are the 2048-bit DH parameters from "More Modular Exponential
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
https://tools.ietf.org/html/rfc3526
See https://tools.ietf.org/html/rfc2412 for how they were generated.
apps/dh4096.pem
+2 -2
View File
@@ -12,8 +12,8 @@ ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O
HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=
-----END DH PARAMETERS-----
These are the 4096-bit DH parameters from "More Modular Exponential
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
These are the 4096-bit DH parameters from "More Modular Exponential
(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)":
https://tools.ietf.org/html/rfc3526
See https://tools.ietf.org/html/rfc2412 for how they were generated.
apps/openssl-vms.cnf
+2 -2
View File
@@ -18,7 +18,7 @@ oid_section = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
@@ -115,7 +115,7 @@ x509_extensions = v3_ca # The extensions to add to the self signed cert
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
apps/openssl.cnf
+2 -2
View File
@@ -18,7 +18,7 @@ oid_section = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
@@ -115,7 +115,7 @@ x509_extensions = v3_ca # The extensions to add to the self signed cert
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
apps/pkcs12.c
+7
View File
@@ -311,6 +311,13 @@ int pkcs12_main(int argc, char **argv)
if (cpass != NULL) {
mpass = cpass;
noprompt = 1;
if (twopass) {
if (export_cert)
BIO_printf(bio_err, "Option -twopass cannot be used with -passout or -password\n");
else
BIO_printf(bio_err, "Option -twopass cannot be used with -passin or -password\n");
goto end;
}
} else {
cpass = pass;
mpass = macpass;
apps/s_client.c
+17 -2
View File
@@ -598,6 +598,7 @@ typedef enum OPTION_choice {
#endif
OPT_DANE_TLSA_RRDATA, OPT_DANE_EE_NO_NAME,
OPT_ENABLE_PHA,
OPT_SCTP_LABEL_BUG,
OPT_R_ENUM
} OPTION_CHOICE;
@@ -754,6 +755,7 @@ const OPTIONS s_client_options[] = {
#endif
#ifndef OPENSSL_NO_SCTP
{"sctp", OPT_SCTP, '-', "Use SCTP"},
{"sctp_label_bug", OPT_SCTP_LABEL_BUG, '-', "Enable SCTP label length bug"},
#endif
#ifndef OPENSSL_NO_SSL_TRACE
{"trace", OPT_TRACE, '-', "Show trace output of protocol messages"},
@@ -982,6 +984,9 @@ int s_client_main(int argc, char **argv)
#endif
char *psksessf = NULL;
int enable_pha = 0;
#ifndef OPENSSL_NO_SCTP
int sctp_label_bug = 0;
#endif
FD_ZERO(&readfds);
FD_ZERO(&writefds);
@@ -1333,6 +1338,11 @@ int s_client_main(int argc, char **argv)
case OPT_SCTP:
#ifndef OPENSSL_NO_SCTP
protocol = IPPROTO_SCTP;
#endif
break;
case OPT_SCTP_LABEL_BUG:
#ifndef OPENSSL_NO_SCTP
sctp_label_bug = 1;
#endif
break;
case OPT_TIMEOUT:
@@ -1729,6 +1739,11 @@ int s_client_main(int argc, char **argv)
}
}
#ifndef OPENSSL_NO_SCTP
if (protocol == IPPROTO_SCTP && sctp_label_bug == 1)
SSL_CTX_set_mode(ctx, SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG);
#endif
if (min_version != 0
&& SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
goto end;
@@ -2345,7 +2360,7 @@ int s_client_main(int argc, char **argv)
BIO_push(fbio, sbio);
BIO_printf(fbio, "CONNECT %s HTTP/1.0\r\n", connectstr);
/*
/*
* Workaround for broken proxies which would otherwise close
* the connection when entering tunnel mode (eg Squid 2.6)
*/
@@ -3534,7 +3549,7 @@ static char *base64encode (const void *buf, size_t len)
i = EVP_EncodeBlock((unsigned char *)out, buf, len);
assert(i <= (int)outl);
if (i < 0)
*out = '\0';
*out = '\0';
return out;
}
apps/s_server.c
+17 -2
View File
@@ -751,7 +751,7 @@ typedef enum OPTION_choice {
OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN,
OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,
OPT_KEYLOG_FILE, OPT_MAX_EARLY, OPT_RECV_MAX_EARLY, OPT_EARLY_DATA,
OPT_S_NUM_TICKETS, OPT_ANTI_REPLAY, OPT_NO_ANTI_REPLAY,
OPT_S_NUM_TICKETS, OPT_ANTI_REPLAY, OPT_NO_ANTI_REPLAY, OPT_SCTP_LABEL_BUG,
OPT_R_ENUM,
OPT_S_ENUM,
OPT_V_ENUM,
@@ -938,6 +938,7 @@ const OPTIONS s_server_options[] = {
#endif
#ifndef OPENSSL_NO_SCTP
{"sctp", OPT_SCTP, '-', "Use SCTP"},
{"sctp_label_bug", OPT_SCTP_LABEL_BUG, '-', "Enable SCTP label length bug"},
#endif
#ifndef OPENSSL_NO_DH
{"no_dhe", OPT_NO_DHE, '-', "Disable ephemeral DH"},
@@ -1047,6 +1048,9 @@ int s_server_main(int argc, char *argv[])
const char *keylog_file = NULL;
int max_early_data = -1, recv_max_early_data = -1;
char *psksessf = NULL;
#ifndef OPENSSL_NO_SCTP
int sctp_label_bug = 0;
#endif
/* Init of few remaining global variables */
local_argc = argc;
@@ -1407,7 +1411,7 @@ int s_server_main(int argc, char *argv[])
for (p = psk_key = opt_arg(); *p; p++) {
if (isxdigit(_UC(*p)))
continue;
BIO_printf(bio_err, "Not a hex number '%s'\n", *argv);
BIO_printf(bio_err, "Not a hex number '%s'\n", psk_key);
goto end;
}
break;
@@ -1488,6 +1492,11 @@ int s_server_main(int argc, char *argv[])
case OPT_SCTP:
#ifndef OPENSSL_NO_SCTP
protocol = IPPROTO_SCTP;
#endif
break;
case OPT_SCTP_LABEL_BUG:
#ifndef OPENSSL_NO_SCTP
sctp_label_bug = 1;
#endif
break;
case OPT_TIMEOUT:
@@ -1792,6 +1801,12 @@ int s_server_main(int argc, char *argv[])
goto end;
}
}
#ifndef OPENSSL_NO_SCTP
if (protocol == IPPROTO_SCTP && sctp_label_bug == 1)
SSL_CTX_set_mode(ctx, SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG);
#endif
if (min_version != 0
&& SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
goto end;
config
+8 -8
View File
@@ -19,7 +19,7 @@ THERE=`dirname $0`
# pick up any command line args to config
for i
do
case "$i" in
case "$i" in
-d*) options=$options" --debug";;
-t*) DRYRUN="true" VERBOSE="true";;
-v*) VERBOSE="true";;
@@ -59,7 +59,7 @@ __CNF_LDLIBS=
# Now test for ISC and SCO, since it is has a braindamaged uname.
#
# We need to work around FreeBSD 1.1.5.1
# We need to work around FreeBSD 1.1.5.1
(
XREL=`uname -X 2>/dev/null | grep "^Release" | awk '{print $3}'`
if [ "x$XREL" != "x" ]; then
@@ -363,7 +363,7 @@ esac
# At this point we gone through all the one's
# we know of: Punt
echo "${MACHINE}-whatever-${SYSTEM}"
echo "${MACHINE}-whatever-${SYSTEM}"
exit 0
) 2>/dev/null | (
@@ -433,7 +433,7 @@ fi
CCVER=${CCVER:-0}
# read the output of the embedded GuessOS
# read the output of the embedded GuessOS
read GUESSOS
echo Operating system: $GUESSOS
@@ -732,7 +732,7 @@ case "$GUESSOS" in
*-*-[Uu]nix[Ww]are7)
if [ "$CC" = "gcc" ]; then
OUT="unixware-7-gcc" ; options="$options no-sse2"
else
else
OUT="unixware-7" ; options="$options no-sse2"
__CNF_CPPFLAGS="$__CNF_CPPFLAGS -D__i386__"
fi
@@ -793,7 +793,7 @@ case "$GUESSOS" in
OUT="aix64-gcc"
fi
elif [ $OBJECT_MODE -eq 64 ]; then
echo 'Your $OBJECT_MODE was found to be set to 64'
echo 'Your $OBJECT_MODE was found to be set to 64'
OUT="aix64-cc"
else
OUT="aix-cc"
@@ -897,7 +897,7 @@ if [ ".$PERL" = . ] ; then
exit 1
fi
# run Configure to check to see if we need to specify the
# run Configure to check to see if we need to specify the
# compiler for the platform ... in which case we add it on
# the end ... otherwise we leave it off
@@ -920,7 +920,7 @@ if [ $? = "0" ]; then
__CNF_LDFLAGS="'$__CNF_LDFLAGS'" \
__CNF_LDLIBS="'$__CNF_LDLIBS'" \
$PERL $THERE/Configure $OUT $options
fi
fi
if [ "$DRYRUN" = "false" ]; then
# eval to make sure quoted options, possibly with spaces inside,
# are treated right
crypto/aes/build.info
+1 -10
View File
@@ -52,13 +52,4 @@ INCLUDE[bsaes-armv7.o]=..
GENERATE[aes-s390x.S]=asm/aes-s390x.pl $(PERLASM_SCHEME)
INCLUDE[aes-s390x.o]=..
BEGINRAW[Makefile]
##### AES assembler implementations
# GNU make "catch all"
{- $builddir -}/aes-%.S: {- $sourcedir -}/asm/aes-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
{- $builddir -}/bsaes-%.S: {- $sourcedir -}/asm/bsaes-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile]
GENERATE[aes-c64xplus.S]=asm/aes-c64xplus.pl $(PERLASM_SCHEME)
crypto/asn1/d2i_pu.c
+1 -1
View File
@@ -32,7 +32,7 @@ EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp,
} else
ret = *a;
if (!EVP_PKEY_set_type(ret, type)) {
if (type != EVP_PKEY_id(ret) && !EVP_PKEY_set_type(ret, type)) {
ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_EVP_LIB);
goto err;
}
crypto/blake2/blake2_locl.h
+24 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -49,6 +49,7 @@ struct blake2s_ctx_st {
uint32_t f[2];
uint8_t buf[BLAKE2S_BLOCKBYTES];
size_t buflen;
size_t outlen;
};
struct blake2b_param_st {
@@ -73,6 +74,7 @@ struct blake2b_ctx_st {
uint64_t f[2];
uint8_t buf[BLAKE2B_BLOCKBYTES];
size_t buflen;
size_t outlen;
};
#define BLAKE2B_DIGEST_LENGTH 64
@@ -81,10 +83,29 @@ struct blake2b_ctx_st {
typedef struct blake2s_ctx_st BLAKE2S_CTX;
typedef struct blake2b_ctx_st BLAKE2B_CTX;
int BLAKE2b_Init(BLAKE2B_CTX *c);
int BLAKE2b_Init(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P);
int BLAKE2b_Init_key(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P, const void *key);
int BLAKE2b_Update(BLAKE2B_CTX *c, const void *data, size_t datalen);
int BLAKE2b_Final(unsigned char *md, BLAKE2B_CTX *c);
int BLAKE2s_Init(BLAKE2S_CTX *c);
/*
* These setters are internal and do not check the validity of their parameters.
* See blake2b_mac_ctrl for validation logic.
*/
void blake2b_param_init(BLAKE2B_PARAM *P);
void blake2b_param_set_digest_length(BLAKE2B_PARAM *P, uint8_t outlen);
void blake2b_param_set_key_length(BLAKE2B_PARAM *P, uint8_t keylen);
void blake2b_param_set_personal(BLAKE2B_PARAM *P, const uint8_t *personal, size_t length);
void blake2b_param_set_salt(BLAKE2B_PARAM *P, const uint8_t *salt, size_t length);
int BLAKE2s_Init(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P);
int BLAKE2s_Init_key(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P, const void *key);
int BLAKE2s_Update(BLAKE2S_CTX *c, const void *data, size_t datalen);
int BLAKE2s_Final(unsigned char *md, BLAKE2S_CTX *c);
void blake2s_param_init(BLAKE2S_PARAM *P);
void blake2s_param_set_digest_length(BLAKE2S_PARAM *P, uint8_t outlen);
void blake2s_param_set_key_length(BLAKE2S_PARAM *P, uint8_t keylen);
void blake2s_param_set_personal(BLAKE2S_PARAM *P, const uint8_t *personal, size_t length);
void blake2s_param_set_salt(BLAKE2S_PARAM *P, const uint8_t *salt, size_t length);
crypto/blake2/blake2b.c
+69 -9
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -62,12 +62,14 @@ static ossl_inline void blake2b_init0(BLAKE2B_CTX *S)
}
}
/* init xors IV with input parameter block */
/* init xors IV with input parameter block and sets the output length */
static void blake2b_init_param(BLAKE2B_CTX *S, const BLAKE2B_PARAM *P)
{
size_t i;
const uint8_t *p = (const uint8_t *)(P);
blake2b_init0(S);
S->outlen = P->digest_length;
/* The param struct is carefully hand packed, and should be 64 bytes on
* every platform. */
@@ -78,10 +80,9 @@ static void blake2b_init_param(BLAKE2B_CTX *S, const BLAKE2B_PARAM *P)
}
}
/* Initialize the hashing context. Always returns 1. */
int BLAKE2b_Init(BLAKE2B_CTX *c)
/* Initialize the parameter block with default values */
void blake2b_param_init(BLAKE2B_PARAM *P)
{
BLAKE2B_PARAM P[1];
P->digest_length = BLAKE2B_DIGEST_LENGTH;
P->key_length = 0;
P->fanout = 1;
@@ -93,10 +94,60 @@ int BLAKE2b_Init(BLAKE2B_CTX *c)
memset(P->reserved, 0, sizeof(P->reserved));
memset(P->salt, 0, sizeof(P->salt));
memset(P->personal, 0, sizeof(P->personal));
}
void blake2b_param_set_digest_length(BLAKE2B_PARAM *P, uint8_t outlen)
{
P->digest_length = outlen;
}
void blake2b_param_set_key_length(BLAKE2B_PARAM *P, uint8_t keylen)
{
P->key_length = keylen;
}
void blake2b_param_set_personal(BLAKE2B_PARAM *P, const uint8_t *personal, size_t len)
{
memcpy(P->personal, personal, len);
memset(P->personal + len, 0, BLAKE2B_PERSONALBYTES - len);
}
void blake2b_param_set_salt(BLAKE2B_PARAM *P, const uint8_t *salt, size_t len)
{
memcpy(P->salt, salt, len);
memset(P->salt + len, 0, BLAKE2B_SALTBYTES - len);
}
/*
* Initialize the hashing context with the given parameter block.
* Always returns 1.
*/
int BLAKE2b_Init(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P)
{
blake2b_init_param(c, P);
return 1;
}
/*
* Initialize the hashing context with the given parameter block and key.
* Always returns 1.
*/
int BLAKE2b_Init_key(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P, const void *key)
{
blake2b_init_param(c, P);
/* Pad the key to form first data block */
{
uint8_t block[BLAKE2B_BLOCKBYTES] = {0};
memcpy(block, key, P->key_length);
BLAKE2b_Update(c, block, BLAKE2B_BLOCKBYTES);
OPENSSL_cleanse(block, BLAKE2B_BLOCKBYTES);
}
return 1;
}
/* Permute the state while xoring in the block of data. */
static void blake2b_compress(BLAKE2B_CTX *S,
const uint8_t *blocks,
@@ -252,17 +303,26 @@ int BLAKE2b_Update(BLAKE2B_CTX *c, const void *data, size_t datalen)
*/
int BLAKE2b_Final(unsigned char *md, BLAKE2B_CTX *c)
{
uint8_t outbuffer[BLAKE2B_OUTBYTES] = {0};
uint8_t *target = outbuffer;
int iter = (c->outlen + 7) / 8;
int i;
/* Avoid writing to the temporary buffer if possible */
if ((c->outlen % sizeof(c->h[0])) == 0)
target = md;
blake2b_set_lastblock(c);
/* Padding */
memset(c->buf + c->buflen, 0, sizeof(c->buf) - c->buflen);
blake2b_compress(c, c->buf, c->buflen);
/* Output full hash to message digest */
for (i = 0; i < 8; ++i) {
store64(md + sizeof(c->h[i]) * i, c->h[i]);
}
/* Output full hash to buffer */
for (i = 0; i < iter; ++i)
store64(target + sizeof(c->h[i]) * i, c->h[i]);
if (target != md)
memcpy(md, target, c->outlen);
OPENSSL_cleanse(c, sizeof(BLAKE2B_CTX));
return 1;
crypto/blake2/blake2b_mac.c
+190
View File
@@ -0,0 +1,190 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#ifndef OPENSSL_NO_BLAKE2
# include <openssl/evp.h>
# include "blake2_locl.h"
# include "internal/cryptlib.h"
# include "internal/evp_int.h"
/* typedef EVP_MAC_IMPL */
struct evp_mac_impl_st {
BLAKE2B_CTX ctx;
BLAKE2B_PARAM params;
unsigned char key[BLAKE2B_KEYBYTES];
};
static EVP_MAC_IMPL *blake2b_mac_new(void)
{
EVP_MAC_IMPL *macctx = OPENSSL_zalloc(sizeof(*macctx));
if (macctx != NULL) {
blake2b_param_init(&macctx->params);
/* ctx initialization is deferred to BLAKE2b_Init() */
}
return macctx;
}
static void blake2b_mac_free(EVP_MAC_IMPL *macctx)
{
if (macctx != NULL) {
OPENSSL_cleanse(macctx->key, sizeof(macctx->key));
OPENSSL_free(macctx);
}
}
static int blake2b_mac_copy(EVP_MAC_IMPL *dst, EVP_MAC_IMPL *src)
{
*dst = *src;
return 1;
}
static int blake2b_mac_init(EVP_MAC_IMPL *macctx)
{
/* Check key has been set */
if (macctx->params.key_length == 0) {
EVPerr(EVP_F_BLAKE2B_MAC_INIT, EVP_R_NO_KEY_SET);
return 0;
}
return BLAKE2b_Init_key(&macctx->ctx, &macctx->params, macctx->key);
}
static int blake2b_mac_update(EVP_MAC_IMPL *macctx, const unsigned char *data,
size_t datalen)
{
return BLAKE2b_Update(&macctx->ctx, data, datalen);
}
static int blake2b_mac_final(EVP_MAC_IMPL *macctx, unsigned char *out)
{
return BLAKE2b_Final(out, &macctx->ctx);
}
/*
* ALL Ctrl functions should be set before init().
*/
static int blake2b_mac_ctrl(EVP_MAC_IMPL *macctx, int cmd, va_list args)
{
const unsigned char *p;
size_t len;
size_t size;
switch (cmd) {
case EVP_MAC_CTRL_SET_SIZE:
size = va_arg(args, size_t);
if (size < 1 || size > BLAKE2B_OUTBYTES) {
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
return 0;
}
blake2b_param_set_digest_length(&macctx->params, (uint8_t)size);
return 1;
case EVP_MAC_CTRL_SET_KEY:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len < 1 || len > BLAKE2B_KEYBYTES) {
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_INVALID_KEY_LENGTH);
return 0;
}
blake2b_param_set_key_length(&macctx->params, (uint8_t)len);
memcpy(macctx->key, p, len);
memset(macctx->key + len, 0, BLAKE2B_KEYBYTES - len);
return 1;
case EVP_MAC_CTRL_SET_CUSTOM:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len > BLAKE2B_PERSONALBYTES) {
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_INVALID_CUSTOM_LENGTH);
return 0;
}
blake2b_param_set_personal(&macctx->params, p, len);
return 1;
case EVP_MAC_CTRL_SET_SALT:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len > BLAKE2B_SALTBYTES) {
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_INVALID_SALT_LENGTH);
return 0;
}
blake2b_param_set_salt(&macctx->params, p, len);
return 1;
default:
return -2;
}
}
static int blake2b_mac_ctrl_int(EVP_MAC_IMPL *macctx, int cmd, ...)
{
int rv;
va_list args;
va_start(args, cmd);
rv = blake2b_mac_ctrl(macctx, cmd, args);
va_end(args);
return rv;
}
static int blake2b_mac_ctrl_str_cb(void *macctx, int cmd, void *buf, size_t buflen)
{
return blake2b_mac_ctrl_int(macctx, cmd, buf, buflen);
}
static int blake2b_mac_ctrl_str(EVP_MAC_IMPL *macctx, const char *type,
const char *value)
{
if (value == NULL)
return 0;
if (strcmp(type, "outlen") == 0)
return blake2b_mac_ctrl_int(macctx, EVP_MAC_CTRL_SET_SIZE, (size_t)atoi(value));
if (strcmp(type, "key") == 0)
return EVP_str2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
value);
if (strcmp(type, "hexkey") == 0)
return EVP_hex2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
value);
if (strcmp(type, "custom") == 0)
return EVP_str2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
value);
if (strcmp(type, "hexcustom") == 0)
return EVP_hex2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
value);
if (strcmp(type, "salt") == 0)
return EVP_str2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
value);
if (strcmp(type, "hexsalt") == 0)
return EVP_hex2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
value);
return -2;
}
static size_t blake2b_mac_size(EVP_MAC_IMPL *macctx)
{
return macctx->params.digest_length;
}
const EVP_MAC blake2b_mac_meth = {
EVP_MAC_BLAKE2B,
blake2b_mac_new,
blake2b_mac_copy,
blake2b_mac_free,
blake2b_mac_size,
blake2b_mac_init,
blake2b_mac_update,
blake2b_mac_final,
blake2b_mac_ctrl,
blake2b_mac_ctrl_str
};
#endif
crypto/blake2/blake2s.c
+69 -12
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -58,27 +58,26 @@ static ossl_inline void blake2s_init0(BLAKE2S_CTX *S)
}
}
/* init2 xors IV with input parameter block */
/* init xors IV with input parameter block and sets the output length */
static void blake2s_init_param(BLAKE2S_CTX *S, const BLAKE2S_PARAM *P)
{
const uint8_t *p = (const uint8_t *)(P);
size_t i;
const uint8_t *p = (const uint8_t *)(P);
blake2s_init0(S);
S->outlen = P->digest_length;
/* The param struct is carefully hand packed, and should be 32 bytes on
* every platform. */
assert(sizeof(BLAKE2S_PARAM) == 32);
blake2s_init0(S);
/* IV XOR ParamBlock */
for (i = 0; i < 8; ++i) {
S->h[i] ^= load32(&p[i*4]);
}
}
/* Initialize the hashing context. Always returns 1. */
int BLAKE2s_Init(BLAKE2S_CTX *c)
void blake2s_param_init(BLAKE2S_PARAM *P)
{
BLAKE2S_PARAM P[1];
P->digest_length = BLAKE2S_DIGEST_LENGTH;
P->key_length = 0;
P->fanout = 1;
@@ -89,10 +88,59 @@ int BLAKE2s_Init(BLAKE2S_CTX *c)
P->inner_length = 0;
memset(P->salt, 0, sizeof(P->salt));
memset(P->personal, 0, sizeof(P->personal));
}
void blake2s_param_set_digest_length(BLAKE2S_PARAM *P, uint8_t outlen)
{
P->digest_length = outlen;
}
void blake2s_param_set_key_length(BLAKE2S_PARAM *P, uint8_t keylen)
{
P->key_length = keylen;
}
void blake2s_param_set_personal(BLAKE2S_PARAM *P, const uint8_t *personal, size_t len)
{
memcpy(P->personal, personal, len);
memset(P->personal + len, 0, BLAKE2S_PERSONALBYTES - len);
}
void blake2s_param_set_salt(BLAKE2S_PARAM *P, const uint8_t *salt, size_t len)
{
memcpy(P->salt, salt, len);
memset(P->salt + len, 0, BLAKE2S_SALTBYTES - len);}
/*
* Initialize the hashing context with the given parameter block.
* Always returns 1.
*/
int BLAKE2s_Init(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P)
{
blake2s_init_param(c, P);
return 1;
}
/*
* Initialize the hashing context with the given parameter block and key.
* Always returns 1.
*/
int BLAKE2s_Init_key(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P, const void *key)
{
blake2s_init_param(c, P);
/* Pad the key to form first data block */
{
uint8_t block[BLAKE2S_BLOCKBYTES] = {0};
memcpy(block, key, P->key_length);
BLAKE2s_Update(c, block, BLAKE2S_BLOCKBYTES);
OPENSSL_cleanse(block, BLAKE2S_BLOCKBYTES);
}
return 1;
}
/* Permute the state while xoring in the block of data. */
static void blake2s_compress(BLAKE2S_CTX *S,
const uint8_t *blocks,
@@ -246,17 +294,26 @@ int BLAKE2s_Update(BLAKE2S_CTX *c, const void *data, size_t datalen)
*/
int BLAKE2s_Final(unsigned char *md, BLAKE2S_CTX *c)
{
uint8_t outbuffer[BLAKE2S_OUTBYTES] = {0};
uint8_t *target = outbuffer;
int iter = (c->outlen + 3) / 4;
int i;
/* Avoid writing to the temporary buffer if possible */
if ((c->outlen % sizeof(c->h[0])) == 0)
target = md;
blake2s_set_lastblock(c);
/* Padding */
memset(c->buf + c->buflen, 0, sizeof(c->buf) - c->buflen);
blake2s_compress(c, c->buf, c->buflen);
/* Output full hash to temp buffer */
for (i = 0; i < 8; ++i) {
store32(md + sizeof(c->h[i]) * i, c->h[i]);
}
/* Output full hash to buffer */
for (i = 0; i < iter; ++i)
store32(target + sizeof(c->h[i]) * i, c->h[i]);
if (target != md)
memcpy(md, target, c->outlen);
OPENSSL_cleanse(c, sizeof(BLAKE2S_CTX));
return 1;
crypto/blake2/blake2s_mac.c
+190
View File
@@ -0,0 +1,190 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#ifndef OPENSSL_NO_BLAKE2
# include <openssl/evp.h>
# include "blake2_locl.h"
# include "internal/cryptlib.h"
# include "internal/evp_int.h"
/* typedef EVP_MAC_IMPL */
struct evp_mac_impl_st {
BLAKE2S_CTX ctx;
BLAKE2S_PARAM params;
unsigned char key[BLAKE2S_KEYBYTES];
};
static EVP_MAC_IMPL *blake2s_mac_new(void)
{
EVP_MAC_IMPL *macctx = OPENSSL_zalloc(sizeof(*macctx));
if (macctx != NULL) {
blake2s_param_init(&macctx->params);
/* ctx initialization is deferred to BLAKE2s_Init() */
}
return macctx;
}
static void blake2s_mac_free(EVP_MAC_IMPL *macctx)
{
if (macctx != NULL) {
OPENSSL_cleanse(macctx->key, sizeof(macctx->key));
OPENSSL_free(macctx);
}
}
static int blake2s_mac_copy(EVP_MAC_IMPL *dst, EVP_MAC_IMPL *src)
{
*dst = *src;
return 1;
}
static int blake2s_mac_init(EVP_MAC_IMPL *macctx)
{
/* Check key has been set */
if (macctx->params.key_length == 0) {
EVPerr(EVP_F_BLAKE2S_MAC_INIT, EVP_R_NO_KEY_SET);
return 0;
}
return BLAKE2s_Init_key(&macctx->ctx, &macctx->params, macctx->key);
}
static int blake2s_mac_update(EVP_MAC_IMPL *macctx, const unsigned char *data,
size_t datalen)
{
return BLAKE2s_Update(&macctx->ctx, data, datalen);
}
static int blake2s_mac_final(EVP_MAC_IMPL *macctx, unsigned char *out)
{
return BLAKE2s_Final(out, &macctx->ctx);
}
/*
* ALL Ctrl functions should be set before init().
*/
static int blake2s_mac_ctrl(EVP_MAC_IMPL *macctx, int cmd, va_list args)
{
const unsigned char *p;
size_t len;
size_t size;
switch (cmd) {
case EVP_MAC_CTRL_SET_SIZE:
size = va_arg(args, size_t);
if (size < 1 || size > BLAKE2S_OUTBYTES) {
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
return 0;
}
blake2s_param_set_digest_length(&macctx->params, (uint8_t)size);
return 1;
case EVP_MAC_CTRL_SET_KEY:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len < 1 || len > BLAKE2S_KEYBYTES) {
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_INVALID_KEY_LENGTH);
return 0;
}
blake2s_param_set_key_length(&macctx->params, (uint8_t)len);
memcpy(macctx->key, p, len);
memset(macctx->key + len, 0, BLAKE2S_KEYBYTES - len);
return 1;
case EVP_MAC_CTRL_SET_CUSTOM:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len > BLAKE2S_PERSONALBYTES) {
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_INVALID_CUSTOM_LENGTH);
return 0;
}
blake2s_param_set_personal(&macctx->params, p, len);
return 1;
case EVP_MAC_CTRL_SET_SALT:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len > BLAKE2S_SALTBYTES) {
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_INVALID_SALT_LENGTH);
return 0;
}
blake2s_param_set_salt(&macctx->params, p, len);
return 1;
default:
return -2;
}
}
static int blake2s_mac_ctrl_int(EVP_MAC_IMPL *macctx, int cmd, ...)
{
int rv;
va_list args;
va_start(args, cmd);
rv = blake2s_mac_ctrl(macctx, cmd, args);
va_end(args);
return rv;
}
static int blake2s_mac_ctrl_str_cb(void *macctx, int cmd, void *buf, size_t buflen)
{
return blake2s_mac_ctrl_int(macctx, cmd, buf, buflen);
}
static int blake2s_mac_ctrl_str(EVP_MAC_IMPL *macctx, const char *type,
const char *value)
{
if (value == NULL)
return 0;
if (strcmp(type, "outlen") == 0)
return blake2s_mac_ctrl_int(macctx, EVP_MAC_CTRL_SET_SIZE, (size_t)atoi(value));
if (strcmp(type, "key") == 0)
return EVP_str2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
value);
if (strcmp(type, "hexkey") == 0)
return EVP_hex2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
value);
if (strcmp(type, "custom") == 0)
return EVP_str2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
value);
if (strcmp(type, "hexcustom") == 0)
return EVP_hex2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
value);
if (strcmp(type, "salt") == 0)
return EVP_str2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
value);
if (strcmp(type, "hexsalt") == 0)
return EVP_hex2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
value);
return -2;
}
static size_t blake2s_mac_size(EVP_MAC_IMPL *macctx)
{
return macctx->params.digest_length;
}
const EVP_MAC blake2s_mac_meth = {
EVP_MAC_BLAKE2S,
blake2s_mac_new,
blake2s_mac_copy,
blake2s_mac_free,
blake2s_mac_size,
blake2s_mac_init,
blake2s_mac_update,
blake2s_mac_final,
blake2s_mac_ctrl,
blake2s_mac_ctrl_str
};
#endif
crypto/blake2/build.info
+1 -1
View File
@@ -1,3 +1,3 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
blake2b.c blake2s.c m_blake2b.c m_blake2s.c
blake2b.c blake2s.c blake2b_mac.c blake2s_mac.c m_blake2b.c m_blake2s.c
crypto/blake2/m_blake2b.c
+5 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -25,7 +25,9 @@
static int init(EVP_MD_CTX *ctx)
{
return BLAKE2b_Init(EVP_MD_CTX_md_data(ctx));
BLAKE2B_PARAM P;
blake2b_param_init(&P);
return BLAKE2b_Init(EVP_MD_CTX_md_data(ctx), &P);
}
static int update(EVP_MD_CTX *ctx, const void *data, size_t count)
@@ -49,7 +51,7 @@ static const EVP_MD blake2b_md = {
NULL,
NULL,
BLAKE2B_BLOCKBYTES,
sizeof(EVP_MD *) + sizeof(BLAKE2B_CTX),
sizeof(BLAKE2B_CTX),
};
const EVP_MD *EVP_blake2b512(void)
crypto/blake2/m_blake2s.c
+5 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -25,7 +25,9 @@
static int init(EVP_MD_CTX *ctx)
{
return BLAKE2s_Init(EVP_MD_CTX_md_data(ctx));
BLAKE2S_PARAM P;
blake2s_param_init(&P);
return BLAKE2s_Init(EVP_MD_CTX_md_data(ctx), &P);
}
static int update(EVP_MD_CTX *ctx, const void *data, size_t count)
@@ -49,7 +51,7 @@ static const EVP_MD blake2s_md = {
NULL,
NULL,
BLAKE2S_BLOCKBYTES,
sizeof(EVP_MD *) + sizeof(BLAKE2S_CTX),
sizeof(BLAKE2S_CTX),
};
const EVP_MD *EVP_blake2s256(void)
crypto/bn/asm/ia64.S
+2 -2
View File
@@ -47,7 +47,7 @@
// on Itanium2! What to do? Reschedule loops for Itanium2? But then
// Itanium would exhibit anti-scalability. So I've chosen to reschedule
// for worst latency for every instruction aiming for best *all-round*
// performance.
// performance.
// Q. How much faster does it get?
// A. Here is the output from 'openssl speed rsa dsa' for vanilla
@@ -471,7 +471,7 @@ bn_mul_add_words:
.global bn_sqr_words#
.proc bn_sqr_words#
.align 64
.skip 32 // makes the loop body aligned at 64-byte boundary
.skip 32 // makes the loop body aligned at 64-byte boundary
bn_sqr_words:
.prologue
.save ar.pfs,r2
crypto/bn/asm/sparcv8plus.S
+2 -2
View File
@@ -154,9 +154,9 @@
.register %g2,#scratch
.register %g3,#scratch
# define FRAME_SIZE -192
#else
#else
# define FRAME_SIZE -96
#endif
#endif
/*
* GNU assembler can't stand stuw:-(
*/
crypto/bn/bn_ctx.c
+2 -2
View File
@@ -256,7 +256,7 @@ static int BN_STACK_push(BN_STACK *st, unsigned int idx)
unsigned int newsize =
st->size ? (st->size * 3 / 2) : BN_CTX_START_FRAMES;
unsigned int *newitems;
if ((newitems = OPENSSL_malloc(sizeof(*newitems) * newsize)) == NULL) {
BNerr(BN_F_BN_STACK_PUSH, ERR_R_MALLOC_FAILURE);
return 0;
@@ -310,7 +310,7 @@ static BIGNUM *BN_POOL_get(BN_POOL *p, int flag)
/* Full; allocate a new pool item and link it in. */
if (p->used == p->size) {
BN_POOL_ITEM *item;
if ((item = OPENSSL_malloc(sizeof(*item))) == NULL) {
BNerr(BN_F_BN_POOL_GET, ERR_R_MALLOC_FAILURE);
return NULL;
crypto/build.info
-3
View File
@@ -14,9 +14,6 @@ SOURCE[../libcrypto]=\
threads_pthread.c threads_win.c threads_none.c getenv.c \
o_init.c o_fips.c mem_sec.c init.c {- $target{cpuid_asm_src} -} \
{- $target{uplink_aux_src} -}
EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \
x86cpuid.pl x86_64cpuid.pl ia64cpuid.S \
ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl
DEPEND[cversion.o]=buildinf.h
GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
crypto/chacha/build.info
+2 -7
View File
@@ -10,10 +10,5 @@ INCLUDE[chacha-armv4.o]=..
GENERATE[chacha-armv8.S]=asm/chacha-armv8.pl $(PERLASM_SCHEME)
INCLUDE[chacha-armv8.o]=..
INCLUDE[chacha-s390x.o]=..
BEGINRAW[Makefile(unix)]
##### CHACHA assembler implementations
{- $builddir -}/chacha-%.S: {- $sourcedir -}/asm/chacha-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile(unix)]
GENERATE[chacha-c64xplus.S]=asm/chacha-c64xplus.pl $(PERLASM_SCHEME)
GENERATE[chacha-s390x.S]=asm/chacha-s390x.pl $(PERLASM_SCHEME)
crypto/cryptlib.c
+3 -3
View File
@@ -352,9 +352,9 @@ void OPENSSL_showfatal(const char *fmta, ...)
/*
* TODO: (For non GUI and no std error cases)
* Add event logging feature here.
* Add event logging feature here.
*/
# if !defined(NDEBUG)
/*
* We are in a situation where we tried to report a critical
@@ -393,7 +393,7 @@ void OPENSSL_showfatal(const char *fmta, ...)
# endif
# else
MessageBox(NULL, buf, _T("OpenSSL: FATAL"), MB_OK | MB_ICONERROR);
# endif
# endif
}
#else
void OPENSSL_showfatal(const char *fmta, ...)
crypto/des/asm/des_enc.m4
+2 -2
View File
@@ -311,7 +311,7 @@ $4:
sll out1, 28, out1 ! rotate
xor $1, local1, $1 ! 1 finished, local1 now sbox 7
ld [global2+local2], local2 ! 2
ld [global2+local2], local2 ! 2
srl out0, 24, local1 ! 7
or out1, local0, out1 ! rotate
@@ -1390,7 +1390,7 @@ DES_ncbc_encrypt:
add %o7,global1,global1
sub global1,.PIC.DES_SPtrans-.des_and,out2
cmp in5, 0 ! enc
cmp in5, 0 ! enc
be .ncbc.dec
STPTR in4, IVEC
crypto/dsa/dsa_pmeth.c
+2 -6
View File
@@ -174,9 +174,7 @@ static int pkey_dsa_ctrl_str(EVP_PKEY_CTX *ctx,
}
if (strcmp(type, "dsa_paramgen_q_bits") == 0) {
int qbits = atoi(value);
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN,
EVP_PKEY_CTRL_DSA_PARAMGEN_Q_BITS, qbits,
NULL);
return EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits);
}
if (strcmp(type, "dsa_paramgen_md") == 0) {
const EVP_MD *md = EVP_get_digestbyname(value);
@@ -185,9 +183,7 @@ static int pkey_dsa_ctrl_str(EVP_PKEY_CTX *ctx,
DSAerr(DSA_F_PKEY_DSA_CTRL_STR, DSA_R_INVALID_DIGEST_TYPE);
return 0;
}
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN,
EVP_PKEY_CTRL_DSA_PARAMGEN_MD, 0,
(void *)md);
return EVP_PKEY_CTX_set_dsa_paramgen_md(ctx, md);
}
return -2;
}
crypto/ec/build.info
-5
View File
@@ -29,11 +29,6 @@ GENERATE[ecp_nistz256-ppc64.s]=asm/ecp_nistz256-ppc64.pl $(PERLASM_SCHEME)
GENERATE[x25519-x86_64.s]=asm/x25519-x86_64.pl $(PERLASM_SCHEME)
GENERATE[x25519-ppc64.s]=asm/x25519-ppc64.pl $(PERLASM_SCHEME)
BEGINRAW[Makefile]
{- $builddir -}/ecp_nistz256-%.S: {- $sourcedir -}/asm/ecp_nistz256-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile]
INCLUDE[curve448/arch_32/f_impl.o]=curve448/arch_32 curve448
INCLUDE[curve448/f_generic.o]=curve448/arch_32 curve448
INCLUDE[curve448/scalar.o]=curve448/arch_32 curve448
crypto/ec/curve448/point_448.h
+7 -7
View File
@@ -116,7 +116,7 @@ void curve448_scalar_encode(unsigned char ser[C448_SCALAR_BYTES],
/*
* Add two scalars. |a|, |b| and |out| may alias each other.
*
*
* a (in): One scalar.
* b (in): Another scalar.
* out (out): a+b.
@@ -135,7 +135,7 @@ void curve448_scalar_sub(curve448_scalar_t out,
/*
* Multiply two scalars. |a|, |b| and |out| may alias each other.
*
*
* a (in): One scalar.
* b (in): Another scalar.
* out (out): a*b.
@@ -145,7 +145,7 @@ void curve448_scalar_mul(curve448_scalar_t out,
/*
* Halve a scalar. |a| and |out| may alias each other.
*
*
* a (in): A scalar.
* out (out): a/2.
*/
@@ -154,7 +154,7 @@ void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a);
/*
* Copy a scalar. The scalars may alias each other, in which case this
* function does nothing.
*
*
* a (in): A scalar.
* out (out): Will become a copy of a.
*/
@@ -183,7 +183,7 @@ static ossl_inline void curve448_point_copy(curve448_point_t a,
*
* a (in): A point.
* b (in): Another point.
*
*
* Returns:
* C448_TRUE: The points are equal.
* C448_FALSE: The points are not equal.
@@ -243,7 +243,7 @@ void curve448_point_mul_by_ratio_and_encode_like_x448(
/*
* RFC 7748 Diffie-Hellman base point scalarmul. This function uses a different
* (non-Decaf) encoding.
*
*
* out (out): The scaled point base*scalar
* scalar (in): The scalar to multiply by.
*/
@@ -273,7 +273,7 @@ void curve448_precomputed_scalarmul(curve448_point_t scaled,
* base2 (in): A second point to be scaled.
* scalar2 (in) A second scalar to multiply by.
*
* Warning: This function takes variable time, and may leak the scalars used.
* Warning: This function takes variable time, and may leak the scalars used.
* It is designed for signature verification.
*/
void curve448_base_double_scalarmul_non_secret(curve448_point_t combo,
crypto/engine/README
+1 -1
View File
@@ -26,7 +26,7 @@ algorithm/mode pair are;
EVP_EncryptInit(&ctx, cipher, key, iv);
[ ... use EVP_EncryptUpdate() and EVP_EncryptFinal() ...]
(ii) indirectly;
(ii) indirectly;
OpenSSL_add_all_ciphers();
cipher = EVP_get_cipherbyname("des_cbc");
EVP_EncryptInit(&ctx, cipher, key, iv);
crypto/engine/eng_lib.c
+1 -1
View File
@@ -124,7 +124,7 @@ static int int_cleanup_check(int create)
static ENGINE_CLEANUP_ITEM *int_cleanup_item(ENGINE_CLEANUP_CB *cb)
{
ENGINE_CLEANUP_ITEM *item;
if ((item = OPENSSL_malloc(sizeof(*item))) == NULL) {
ENGINEerr(ENGINE_F_INT_CLEANUP_ITEM, ERR_R_MALLOC_FAILURE);
return NULL;
crypto/err/openssl.txt
+5
View File
@@ -730,6 +730,10 @@ EVP_F_ARIA_GCM_CTRL:197:aria_gcm_ctrl
EVP_F_ARIA_GCM_INIT_KEY:176:aria_gcm_init_key
EVP_F_ARIA_INIT_KEY:185:aria_init_key
EVP_F_B64_NEW:198:b64_new
EVP_F_BLAKE2B_MAC_CTRL:220:blake2b_mac_ctrl
EVP_F_BLAKE2B_MAC_INIT:221:blake2b_mac_init
EVP_F_BLAKE2S_MAC_CTRL:222:blake2s_mac_ctrl
EVP_F_BLAKE2S_MAC_INIT:223:blake2s_mac_init
EVP_F_CAMELLIA_INIT_KEY:159:camellia_init_key
EVP_F_CHACHA20_POLY1305_CTRL:182:chacha20_poly1305_ctrl
EVP_F_CMLL_T4_INIT_KEY:179:cmll_t4_init_key
@@ -2263,6 +2267,7 @@ EVP_R_INVALID_FIPS_MODE:168:invalid fips mode
EVP_R_INVALID_KEY:163:invalid key
EVP_R_INVALID_KEY_LENGTH:130:invalid key length
EVP_R_INVALID_OPERATION:148:invalid operation
EVP_R_INVALID_SALT_LENGTH:186:invalid salt length
EVP_R_KEYGEN_FAILURE:120:keygen failure
EVP_R_KEY_SETUP_FAILED:180:key setup failed
EVP_R_MEMORY_LIMIT_EXCEEDED:172:memory limit exceeded
crypto/evp/c_allm.c
+4
View File
@@ -12,6 +12,10 @@
void openssl_add_all_macs_int(void)
{
#ifndef OPENSSL_NO_BLAKE2
EVP_add_mac(&blake2b_mac_meth);
EVP_add_mac(&blake2s_mac_meth);
#endif
#ifndef OPENSSL_NO_CMAC
EVP_add_mac(&cmac_meth);
#endif
crypto/evp/e_aes.c
+1 -1
View File
@@ -3081,7 +3081,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
if (out != in
|| len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
return -1;
/*
* Check for too many keys as per FIPS 140-2 IG A.5 "Key/IV Pair Uniqueness
* Requirements from SP 800-38D". The requirements is for one party to the
crypto/evp/evp_err.c
+6
View File
@@ -27,6 +27,10 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
{ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_GCM_INIT_KEY, 0), "aria_gcm_init_key"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_INIT_KEY, 0), "aria_init_key"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_B64_NEW, 0), "b64_new"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2B_MAC_CTRL, 0), "blake2b_mac_ctrl"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2B_MAC_INIT, 0), "blake2b_mac_init"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2S_MAC_CTRL, 0), "blake2s_mac_ctrl"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2S_MAC_INIT, 0), "blake2s_mac_init"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_CAMELLIA_INIT_KEY, 0), "camellia_init_key"},
{ERR_PACK(ERR_LIB_EVP, EVP_F_CHACHA20_POLY1305_CTRL, 0),
"chacha20_poly1305_ctrl"},
@@ -226,6 +230,8 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_KEY), "invalid key"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_KEY_LENGTH), "invalid key length"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_OPERATION), "invalid operation"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_SALT_LENGTH),
"invalid salt length"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_KEYGEN_FAILURE), "keygen failure"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_KEY_SETUP_FAILED), "key setup failed"},
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_MEMORY_LIMIT_EXCEEDED),
crypto/include/internal/evp_int.h
+2
View File
@@ -128,6 +128,8 @@ struct evp_mac_st {
int (*ctrl_str) (EVP_MAC_IMPL *macctx, const char *type, const char *value);
};
extern const EVP_MAC blake2b_mac_meth;
extern const EVP_MAC blake2s_mac_meth;
extern const EVP_MAC cmac_meth;
extern const EVP_MAC gmac_meth;
extern const EVP_MAC hmac_meth;
crypto/modes/build.info
+1 -6
View File
@@ -22,9 +22,4 @@ GENERATE[ghashv8-armx.S]=asm/ghashv8-armx.pl $(PERLASM_SCHEME)
INCLUDE[ghashv8-armx.o]=..
GENERATE[ghash-s390x.S]=asm/ghash-s390x.pl $(PERLASM_SCHEME)
INCLUDE[ghash-s390x.o]=..
BEGINRAW[Makefile]
# GNU make "catch all"
{- $builddir -}/ghash-%.S: {- $sourcedir -}/asm/ghash-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile]
GENERATE[ghash-c64xplus.S]=asm/ghash-c64xplus.pl $(PERLASM_SCHEME)
crypto/objects/obj_dat.h
+11 -5
View File
@@ -1079,7 +1079,7 @@ static const unsigned char so[7767] = {
0x28,0xCC,0x45,0x03,0x04, /* [ 7761] OBJ_gmac */
};
#define NUM_NID 1202
#define NUM_NID 1204
static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"UNDEF", "undefined", NID_undef},
{"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
@@ -2282,10 +2282,12 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"AES-128-SIV", "aes-128-siv", NID_aes_128_siv},
{"AES-192-SIV", "aes-192-siv", NID_aes_192_siv},
{"AES-256-SIV", "aes-256-siv", NID_aes_256_siv},
{"BLAKE2BMAC", "blake2bmac", NID_blake2bmac},
{"BLAKE2SMAC", "blake2smac", NID_blake2smac},
{"ChaCha20-Poly1305-D", "chacha20-poly1305-draft", NID_chacha20_poly1305_draft },
};
#define NUM_SN 1193
#define NUM_SN 1195
static const unsigned int sn_objs[NUM_SN] = {
364, /* "AD_DVCS" */
419, /* "AES-128-CBC" */
@@ -2363,6 +2365,8 @@ static const unsigned int sn_objs[NUM_SN] = {
93, /* "BF-CFB" */
92, /* "BF-ECB" */
94, /* "BF-OFB" */
1201, /* "BLAKE2BMAC" */
1202, /* "BLAKE2SMAC" */
1056, /* "BLAKE2b512" */
1057, /* "BLAKE2s256" */
14, /* "C" */
@@ -2406,7 +2410,7 @@ static const unsigned int sn_objs[NUM_SN] = {
417, /* "CSPName" */
1019, /* "ChaCha20" */
1018, /* "ChaCha20-Poly1305" */
1201, /* "chacha20-poly1305-draft" */
1203, /* "chacha20-poly1305-draft" */
367, /* "CrlID" */
391, /* "DC" */
31, /* "DES-CBC" */
@@ -3482,7 +3486,7 @@ static const unsigned int sn_objs[NUM_SN] = {
1093, /* "x509ExtAdmission" */
};
#define NUM_LN 1193
#define NUM_LN 1195
static const unsigned int ln_objs[NUM_LN] = {
363, /* "AD Time Stamping" */
405, /* "ANSI X9.62" */
@@ -3784,7 +3788,9 @@ static const unsigned int ln_objs[NUM_LN] = {
92, /* "bf-ecb" */
94, /* "bf-ofb" */
1056, /* "blake2b512" */
1201, /* "blake2bmac" */
1057, /* "blake2s256" */
1202, /* "blake2smac" */
921, /* "brainpoolP160r1" */
922, /* "brainpoolP160t1" */
923, /* "brainpoolP192r1" */
@@ -3864,7 +3870,7 @@ static const unsigned int ln_objs[NUM_LN] = {
883, /* "certificateRevocationList" */
1019, /* "chacha20" */
1018, /* "chacha20-poly1305" */
1201, /* "ChaCha20-Poly1305-D" */
1203, /* "ChaCha20-Poly1305-D" */
54, /* "challengePassword" */
407, /* "characteristic-two-field" */
395, /* "clearance" */
crypto/objects/obj_mac.num
+3 -1
View File
@@ -1198,4 +1198,6 @@ kmac256 1197
aes_128_siv 1198
aes_192_siv 1199
aes_256_siv 1200
chacha20_poly1305_draft 1201
blake2bmac 1201
blake2smac 1202
chacha20_poly1305_draft 1203
crypto/objects/objects.txt
+3 -1
View File
@@ -17,7 +17,9 @@ iso 0 9797 3 4 : GMAC : gmac
# There are no OIDs for these yet...
: KMAC128 : kmac128
: KMAC256 : kmac256
: BLAKE2BMAC : blake2bmac
: BLAKE2SMAC : blake2smac
# HMAC OIDs
identified-organization 6 1 5 5 8 1 1 : HMAC-MD5 : hmac-md5
identified-organization 6 1 5 5 8 1 2 : HMAC-SHA1 : hmac-sha1
crypto/pem/pem_info.c
+1 -1
View File
@@ -297,7 +297,7 @@ int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc,
goto err;
}
/* Create the right magic header stuff */
/* Create the right magic header stuff */
buf[0] = '\0';
PEM_proc_type(buf, PEM_TYPE_ENCRYPTED);
PEM_dek_info(buf, objstr, EVP_CIPHER_iv_length(enc),
crypto/perlasm/ppc-xlate.pl
+2
View File
@@ -273,6 +273,8 @@ my $mtvrwz = sub {
my ($f, $vrt, $ra) = @_;
" .long ".sprintf "0x%X",(31<<26)|($vrt<<21)|($ra<<16)|(243<<1)|1;
};
my $lvwzx_u = sub { vsxmem_op(@_, 12); }; # lxsiwzx
my $stvwx_u = sub { vsxmem_op(@_, 140); }; # stxsiwx
# PowerISA 3.0 stuff
my $maddhdu = sub { vfour(@_,49); };
crypto/poly1305/asm/poly1305-ppc.pl
+1440 -108
View File
@@ -8,10 +8,10 @@
#
# ====================================================================
# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
# project. The module is, however, dual licensed under OpenSSL and
# CRYPTOGAMS licenses depending on where you obtain it. For further
# details see http://www.openssl.org/~appro/cryptogams/.
# Written by Andy Polyakov, @dot-asm, initially for use in the OpenSSL
# project. The module is dual licensed under OpenSSL and CRYPTOGAMS
# licenses depending on where you obtain it. For further details see
# https://github.com/dot-asm/cryptogams/.
# ====================================================================
#
# This module implements Poly1305 hash for PowerPC.
@@ -44,6 +44,13 @@
#
# On side note, Power ISA 2.07 enables vector base 2^26 implementation,
# and POWER8 might have capacity to break 1.0 cycle per byte barrier...
#
# January 2019
#
# ... Unfortunately not:-( Estimate was a projection of ARM result,
# but ARM has vector multiply-n-add instruction, while PowerISA does
# not, not one usable in the context. Improvement is ~40% over -m64
# result above and is ~1.43 on little-endian systems.
$flavour = shift;
@@ -99,6 +106,7 @@ $code.=<<___;
std r0,0($ctx) # zero hash value
std r0,8($ctx)
std r0,16($ctx)
stw r0,24($ctx) # clear is_base2_26
$UCMP $inp,r0
beq- Lno_key
@@ -140,6 +148,7 @@ Lno_key:
.globl .poly1305_blocks
.align 4
.poly1305_blocks:
Lpoly1305_blocks:
srdi. $len,$len,4
beq- Labort
@@ -238,60 +247,120 @@ Labort:
.long 0
.byte 0,12,4,1,0x80,5,4,0
.size .poly1305_blocks,.-.poly1305_blocks
___
{
my ($h0,$h1,$h2,$h3,$h4,$t0) = map("r$_",(7..12));
$code.=<<___;
.globl .poly1305_emit
.align 4
.align 5
.poly1305_emit:
ld $h0,0($ctx) # load hash
ld $h1,8($ctx)
ld $h2,16($ctx)
ld $padbit,0($nonce) # load nonce
ld $nonce,8($nonce)
lwz $h0,0($ctx) # load hash value base 2^26
lwz $h1,4($ctx)
lwz $h2,8($ctx)
lwz $h3,12($ctx)
lwz $h4,16($ctx)
lwz r0,24($ctx) # is_base2_26
addic $d0,$h0,5 # compare to modulus
addze $d1,$h1
addze $d2,$h2
sldi $h1,$h1,26 # base 2^26 -> base 2^64
sldi $t0,$h2,52
srdi $h2,$h2,12
sldi $h3,$h3,14
add $h0,$h0,$h1
addc $h0,$h0,$t0
sldi $t0,$h4,40
srdi $h4,$h4,24
adde $h1,$h2,$h3
addc $h1,$h1,$t0
addze $h2,$h4
srdi $mask,$d2,2 # did it carry/borrow?
neg $mask,$mask
ld $h3,0($ctx) # load hash value base 2^64
ld $h4,8($ctx)
ld $t0,16($ctx)
neg r0,r0
xor $h0,$h0,$h3 # choose between radixes
xor $h1,$h1,$h4
xor $h2,$h2,$t0
and $h0,$h0,r0
and $h1,$h1,r0
and $h2,$h2,r0
xor $h0,$h0,$h3
xor $h1,$h1,$h4
xor $h2,$h2,$t0
addic $h3,$h0,5 # compare to modulus
addze $h4,$h1
addze $t0,$h2
srdi $t0,$t0,2 # see if it carried/borrowed
neg $t0,$t0
andc $h0,$h0,$t0
and $h3,$h3,$t0
andc $h1,$h1,$t0
and $h4,$h4,$t0
or $h0,$h0,$h3
or $h1,$h1,$h4
lwz $t0,4($nonce)
lwz $h2,12($nonce)
lwz $h3,0($nonce)
lwz $h4,8($nonce)
insrdi $h3,$t0,32,0
insrdi $h4,$h2,32,0
addc $h0,$h0,$h3 # accumulate nonce
adde $h1,$h1,$h4
addi $ctx,$mac,-1
addi $mac,$mac,7
stbu $h0,1($ctx) # write [little-endian] result
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
srdi $h0,$h0,8
stbu $h1,1($mac)
srdi $h1,$h1,8
stbu $h0,1($ctx)
stbu $h1,1($mac)
andc $h0,$h0,$mask
and $d0,$d0,$mask
andc $h1,$h1,$mask
and $d1,$d1,$mask
or $h0,$h0,$d0
or $h1,$h1,$d1
___
$code.=<<___ if (!$LITTLE_ENDIAN);
rotldi $padbit,$padbit,32 # flip nonce words
rotldi $nonce,$nonce,32
___
$code.=<<___;
addc $h0,$h0,$padbit # accumulate nonce
adde $h1,$h1,$nonce
___
$code.=<<___ if ($LITTLE_ENDIAN);
std $h0,0($mac) # write result
std $h1,8($mac)
___
$code.=<<___ if (!$LITTLE_ENDIAN);
extrdi r0,$h0,32,0
li $d0,4
stwbrx $h0,0,$mac # write result
extrdi $h0,$h1,32,0
li $d1,8
stwbrx r0,$d0,$mac
li $d2,12
stwbrx $h1,$d1,$mac
stwbrx $h0,$d2,$mac
___
$code.=<<___;
blr
.long 0
.byte 0,12,0x14,0,0,0,3,0
.size .poly1305_emit,.-.poly1305_emit
___
} else {
} } else {
###############################################################################
# base 2^32 implementation
@@ -309,6 +378,7 @@ $code.=<<___;
stw r0,8($ctx)
stw r0,12($ctx)
stw r0,16($ctx)
stw r0,24($ctx) # clear is_base2_26
$UCMP $inp,r0
beq- Lno_key
@@ -353,6 +423,7 @@ Lno_key:
.globl .poly1305_blocks
.align 4
.poly1305_blocks:
Lpoly1305_blocks:
srwi. $len,$len,4
beq- Labort
@@ -560,17 +631,389 @@ Labort:
.long 0
.byte 0,12,4,1,0x80,18,4,0
.size .poly1305_blocks,.-.poly1305_blocks
___
{
my ($h0,$h1,$h2,$h3,$h4,$t0,$t1) = map("r$_",(6..12));
$code.=<<___;
.globl .poly1305_emit
.align 4
.align 5
.poly1305_emit:
$STU $sp,-$FRAME($sp)
lwz r0,24($ctx) # is_base2_26
lwz $h0,0($ctx) # load hash value
lwz $h1,4($ctx)
lwz $h2,8($ctx)
lwz $h3,12($ctx)
lwz $h4,16($ctx)
cmplwi r0,0
beq Lemit_base2_32
slwi $t0,$h1,26 # base 2^26 -> base 2^32
srwi $h1,$h1,6
slwi $t1,$h2,20
srwi $h2,$h2,12
addc $h0,$h0,$t0
slwi $t0,$h3,14
srwi $h3,$h3,18
adde $h1,$h1,$t1
slwi $t1,$h4,8
srwi $h4,$h4,24
adde $h2,$h2,$t0
adde $h3,$h3,$t1
addze $h4,$h4
Lemit_base2_32:
addic r0,$h0,5 # compare to modulus
addze r0,$h1
addze r0,$h2
addze r0,$h3
addze r0,$h4
srwi r0,r0,2 # see if it carried/borrowed
neg r0,r0
andi. r0,r0,5
addc $h0,$h0,r0
lwz r0,0($nonce)
addze $h1,$h1
lwz $t0,4($nonce)
addze $h2,$h2
lwz $t1,8($nonce)
addze $h3,$h3
lwz $h4,12($nonce)
addc $h0,$h0,r0 # accumulate nonce
adde $h1,$h1,$t0
adde $h2,$h2,$t1
adde $h3,$h3,$h4
addi $ctx,$mac,-1
addi $mac,$mac,7
stbu $h0,1($ctx) # write [little-endian] result
srwi $h0,$h0,8
stbu $h2,1($mac)
srwi $h2,$h2,8
stbu $h0,1($ctx)
srwi $h0,$h0,8
stbu $h2,1($mac)
srwi $h2,$h2,8
stbu $h0,1($ctx)
srwi $h0,$h0,8
stbu $h2,1($mac)
srwi $h2,$h2,8
stbu $h0,1($ctx)
stbu $h2,1($mac)
stbu $h1,1($ctx)
srwi $h1,$h1,8
stbu $h3,1($mac)
srwi $h3,$h3,8
stbu $h1,1($ctx)
srwi $h1,$h1,8
stbu $h3,1($mac)
srwi $h3,$h3,8
stbu $h1,1($ctx)
srwi $h1,$h1,8
stbu $h3,1($mac)
srwi $h3,$h3,8
stbu $h1,1($ctx)
stbu $h3,1($mac)
blr
.long 0
.byte 0,12,0x14,0,0,0,3,0
.size .poly1305_emit,.-.poly1305_emit
___
} }
{{{
########################################################################
# PowerISA 2.07/VSX section #
########################################################################
my $LOCALS= 6*$SIZE_T;
my $VSXFRAME = $LOCALS + 6*$SIZE_T;
$VSXFRAME += 128; # local variables
$VSXFRAME += 13*16; # v20-v31 offload
my $BIG_ENDIAN = ($flavour !~ /le/) ? 4 : 0;
########################################################################
# Layout of opaque area is following:
#
# unsigned __int32 h[5]; # current hash value base 2^26
# unsigned __int32 pad;
# unsigned __int32 is_base2_26, pad;
# unsigned __int64 r[2]; # key value base 2^64
# struct { unsigned __int32 r^2, r^4, r^1, r^3; } r[9];
#
# where r^n are base 2^26 digits of powers of multiplier key. There are
# 5 digits, but last four are interleaved with multiples of 5, totalling
# in 9 elements: r0, r1, 5*r1, r2, 5*r2, r3, 5*r3, r4, 5*r4. Order of
# powers is as they appear in register, not memory.
my ($H0, $H1, $H2, $H3, $H4) = map("v$_",(0..4));
my ($I0, $I1, $I2, $I3, $I4) = map("v$_",(5..9));
my ($R0, $R1, $S1, $R2, $S2) = map("v$_",(10..14));
my ($R3, $S3, $R4, $S4) = ($R1, $S1, $R2, $S2);
my ($ACC0, $ACC1, $ACC2, $ACC3, $ACC4) = map("v$_",(15..19));
my ($T0, $T1, $T2, $T3, $T4) = map("v$_",(20..24));
my ($_26,$_4,$_40,$_14,$mask26,$padbits,$I2perm) = map("v$_",(25..31));
my ($x00,$x60,$x70,$x10,$x20,$x30,$x40,$x50) = (0, map("r$_",(7,8,27..31)));
my ($ctx_,$_ctx,$const) = map("r$_",(10..12));
if ($flavour =~ /64/) {
###############################################################################
# setup phase of poly1305_blocks_vsx is different on 32- and 64-bit platforms,
# but the base 2^26 computational part is same...
my ($h0,$h1,$h2,$d0,$d1,$d2, $r0,$r1,$s1, $t0,$t1) = map("r$_",(6..11,27..31));
my $mask = "r0";
$code.=<<___;
.globl .poly1305_blocks_vsx
.align 5
.poly1305_blocks_vsx:
lwz r7,24($ctx) # is_base2_26
cmpldi $len,128
bge __poly1305_blocks_vsx
neg r0,r7 # is_base2_26 as mask
lwz r7,0($ctx) # load hash base 2^26
lwz r8,4($ctx)
lwz r9,8($ctx)
lwz r10,12($ctx)
lwz r11,16($ctx)
sldi r8,r8,26 # base 2^26 -> base 2^64
sldi r12,r9,52
add r7,r7,r8
srdi r9,r9,12
sldi r10,r10,14
addc r7,r7,r12
sldi r8,r11,40
adde r9,r9,r10
srdi r11,r11,24
addc r9,r9,r8
addze r11,r11
ld r8,0($ctx) # load hash base 2^64
ld r10,8($ctx)
ld r12,16($ctx)
xor r7,r7,r8 # select between radixes
xor r9,r9,r10
xor r11,r11,r12
and r7,r7,r0
and r9,r9,r0
and r11,r11,r0
xor r7,r7,r8
xor r9,r9,r10
xor r11,r11,r12
li r0,0
std r7,0($ctx) # store hash base 2^64
std r9,8($ctx)
std r11,16($ctx)
stw r0,24($ctx) # clear is_base2_26
b Lpoly1305_blocks
.long 0
.byte 0,12,0x14,0,0,0,4,0
.size .poly1305_blocks_vsx,.-.poly1305_blocks_vsx
.align 5
__poly1305_mul:
mulld $d0,$h0,$r0 # h0*r0
mulhdu $d1,$h0,$r0
mulld $t0,$h1,$s1 # h1*5*r1
mulhdu $t1,$h1,$s1
addc $d0,$d0,$t0
adde $d1,$d1,$t1
mulld $t0,$h0,$r1 # h0*r1
mulhdu $d2,$h0,$r1
addc $d1,$d1,$t0
addze $d2,$d2
mulld $t0,$h1,$r0 # h1*r0
mulhdu $t1,$h1,$r0
addc $d1,$d1,$t0
adde $d2,$d2,$t1
mulld $t0,$h2,$s1 # h2*5*r1
mulld $t1,$h2,$r0 # h2*r0
addc $d1,$d1,$t0
adde $d2,$d2,$t1
andc $t0,$d2,$mask # final reduction step
and $h2,$d2,$mask
srdi $t1,$t0,2
add $t0,$t0,$t1
addc $h0,$d0,$t0
addze $h1,$d1
addze $h2,$h2
blr
.long 0
.byte 0,12,0x14,0,0,0,0,0
.size __poly1305_mul,.-__poly1305_mul
.align 5
__poly1305_splat:
extrdi $d0,$h0,26,38
extrdi $d1,$h0,26,12
stw $d0,0x00($t1)
extrdi $d2,$h0,12,0
slwi $d0,$d1,2
stw $d1,0x10($t1)
add $d0,$d0,$d1 # * 5
stw $d0,0x20($t1)
insrdi $d2,$h1,14,38
slwi $d0,$d2,2
stw $d2,0x30($t1)
add $d0,$d0,$d2 # * 5
stw $d0,0x40($t1)
extrdi $d1,$h1,26,24
extrdi $d2,$h1,24,0
slwi $d0,$d1,2
stw $d1,0x50($t1)
add $d0,$d0,$d1 # * 5
stw $d0,0x60($t1)
insrdi $d2,$h2,3,37
slwi $d0,$d2,2
stw $d2,0x70($t1)
add $d0,$d0,$d2 # * 5
stw $d0,0x80($t1)
blr
.long 0
.byte 0,12,0x14,0,0,0,0,0
.size __poly1305_splat,.-__poly1305_splat
.align 5
__poly1305_blocks_vsx:
$STU $sp,-$VSXFRAME($sp)
mflr r0
$PUSH r28,`$FRAME-$SIZE_T*4`($sp)
$PUSH r29,`$FRAME-$SIZE_T*3`($sp)
$PUSH r30,`$FRAME-$SIZE_T*2`($sp)
$PUSH r31,`$FRAME-$SIZE_T*1`($sp)
$PUSH r0,`$FRAME+$LRSAVE`($sp)
li r10,`15+$LOCALS+128`
li r11,`31+$LOCALS+128`
mfspr r12,256
stvx v20,r10,$sp
addi r10,r10,32
stvx v21,r11,$sp
addi r11,r11,32
stvx v22,r10,$sp
addi r10,r10,32
stvx v23,r10,$sp
addi r10,r10,32
stvx v24,r11,$sp
addi r11,r11,32
stvx v25,r10,$sp
addi r10,r10,32
stvx v26,r10,$sp
addi r10,r10,32
stvx v27,r11,$sp
addi r11,r11,32
stvx v28,r10,$sp
addi r10,r10,32
stvx v29,r11,$sp
addi r11,r11,32
stvx v30,r10,$sp
stvx v31,r11,$sp
stw r12,`$VSXFRAME-$SIZE_T*5-4`($sp)# save vrsave
li r12,-1
mtspr 256,r12 # preserve all AltiVec registers
$PUSH r27,`$VSXFRAME-$SIZE_T*5`($sp)
$PUSH r28,`$VSXFRAME-$SIZE_T*4`($sp)
$PUSH r29,`$VSXFRAME-$SIZE_T*3`($sp)
$PUSH r30,`$VSXFRAME-$SIZE_T*2`($sp)
$PUSH r31,`$VSXFRAME-$SIZE_T*1`($sp)
$PUSH r0,`$VSXFRAME+$LRSAVE`($sp)
bl LPICmeup
li $x10,0x10
li $x20,0x20
li $x30,0x30
li $x40,0x40
li $x50,0x50
lvx_u $mask26,$x00,$const
lvx_u $_26,$x10,$const
lvx_u $_40,$x20,$const
lvx_u $I2perm,$x30,$const
lvx_u $padbits,$x40,$const
cmplwi r7,0 # is_base2_26?
bne Lskip_init_vsx
ld $r0,32($ctx) # load key base 2^64
ld $r1,40($ctx)
srdi $s1,$r1,2
li $mask,3
add $s1,$s1,$r1 # s1 = r1 + r1>>2
mr $h0,$r0 # "calculate" r^1
mr $h1,$r1
li $h2,0
addi $t1,$ctx,`48+(12^$BIG_ENDIAN)`
bl __poly1305_splat
bl __poly1305_mul # caclulate r^2
addi $t1,$ctx,`48+(4^$BIG_ENDIAN)`
bl __poly1305_splat
bl __poly1305_mul # caclulate r^3
addi $t1,$ctx,`48+(8^$BIG_ENDIAN)`
bl __poly1305_splat
bl __poly1305_mul # caclulate r^4
addi $t1,$ctx,`48+(0^$BIG_ENDIAN)`
bl __poly1305_splat
ld $h0,0($ctx) # load hash
ld $h1,8($ctx)
ld $h2,16($ctx)
extrdi $d0,$h0,26,38 # base 2^64 -> base 2^26
extrdi $d1,$h0,26,12
extrdi $d2,$h0,12,0
mtvrwz $H0,$d0
insrdi $d2,$h1,14,38
mtvrwz $H1,$d1
extrdi $d1,$h1,26,24
mtvrwz $H2,$d2
extrdi $d2,$h1,24,0
mtvrwz $H3,$d1
insrdi $d2,$h2,3,37
mtvrwz $H4,$d2
___
} else {
###############################################################################
# 32-bit initialization
my ($h0,$h1,$h2,$h3,$h4,$t0,$t1) = map("r$_",(7..11,0,12));
my ($R3,$S3,$R4,$S4)=($I1,$I2,$I3,$I4);
$code.=<<___;
.globl .poly1305_blocks_vsx
.align 5
.poly1305_blocks_vsx:
lwz r7,24($ctx) # is_base2_26
cmplwi $len,128
bge __poly1305_blocks_vsx
cmplwi r7,0
beq Lpoly1305_blocks
lwz $h0,0($ctx) # load hash
lwz $h1,4($ctx)
@@ -578,68 +1021,957 @@ Labort:
lwz $h3,12($ctx)
lwz $h4,16($ctx)
addic $d0,$h0,5 # compare to modulus
addze $d1,$h1
addze $d2,$h2
addze $d3,$h3
addze $mask,$h4
slwi $t0,$h1,26 # base 2^26 -> base 2^32
srwi $h1,$h1,6
slwi $t1,$h2,20
srwi $h2,$h2,12
addc $h0,$h0,$t0
slwi $t0,$h3,14
srwi $h3,$h3,18
adde $h1,$h1,$t1
slwi $t1,$h4,8
srwi $h4,$h4,24
adde $h2,$h2,$t0
li $t0,0
adde $h3,$h3,$t1
addze $h4,$h4
srwi $mask,$mask,2 # did it carry/borrow?
neg $mask,$mask
stw $h0,0($ctx) # store hash base 2^32
stw $h1,4($ctx)
stw $h2,8($ctx)
stw $h3,12($ctx)
stw $h4,16($ctx)
stw $t0,24($ctx) # clear is_base2_26
andc $h0,$h0,$mask
and $d0,$d0,$mask
andc $h1,$h1,$mask
and $d1,$d1,$mask
or $h0,$h0,$d0
lwz $d0,0($nonce) # load nonce
andc $h2,$h2,$mask
and $d2,$d2,$mask
or $h1,$h1,$d1
lwz $d1,4($nonce)
andc $h3,$h3,$mask
and $d3,$d3,$mask
or $h2,$h2,$d2
lwz $d2,8($nonce)
or $h3,$h3,$d3
lwz $d3,12($nonce)
b Lpoly1305_blocks
.long 0
.byte 0,12,0x14,0,0,0,4,0
.size .poly1305_blocks_vsx,.-.poly1305_blocks_vsx
.align 5
__poly1305_mul:
vmulouw $ACC0,$H0,$R0
vmulouw $ACC1,$H1,$R0
vmulouw $ACC2,$H2,$R0
vmulouw $ACC3,$H3,$R0
vmulouw $ACC4,$H4,$R0
vmulouw $T0,$H4,$S1
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H0,$R1
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H1,$R1
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H2,$R1
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H3,$R1
vaddudm $ACC4,$ACC4,$T0
vmulouw $T0,$H3,$S2
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H4,$S2
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H0,$R2
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H1,$R2
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H2,$R2
vaddudm $ACC4,$ACC4,$T0
vmulouw $T0,$H2,$S3
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H3,$S3
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H4,$S3
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H0,$R3
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H1,$R3
vaddudm $ACC4,$ACC4,$T0
vmulouw $T0,$H1,$S4
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H2,$S4
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H3,$S4
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H4,$S4
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H0,$R4
vaddudm $ACC4,$ACC4,$T0
################################################################
# lazy reduction
vspltisb $T0,2
vsrd $H4,$ACC3,$_26
vsrd $H1,$ACC0,$_26
vand $H3,$ACC3,$mask26
vand $H0,$ACC0,$mask26
vaddudm $H4,$H4,$ACC4 # h3 -> h4
vaddudm $H1,$H1,$ACC1 # h0 -> h1
vsrd $ACC4,$H4,$_26
vsrd $ACC1,$H1,$_26
vand $H4,$H4,$mask26
vand $H1,$H1,$mask26
vaddudm $H0,$H0,$ACC4
vaddudm $H2,$ACC2,$ACC1 # h1 -> h2
vsld $ACC4,$ACC4,$T0 # <<2
vsrd $ACC2,$H2,$_26
vand $H2,$H2,$mask26
vaddudm $H0,$H0,$ACC4 # h4 -> h0
vaddudm $H3,$H3,$ACC2 # h2 -> h3
vsrd $ACC0,$H0,$_26
vsrd $ACC3,$H3,$_26
vand $H0,$H0,$mask26
vand $H3,$H3,$mask26
vaddudm $H1,$H1,$ACC0 # h0 -> h1
vaddudm $H4,$H4,$ACC3 # h3 -> h4
addc $h0,$h0,$d0 # accumulate nonce
adde $h1,$h1,$d1
adde $h2,$h2,$d2
adde $h3,$h3,$d3
___
$code.=<<___ if ($LITTLE_ENDIAN);
stw $h0,0($mac) # write result
stw $h1,4($mac)
stw $h2,8($mac)
stw $h3,12($mac)
___
$code.=<<___ if (!$LITTLE_ENDIAN);
li $d1,4
stwbrx $h0,0,$mac # write result
li $d2,8
stwbrx $h1,$d1,$mac
li $d3,12
stwbrx $h2,$d2,$mac
stwbrx $h3,$d3,$mac
___
$code.=<<___;
$POP r28,`$FRAME-$SIZE_T*4`($sp)
$POP r29,`$FRAME-$SIZE_T*3`($sp)
$POP r30,`$FRAME-$SIZE_T*2`($sp)
$POP r31,`$FRAME-$SIZE_T*1`($sp)
addi $sp,$sp,$FRAME
blr
.long 0
.byte 0,12,4,1,0x80,4,3,0
.size .poly1305_emit,.-.poly1305_emit
.byte 0,12,0x14,0,0,0,0,0
.size __poly1305_mul,.-__poly1305_mul
.align 5
__poly1305_blocks_vsx:
$STU $sp,-$VSXFRAME($sp)
mflr r0
li r10,`15+$LOCALS+128`
li r11,`31+$LOCALS+128`
mfspr r12,256
stvx v20,r10,$sp
addi r10,r10,32
stvx v21,r11,$sp
addi r11,r11,32
stvx v22,r10,$sp
addi r10,r10,32
stvx v23,r10,$sp
addi r10,r10,32
stvx v24,r11,$sp
addi r11,r11,32
stvx v25,r10,$sp
addi r10,r10,32
stvx v26,r10,$sp
addi r10,r10,32
stvx v27,r11,$sp
addi r11,r11,32
stvx v28,r10,$sp
addi r10,r10,32
stvx v29,r11,$sp
addi r11,r11,32
stvx v30,r10,$sp
stvx v31,r11,$sp
stw r12,`$VSXFRAME-$SIZE_T*5-4`($sp)# save vrsave
li r12,-1
mtspr 256,r12 # preserve all AltiVec registers
$PUSH r27,`$VSXFRAME-$SIZE_T*5`($sp)
$PUSH r28,`$VSXFRAME-$SIZE_T*4`($sp)
$PUSH r29,`$VSXFRAME-$SIZE_T*3`($sp)
$PUSH r30,`$VSXFRAME-$SIZE_T*2`($sp)
$PUSH r31,`$VSXFRAME-$SIZE_T*1`($sp)
$PUSH r0,`$VSXFRAME+$LRSAVE`($sp)
bl LPICmeup
li $x10,0x10
li $x20,0x20
li $x30,0x30
li $x40,0x40
li $x50,0x50
lvx_u $mask26,$x00,$const
lvx_u $_26,$x10,$const
lvx_u $_40,$x20,$const
lvx_u $I2perm,$x30,$const
lvx_u $padbits,$x40,$const
cmplwi r7,0 # is_base2_26?
bne Lskip_init_vsx
lwz $h1,32($ctx) # load key base 2^32
lwz $h2,36($ctx)
lwz $h3,40($ctx)
lwz $h4,44($ctx)
extrwi $h0,$h1,26,6 # base 2^32 -> base 2^26
extrwi $h1,$h1,6,0
insrwi $h1,$h2,20,6
extrwi $h2,$h2,12,0
insrwi $h2,$h3,14,6
extrwi $h3,$h3,18,0
insrwi $h3,$h4,8,6
extrwi $h4,$h4,24,0
mtvrwz $R0,$h0
slwi $h0,$h1,2
mtvrwz $R1,$h1
add $h1,$h1,$h0
mtvrwz $S1,$h1
slwi $h1,$h2,2
mtvrwz $R2,$h2
add $h2,$h2,$h1
mtvrwz $S2,$h2
slwi $h2,$h3,2
mtvrwz $R3,$h3
add $h3,$h3,$h2
mtvrwz $S3,$h3
slwi $h3,$h4,2
mtvrwz $R4,$h4
add $h4,$h4,$h3
mtvrwz $S4,$h4
vmr $H0,$R0
vmr $H1,$R1
vmr $H2,$R2
vmr $H3,$R3
vmr $H4,$R4
bl __poly1305_mul # r^1:- * r^1:-
vpermdi $R0,$H0,$R0,0b00
vpermdi $R1,$H1,$R1,0b00
vpermdi $R2,$H2,$R2,0b00
vpermdi $R3,$H3,$R3,0b00
vpermdi $R4,$H4,$R4,0b00
vpermdi $H0,$H0,$H0,0b00
vpermdi $H1,$H1,$H1,0b00
vpermdi $H2,$H2,$H2,0b00
vpermdi $H3,$H3,$H3,0b00
vpermdi $H4,$H4,$H4,0b00
vsld $S1,$R1,$T0 # <<2
vsld $S2,$R2,$T0
vsld $S3,$R3,$T0
vsld $S4,$R4,$T0
vaddudm $S1,$S1,$R1
vaddudm $S2,$S2,$R2
vaddudm $S3,$S3,$R3
vaddudm $S4,$S4,$R4
bl __poly1305_mul # r^2:r^2 * r^2:r^1
addi $h0,$ctx,0x60
lwz $h1,0($ctx) # load hash
lwz $h2,4($ctx)
lwz $h3,8($ctx)
lwz $h4,12($ctx)
lwz $t0,16($ctx)
vmrgow $R0,$R0,$H0 # r^2:r^4:r^1:r^3
vmrgow $R1,$R1,$H1
vmrgow $R2,$R2,$H2
vmrgow $R3,$R3,$H3
vmrgow $R4,$R4,$H4
vslw $S1,$R1,$T0 # <<2
vslw $S2,$R2,$T0
vslw $S3,$R3,$T0
vslw $S4,$R4,$T0
vadduwm $S1,$S1,$R1
vadduwm $S2,$S2,$R2
vadduwm $S3,$S3,$R3
vadduwm $S4,$S4,$R4
stvx_u $R0,$x30,$ctx
stvx_u $R1,$x40,$ctx
stvx_u $S1,$x50,$ctx
stvx_u $R2,$x00,$h0
stvx_u $S2,$x10,$h0
stvx_u $R3,$x20,$h0
stvx_u $S3,$x30,$h0
stvx_u $R4,$x40,$h0
stvx_u $S4,$x50,$h0
extrwi $h0,$h1,26,6 # base 2^32 -> base 2^26
extrwi $h1,$h1,6,0
mtvrwz $H0,$h0
insrwi $h1,$h2,20,6
extrwi $h2,$h2,12,0
mtvrwz $H1,$h1
insrwi $h2,$h3,14,6
extrwi $h3,$h3,18,0
mtvrwz $H2,$h2
insrwi $h3,$h4,8,6
extrwi $h4,$h4,24,0
mtvrwz $H3,$h3
insrwi $h4,$t0,3,5
mtvrwz $H4,$h4
___
}
$code.=<<___;
.asciz "Poly1305 for PPC, CRYPTOGAMS by <appro\@openssl.org>"
li r0,1
stw r0,24($ctx) # set is_base2_26
b Loaded_vsx
.align 4
Lskip_init_vsx:
li $x10,4
li $x20,8
li $x30,12
li $x40,16
lvwzx_u $H0,$x00,$ctx
lvwzx_u $H1,$x10,$ctx
lvwzx_u $H2,$x20,$ctx
lvwzx_u $H3,$x30,$ctx
lvwzx_u $H4,$x40,$ctx
Loaded_vsx:
li $x10,0x10
li $x20,0x20
li $x30,0x30
li $x40,0x40
li $x50,0x50
li $x60,0x60
li $x70,0x70
addi $ctx_,$ctx,64 # &ctx->r[1]
addi $_ctx,$sp,`$LOCALS+15` # &ctx->r[1], r^2:r^4 shadow
vxor $T0,$T0,$T0 # ensure second half is zero
vpermdi $H0,$H0,$T0,0b00
vpermdi $H1,$H1,$T0,0b00
vpermdi $H2,$H2,$T0,0b00
vpermdi $H3,$H3,$T0,0b00
vpermdi $H4,$H4,$T0,0b00
be?lvx_u $_4,$x50,$const # byte swap mask
lvx_u $T1,$x00,$inp # load first input block
lvx_u $T2,$x10,$inp
lvx_u $T3,$x20,$inp
lvx_u $T4,$x30,$inp
be?vperm $T1,$T1,$T1,$_4
be?vperm $T2,$T2,$T2,$_4
be?vperm $T3,$T3,$T3,$_4
be?vperm $T4,$T4,$T4,$_4
vpermdi $I0,$T1,$T2,0b00 # smash input to base 2^26
vspltisb $_4,4
vperm $I2,$T1,$T2,$I2perm # 0x...0e0f0001...1e1f1011
vspltisb $_14,14
vpermdi $I3,$T1,$T2,0b11
vsrd $I1,$I0,$_26
vsrd $I2,$I2,$_4
vsrd $I4,$I3,$_40
vsrd $I3,$I3,$_14
vand $I0,$I0,$mask26
vand $I1,$I1,$mask26
vand $I2,$I2,$mask26
vand $I3,$I3,$mask26
vpermdi $T1,$T3,$T4,0b00
vperm $T2,$T3,$T4,$I2perm # 0x...0e0f0001...1e1f1011
vpermdi $T3,$T3,$T4,0b11
vsrd $T0,$T1,$_26
vsrd $T2,$T2,$_4
vsrd $T4,$T3,$_40
vsrd $T3,$T3,$_14
vand $T1,$T1,$mask26
vand $T0,$T0,$mask26
vand $T2,$T2,$mask26
vand $T3,$T3,$mask26
# inp[2]:inp[0]:inp[3]:inp[1]
vmrgow $I4,$T4,$I4
vmrgow $I0,$T1,$I0
vmrgow $I1,$T0,$I1
vmrgow $I2,$T2,$I2
vmrgow $I3,$T3,$I3
vor $I4,$I4,$padbits
lvx_splt $R0,$x30,$ctx # taking lvx_vsplt out of loop
lvx_splt $R1,$x00,$ctx_ # gives ~8% improvement
lvx_splt $S1,$x10,$ctx_
lvx_splt $R2,$x20,$ctx_
lvx_splt $S2,$x30,$ctx_
lvx_splt $T1,$x40,$ctx_
lvx_splt $T2,$x50,$ctx_
lvx_splt $T3,$x60,$ctx_
lvx_splt $T4,$x70,$ctx_
stvx $R1,$x00,$_ctx
stvx $S1,$x10,$_ctx
stvx $R2,$x20,$_ctx
stvx $S2,$x30,$_ctx
stvx $T1,$x40,$_ctx
stvx $T2,$x50,$_ctx
stvx $T3,$x60,$_ctx
stvx $T4,$x70,$_ctx
addi $inp,$inp,0x40
addi $const,$const,0x50
addi r0,$len,-64
srdi r0,r0,6
mtctr r0
b Loop_vsx
.align 4
Loop_vsx:
################################################################
## ((inp[0]*r^4+inp[2]*r^2+inp[4])*r^4+inp[6]*r^2
## ((inp[1]*r^4+inp[3]*r^2+inp[5])*r^3+inp[7]*r
## \___________________/
##
## Note that we start with inp[2:3]*r^2. This is because it
## doesn't depend on reduction in previous iteration.
################################################################
## d4 = h4*r0 + h3*r1 + h2*r2 + h1*r3 + h0*r4
## d3 = h3*r0 + h2*r1 + h1*r2 + h0*r3 + h4*5*r4
## d2 = h2*r0 + h1*r1 + h0*r2 + h4*5*r3 + h3*5*r4
## d1 = h1*r0 + h0*r1 + h4*5*r2 + h3*5*r3 + h2*5*r4
## d0 = h0*r0 + h4*5*r1 + h3*5*r2 + h2*5*r3 + h1*5*r4
vmuleuw $ACC0,$I0,$R0
vmuleuw $ACC1,$I0,$R1
vmuleuw $ACC2,$I0,$R2
vmuleuw $ACC3,$I1,$R2
vmuleuw $T0,$I1,$R0
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I1,$R1
vaddudm $ACC2,$ACC2,$T0
vmuleuw $ACC4,$I2,$R2
vmuleuw $T0,$I4,$S1
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I2,$R1
vaddudm $ACC3,$ACC3,$T0
lvx $S3,$x50,$_ctx
vmuleuw $T0,$I3,$R1
vaddudm $ACC4,$ACC4,$T0
lvx $R3,$x40,$_ctx
vaddudm $H2,$H2,$I2
vaddudm $H0,$H0,$I0
vaddudm $H3,$H3,$I3
vaddudm $H1,$H1,$I1
vaddudm $H4,$H4,$I4
vmuleuw $T0,$I3,$S2
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I4,$S2
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I2,$R0
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I3,$R0
vaddudm $ACC3,$ACC3,$T0
lvx $S4,$x70,$_ctx
vmuleuw $T0,$I4,$R0
vaddudm $ACC4,$ACC4,$T0
lvx $R4,$x60,$_ctx
vmuleuw $T0,$I2,$S3
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I3,$S3
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I4,$S3
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I0,$R3
vaddudm $ACC3,$ACC3,$T0
vmuleuw $T0,$I1,$R3
vaddudm $ACC4,$ACC4,$T0
be?lvx_u $_4,$x00,$const # byte swap mask
lvx_u $T1,$x00,$inp # load next input block
lvx_u $T2,$x10,$inp
lvx_u $T3,$x20,$inp
lvx_u $T4,$x30,$inp
be?vperm $T1,$T1,$T1,$_4
be?vperm $T2,$T2,$T2,$_4
be?vperm $T3,$T3,$T3,$_4
be?vperm $T4,$T4,$T4,$_4
vmuleuw $T0,$I1,$S4
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I2,$S4
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I3,$S4
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I4,$S4
vaddudm $ACC3,$ACC3,$T0
vmuleuw $T0,$I0,$R4
vaddudm $ACC4,$ACC4,$T0
vpermdi $I0,$T1,$T2,0b00 # smash input to base 2^26
vspltisb $_4,4
vperm $I2,$T1,$T2,$I2perm # 0x...0e0f0001...1e1f1011
vpermdi $I3,$T1,$T2,0b11
# (hash + inp[0:1]) * r^4
vmulouw $T0,$H0,$R0
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H1,$R0
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H2,$R0
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H3,$R0
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H4,$R0
vaddudm $ACC4,$ACC4,$T0
vpermdi $T1,$T3,$T4,0b00
vperm $T2,$T3,$T4,$I2perm # 0x...0e0f0001...1e1f1011
vpermdi $T3,$T3,$T4,0b11
vmulouw $T0,$H2,$S3
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H3,$S3
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H4,$S3
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H0,$R3
vaddudm $ACC3,$ACC3,$T0
lvx $S1,$x10,$_ctx
vmulouw $T0,$H1,$R3
vaddudm $ACC4,$ACC4,$T0
lvx $R1,$x00,$_ctx
vsrd $I1,$I0,$_26
vsrd $I2,$I2,$_4
vsrd $I4,$I3,$_40
vsrd $I3,$I3,$_14
vmulouw $T0,$H1,$S4
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H2,$S4
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H3,$S4
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H4,$S4
vaddudm $ACC3,$ACC3,$T0
lvx $S2,$x30,$_ctx
vmulouw $T0,$H0,$R4
vaddudm $ACC4,$ACC4,$T0
lvx $R2,$x20,$_ctx
vand $I0,$I0,$mask26
vand $I1,$I1,$mask26
vand $I2,$I2,$mask26
vand $I3,$I3,$mask26
vmulouw $T0,$H4,$S1
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H0,$R1
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H1,$R1
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H2,$R1
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H3,$R1
vaddudm $ACC4,$ACC4,$T0
vsrd $T2,$T2,$_4
vsrd $_4,$T1,$_26
vsrd $T4,$T3,$_40
vsrd $T3,$T3,$_14
vmulouw $T0,$H3,$S2
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H4,$S2
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H0,$R2
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H1,$R2
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H2,$R2
vaddudm $ACC4,$ACC4,$T0
vand $T1,$T1,$mask26
vand $_4,$_4,$mask26
vand $T2,$T2,$mask26
vand $T3,$T3,$mask26
################################################################
# lazy reduction as discussed in "NEON crypto" by D.J. Bernstein
# and P. Schwabe
vspltisb $T0,2
vsrd $H4,$ACC3,$_26
vsrd $H1,$ACC0,$_26
vand $H3,$ACC3,$mask26
vand $H0,$ACC0,$mask26
vaddudm $H4,$H4,$ACC4 # h3 -> h4
vaddudm $H1,$H1,$ACC1 # h0 -> h1
vmrgow $I4,$T4,$I4
vmrgow $I0,$T1,$I0
vmrgow $I1,$_4,$I1
vmrgow $I2,$T2,$I2
vmrgow $I3,$T3,$I3
vor $I4,$I4,$padbits
vsrd $ACC4,$H4,$_26
vsrd $ACC1,$H1,$_26
vand $H4,$H4,$mask26
vand $H1,$H1,$mask26
vaddudm $H0,$H0,$ACC4
vaddudm $H2,$ACC2,$ACC1 # h1 -> h2
vsld $ACC4,$ACC4,$T0 # <<2
vsrd $ACC2,$H2,$_26
vand $H2,$H2,$mask26
vaddudm $H0,$H0,$ACC4 # h4 -> h0
vaddudm $H3,$H3,$ACC2 # h2 -> h3
vsrd $ACC0,$H0,$_26
vsrd $ACC3,$H3,$_26
vand $H0,$H0,$mask26
vand $H3,$H3,$mask26
vaddudm $H1,$H1,$ACC0 # h0 -> h1
vaddudm $H4,$H4,$ACC3 # h3 -> h4
addi $inp,$inp,0x40
bdnz Loop_vsx
neg $len,$len
andi. $len,$len,0x30
sub $inp,$inp,$len
lvx_u $R0,$x30,$ctx # load all powers
lvx_u $R1,$x00,$ctx_
lvx_u $S1,$x10,$ctx_
lvx_u $R2,$x20,$ctx_
lvx_u $S2,$x30,$ctx_
Last_vsx:
vmuleuw $ACC0,$I0,$R0
vmuleuw $ACC1,$I1,$R0
vmuleuw $ACC2,$I2,$R0
vmuleuw $ACC3,$I3,$R0
vmuleuw $ACC4,$I4,$R0
vmuleuw $T0,$I4,$S1
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I0,$R1
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I1,$R1
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I2,$R1
vaddudm $ACC3,$ACC3,$T0
lvx_u $S3,$x50,$ctx_
vmuleuw $T0,$I3,$R1
vaddudm $ACC4,$ACC4,$T0
lvx_u $R3,$x40,$ctx_
vaddudm $H2,$H2,$I2
vaddudm $H0,$H0,$I0
vaddudm $H3,$H3,$I3
vaddudm $H1,$H1,$I1
vaddudm $H4,$H4,$I4
vmuleuw $T0,$I3,$S2
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I4,$S2
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I0,$R2
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I1,$R2
vaddudm $ACC3,$ACC3,$T0
lvx_u $S4,$x70,$ctx_
vmuleuw $T0,$I2,$R2
vaddudm $ACC4,$ACC4,$T0
lvx_u $R4,$x60,$ctx_
vmuleuw $T0,$I2,$S3
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I3,$S3
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I4,$S3
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I0,$R3
vaddudm $ACC3,$ACC3,$T0
vmuleuw $T0,$I1,$R3
vaddudm $ACC4,$ACC4,$T0
vmuleuw $T0,$I1,$S4
vaddudm $ACC0,$ACC0,$T0
vmuleuw $T0,$I2,$S4
vaddudm $ACC1,$ACC1,$T0
vmuleuw $T0,$I3,$S4
vaddudm $ACC2,$ACC2,$T0
vmuleuw $T0,$I4,$S4
vaddudm $ACC3,$ACC3,$T0
vmuleuw $T0,$I0,$R4
vaddudm $ACC4,$ACC4,$T0
# (hash + inp[0:1]) * r^4
vmulouw $T0,$H0,$R0
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H1,$R0
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H2,$R0
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H3,$R0
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H4,$R0
vaddudm $ACC4,$ACC4,$T0
vmulouw $T0,$H2,$S3
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H3,$S3
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H4,$S3
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H0,$R3
vaddudm $ACC3,$ACC3,$T0
lvx_u $S1,$x10,$ctx_
vmulouw $T0,$H1,$R3
vaddudm $ACC4,$ACC4,$T0
lvx_u $R1,$x00,$ctx_
vmulouw $T0,$H1,$S4
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H2,$S4
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H3,$S4
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H4,$S4
vaddudm $ACC3,$ACC3,$T0
lvx_u $S2,$x30,$ctx_
vmulouw $T0,$H0,$R4
vaddudm $ACC4,$ACC4,$T0
lvx_u $R2,$x20,$ctx_
vmulouw $T0,$H4,$S1
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H0,$R1
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H1,$R1
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H2,$R1
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H3,$R1
vaddudm $ACC4,$ACC4,$T0
vmulouw $T0,$H3,$S2
vaddudm $ACC0,$ACC0,$T0
vmulouw $T0,$H4,$S2
vaddudm $ACC1,$ACC1,$T0
vmulouw $T0,$H0,$R2
vaddudm $ACC2,$ACC2,$T0
vmulouw $T0,$H1,$R2
vaddudm $ACC3,$ACC3,$T0
vmulouw $T0,$H2,$R2
vaddudm $ACC4,$ACC4,$T0
################################################################
# horizontal addition
vpermdi $H0,$ACC0,$ACC0,0b10
vpermdi $H1,$ACC1,$ACC1,0b10
vpermdi $H2,$ACC2,$ACC2,0b10
vpermdi $H3,$ACC3,$ACC3,0b10
vpermdi $H4,$ACC4,$ACC4,0b10
vaddudm $ACC0,$ACC0,$H0
vaddudm $ACC1,$ACC1,$H1
vaddudm $ACC2,$ACC2,$H2
vaddudm $ACC3,$ACC3,$H3
vaddudm $ACC4,$ACC4,$H4
################################################################
# lazy reduction
vspltisb $T0,2
vsrd $H4,$ACC3,$_26
vsrd $H1,$ACC0,$_26
vand $H3,$ACC3,$mask26
vand $H0,$ACC0,$mask26
vaddudm $H4,$H4,$ACC4 # h3 -> h4
vaddudm $H1,$H1,$ACC1 # h0 -> h1
vsrd $ACC4,$H4,$_26
vsrd $ACC1,$H1,$_26
vand $H4,$H4,$mask26
vand $H1,$H1,$mask26
vaddudm $H0,$H0,$ACC4
vaddudm $H2,$ACC2,$ACC1 # h1 -> h2
vsld $ACC4,$ACC4,$T0 # <<2
vsrd $ACC2,$H2,$_26
vand $H2,$H2,$mask26
vaddudm $H0,$H0,$ACC4 # h4 -> h0
vaddudm $H3,$H3,$ACC2 # h2 -> h3
vsrd $ACC0,$H0,$_26
vsrd $ACC3,$H3,$_26
vand $H0,$H0,$mask26
vand $H3,$H3,$mask26
vaddudm $H1,$H1,$ACC0 # h0 -> h1
vaddudm $H4,$H4,$ACC3 # h3 -> h4
beq Ldone_vsx
add r6,$const,$len
be?lvx_u $_4,$x00,$const # byte swap mask
lvx_u $T1,$x00,$inp # load last partial input block
lvx_u $T2,$x10,$inp
lvx_u $T3,$x20,$inp
lvx_u $T4,$x30,$inp
be?vperm $T1,$T1,$T1,$_4
be?vperm $T2,$T2,$T2,$_4
be?vperm $T3,$T3,$T3,$_4
be?vperm $T4,$T4,$T4,$_4
vpermdi $I0,$T1,$T2,0b00 # smash input to base 2^26
vspltisb $_4,4
vperm $I2,$T1,$T2,$I2perm # 0x...0e0f0001...1e1f1011
vpermdi $I3,$T1,$T2,0b11
vsrd $I1,$I0,$_26
vsrd $I2,$I2,$_4
vsrd $I4,$I3,$_40
vsrd $I3,$I3,$_14
vand $I0,$I0,$mask26
vand $I1,$I1,$mask26
vand $I2,$I2,$mask26
vand $I3,$I3,$mask26
vpermdi $T0,$T3,$T4,0b00
vperm $T1,$T3,$T4,$I2perm # 0x...0e0f0001...1e1f1011
vpermdi $T2,$T3,$T4,0b11
lvx_u $ACC0,$x00,r6
lvx_u $ACC1,$x30,r6
vsrd $T3,$T0,$_26
vsrd $T1,$T1,$_4
vsrd $T4,$T2,$_40
vsrd $T2,$T2,$_14
vand $T0,$T0,$mask26
vand $T3,$T3,$mask26
vand $T1,$T1,$mask26
vand $T2,$T2,$mask26
# inp[2]:inp[0]:inp[3]:inp[1]
vmrgow $I4,$T4,$I4
vmrgow $I0,$T0,$I0
vmrgow $I1,$T3,$I1
vmrgow $I2,$T1,$I2
vmrgow $I3,$T2,$I3
vor $I4,$I4,$padbits
vperm $H0,$H0,$H0,$ACC0 # move hash to right lane
vand $I0,$I0, $ACC1 # mask redundant input lane[s]
vperm $H1,$H1,$H1,$ACC0
vand $I1,$I1, $ACC1
vperm $H2,$H2,$H2,$ACC0
vand $I2,$I2, $ACC1
vperm $H3,$H3,$H3,$ACC0
vand $I3,$I3, $ACC1
vperm $H4,$H4,$H4,$ACC0
vand $I4,$I4, $ACC1
vaddudm $I0,$I0,$H0 # accumulate hash
vxor $H0,$H0,$H0 # wipe hash value
vaddudm $I1,$I1,$H1
vxor $H1,$H1,$H1
vaddudm $I2,$I2,$H2
vxor $H2,$H2,$H2
vaddudm $I3,$I3,$H3
vxor $H3,$H3,$H3
vaddudm $I4,$I4,$H4
vxor $H4,$H4,$H4
xor. $len,$len,$len
b Last_vsx
.align 4
Ldone_vsx:
$POP r0,`$VSXFRAME+$LRSAVE`($sp)
li $x10,4
li $x20,8
li $x30,12
li $x40,16
stvwx_u $H0,$x00,$ctx # store hash
stvwx_u $H1,$x10,$ctx
stvwx_u $H2,$x20,$ctx
stvwx_u $H3,$x30,$ctx
stvwx_u $H4,$x40,$ctx
lwz r12,`$VSXFRAME-$SIZE_T*5-4`($sp)# pull vrsave
mtlr r0
li r10,`15+$LOCALS+128`
li r11,`31+$LOCALS+128`
mtspr 256,r12 # restore vrsave
lvx v20,r10,$sp
addi r10,r10,32
lvx v21,r10,$sp
addi r10,r10,32
lvx v22,r11,$sp
addi r11,r11,32
lvx v23,r10,$sp
addi r10,r10,32
lvx v24,r11,$sp
addi r11,r11,32
lvx v25,r10,$sp
addi r10,r10,32
lvx v26,r11,$sp
addi r11,r11,32
lvx v27,r10,$sp
addi r10,r10,32
lvx v28,r11,$sp
addi r11,r11,32
lvx v29,r10,$sp
addi r10,r10,32
lvx v30,r11,$sp
lvx v31,r10,$sp
$POP r27,`$VSXFRAME-$SIZE_T*5`($sp)
$POP r28,`$VSXFRAME-$SIZE_T*4`($sp)
$POP r29,`$VSXFRAME-$SIZE_T*3`($sp)
$POP r30,`$VSXFRAME-$SIZE_T*2`($sp)
$POP r31,`$VSXFRAME-$SIZE_T*1`($sp)
addi $sp,$sp,$VSXFRAME
blr
.long 0
.byte 0,12,0x04,1,0x80,5,4,0
.long 0
.size __poly1305_blocks_vsx,.-__poly1305_blocks_vsx
.align 6
LPICmeup:
mflr r0
bcl 20,31,\$+4
mflr $const # vvvvvv "distance" between . and 1st data entry
addi $const,$const,`64-8`
mtlr r0
blr
.long 0
.byte 0,12,0x14,0,0,0,0,0
.space `64-9*4`
.quad 0x0000000003ffffff,0x0000000003ffffff # mask26
.quad 0x000000000000001a,0x000000000000001a # _26
.quad 0x0000000000000028,0x0000000000000028 # _40
.quad 0x000000000e0f0001,0x000000001e1f1011 # I2perm
.quad 0x0100000001000000,0x0100000001000000 # padbits
.quad 0x0706050403020100,0x0f0e0d0c0b0a0908 # byte swap for big-endian
.quad 0x0000000000000000,0x0000000004050607 # magic tail masks
.quad 0x0405060700000000,0x0000000000000000
.quad 0x0000000000000000,0x0405060700000000
.quad 0xffffffff00000000,0xffffffffffffffff
.quad 0xffffffff00000000,0xffffffff00000000
.quad 0x0000000000000000,0xffffffff00000000
___
}}}
$code.=<<___;
.asciz "Poly1305 for PPC, CRYPTOGAMS by \@dot-asm"
___
$code =~ s/\`([^\`]*)\`/eval $1/gem;
print $code;
foreach (split("\n",$code)) {
s/\`([^\`]*)\`/eval($1)/ge;
# instructions prefixed with '?' are endian-specific and need
# to be adjusted accordingly...
if ($flavour !~ /le$/) { # big-endian
s/be\?// or
s/le\?/#le#/
} else { # little-endian
s/le\?// or
s/be\?/#be#/
}
print $_,"\n";
}
close STDOUT;
crypto/poly1305/asm/poly1305-s390x.pl
+768 -152
View File
@@ -24,204 +24,820 @@
#
# On side note, z13 enables vector base 2^26 implementation...
$flavour = shift;
#
# January 2019
#
# Add vx code path (base 2^26).
#
# Copyright IBM Corp. 2019
# Author: Patrick Steuer <patrick.steuer@de.ibm.com>
use strict;
use FindBin qw($Bin);
use lib "$Bin/../..";
use perlasm::s390x qw(:DEFAULT :VX AUTOLOAD LABEL);
my $flavour = shift;
my ($z,$SIZE_T);
if ($flavour =~ /3[12]/) {
$z=0; # S/390 ABI
$SIZE_T=4;
$g="";
} else {
$z=1; # zSeries ABI
$SIZE_T=8;
$g="g";
}
my $output;
while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
open STDOUT,">$output";
$sp="%r15";
my $sp="%r15";
# novx code path ctx layout
# ---------------------------------
# var value base off
# ---------------------------------
# u64 h[3] hash 2^64 0
# u32 pad[2]
# u64 r[2] key 2^64 32
# vx code path ctx layout
# ---------------------------------
# var value base off
# ---------------------------------
# u32 acc1[5] r^2-acc 2^26 0
# u32 pad
# u32 acc2[5] r-acc 2^26 24
# u32 pad
# u32 r1[5] r 2^26 48
# u32 r15[5] 5*r 2^26 68
# u32 r2[5] r^2 2^26 88
# u32 r25[5] 5*r^2 2^26 108
# u32 r4[5] r^4 2^26 128
# u32 r45[5] 5*r^4 2^26 148
PERLASM_BEGIN($output);
TEXT ();
################
# static void poly1305_init(void *ctx, const unsigned char key[16])
{
my ($ctx,$key)=map("%r$_",(2..3));
my ($r0,$r1,$r2)=map("%r$_",(9,11,13));
sub MUL_RKEY { # r*=key
my ($d0hi,$d0lo,$d1hi,$d1lo)=map("%r$_",(4..7));
my ($t0,$t1,$s1)=map("%r$_",(8,10,12));
lg ("%r0","32($ctx)");
lg ("%r1","40($ctx)");
srlg ($s1,"%r1",2);
algr ($s1,"%r1");
lgr ($d0lo,$r0);
lgr ($d1lo,$r1);
mlgr ($d0hi,"%r0");
lgr ($r1,$d1lo);
mlgr ($d1hi,$s1);
mlgr ($t0,"%r1");
mlgr ($t1,"%r0");
algr ($d0lo,$d1lo);
lgr ($d1lo,$r2);
alcgr ($d0hi,$d1hi);
lghi ($d1hi,0);
algr ($r1,$r0);
alcgr ($t1,$t0);
msgr ($d1lo,$s1);
msgr ($r2,"%r0");
algr ($r1,$d1lo);
alcgr ($t1,$d1hi);
algr ($r1,$d0hi);
alcgr ($r2,$t1);
lghi ($r0,-4);
ngr ($r0,$r2);
srlg ($t0,$r2,2);
algr ($r0,$t0);
lghi ($t1,3);
ngr ($r2,$t1);
algr ($r0,$d0lo);
alcgr ($r1,$d1hi);
alcgr ($r2,$d1hi);
}
sub ST_R5R { # store r,5*r -> base 2^26
my @d=map("%r$_",(4..8));
my @off=@_;
lgr (@d[2],$r0);
lr ("%r1",@d[2]);
nilh ("%r1",1023);
lgr (@d[3],$r1);
lr (@d[0],"%r1");
srlg ("%r1",@d[2],52);
lgr (@d[4],$r2);
srlg ("%r0",@d[2],26);
sll (@d[4],24);
lr (@d[2],@d[3]);
nilh ("%r0",1023);
sll (@d[2],12);
lr (@d[1],"%r0");
&or (@d[2],"%r1");
srlg ("%r1",@d[3],40);
nilh (@d[2],1023);
&or (@d[4],"%r1");
srlg (@d[3],@d[3],14);
nilh (@d[4],1023);
nilh (@d[3],1023);
stm (@d[0],@d[4],"@off[0]($ctx)");
mhi (@d[$_],5) for (0..4);
stm (@d[0],@d[4],"@off[1]($ctx)");
}
GLOBL ("poly1305_init");
TYPE ("poly1305_init","\@function");
ALIGN (16);
LABEL ("poly1305_init");
lghi ("%r0",0);
lghi ("%r1",-1);
stg ("%r0","0($ctx)"); # zero hash value / acc1
stg ("%r0","8($ctx)");
stg ("%r0","16($ctx)");
&{$z? \&clgr:\&clr} ($key,"%r0");
je (".Ldone");
lrvg ("%r4","0($key)"); # load little-endian key
lrvg ("%r5","8($key)");
nihl ("%r1",0xffc0); # 0xffffffc0ffffffff
srlg ("%r0","%r1",4); # 0x0ffffffc0fffffff
srlg ("%r1","%r1",4);
nill ("%r1",0xfffc); # 0x0ffffffc0ffffffc
ngr ("%r4","%r0");
ngr ("%r5","%r1");
stg ("%r4","32($ctx)");
stg ("%r5","40($ctx)");
larl ("%r1","OPENSSL_s390xcap_P");
lg ("%r0","16(%r1)");
tmhh ("%r0",0x4000); # check for vector facility
jz (".Ldone");
larl ("%r4","poly1305_blocks_vx");
larl ("%r5","poly1305_emit_vx");
&{$z? \&stmg:\&stm} ("%r6","%r13","6*$SIZE_T($sp)");
&{$z? \&stmg:\&stm} ("%r4","%r5","4*$z+228($ctx)");
lg ($r0,"32($ctx)");
lg ($r1,"40($ctx)");
lghi ($r2,0);
ST_R5R (48,68); # store r,5*r
MUL_RKEY();
ST_R5R (88,108); # store r^2,5*r^2
MUL_RKEY();
MUL_RKEY();
ST_R5R (128,148); # store r^4,5*r^4
lghi ("%r0",0);
stg ("%r0","24($ctx)"); # zero acc2
stg ("%r0","32($ctx)");
stg ("%r0","40($ctx)");
&{$z? \&lmg:\&lm} ("%r6","%r13","6*$SIZE_T($sp)");
lghi ("%r2",1);
br ("%r14");
LABEL (".Ldone");
lghi ("%r2",0);
br ("%r14");
SIZE ("poly1305_init",".-poly1305_init");
}
# VX CODE PATH
{
my $frame=8*16;
my @m01=map("%v$_",(0..4));
my @m23=map("%v$_",(5..9));
my @tmp=@m23;
my @acc=map("%v$_",(10..14));
my @r=map("%v$_",(15..19));
my @r5=map("%v$_",(20..24));
my $padvec="%v26";
my $mask4="%v27";
my @vperm=map("%v$_",(28..30));
my $mask="%v31";
sub REDUCE {
vesrlg (@tmp[0],@acc[0],26);
vesrlg (@tmp[3],@acc[3],26);
vn (@acc[0],@acc[0],$mask);
vn (@acc[3],@acc[3],$mask);
vag (@acc[1],@acc[1],@tmp[0]); # carry 0->1
vag (@acc[4],@acc[4],@tmp[3]); # carry 3->4
vesrlg (@tmp[1],@acc[1],26);
vesrlg (@tmp[4],@acc[4],26);
vn (@acc[1],@acc[1],$mask);
vn (@acc[4],@acc[4],$mask);
veslg (@tmp[0],@tmp[4],2);
vag (@tmp[4],@tmp[4],@tmp[0]); # h[4]*=5
vag (@acc[2],@acc[2],@tmp[1]); # carry 1->2
vag (@acc[0],@acc[0],@tmp[4]); # carry 4->0
vesrlg (@tmp[2],@acc[2],26);
vesrlg (@tmp[0],@acc[0],26);
vn (@acc[2],@acc[2],$mask);
vn (@acc[0],@acc[0],$mask);
vag (@acc[3],@acc[3],@tmp[2]); # carry 2->3
vag (@acc[1],@acc[1],@tmp[0]); # carry 0->1
vesrlg (@tmp[3],@acc[3],26);
vn (@acc[3],@acc[3],$mask);
vag (@acc[4],@acc[4],@tmp[3]); # carry 3->4
}
################
# static void poly1305_blocks_vx(void *ctx, const unsigned char *inp,
# size_t len, u32 padbit)
{
my ($ctx,$inp,$len) = map("%r$_",(2..4));
my $padbit="%r0";
GLOBL ("poly1305_blocks_vx");
TYPE ("poly1305_blocks_vx","\@function");
ALIGN (16);
LABEL ("poly1305_blocks_vx");
if ($z) {
aghi ($sp,-$frame);
vstm ("%v8","%v15","0($sp)");
} else {
std ("%f4","16*$SIZE_T+2*8($sp)");
std ("%f6","16*$SIZE_T+3*8($sp)");
llgfr ($len,$len);
}
llgfr ($padbit,"%r5");
vlef (@acc[$_],"4*$_($ctx)",1) for (0..4); # load acc1
larl ("%r5",".Lconst");
vlef (@acc[$_],"24+4*$_($ctx)",3) for (0..4); # load acc2
sllg ($padbit,$padbit,24);
vlm (@vperm[0],$mask,"0(%r5)"); # load vperm ops, mask
vgbm ($mask4,0x0707);
vlvgp ($padvec,$padbit,$padbit);
srlg ("%r1",$len,6);
ltgr ("%r1","%r1");
jz (".Lvx_4x_done");
ALIGN (16);
LABEL (".Lvx_4x");
vlm ("%v20","%v23","0($inp)"); # load m0,m1,m2,m3
# m01,m23 -> base 2^26
vperm (@m01[0],"%v20","%v21",@vperm[0]);
vperm (@m23[0],"%v22","%v23",@vperm[0]);
vperm (@m01[2],"%v20","%v21",@vperm[1]);
vperm (@m23[2],"%v22","%v23",@vperm[1]);
vperm (@m01[4],"%v20","%v21",@vperm[2]);
vperm (@m23[4],"%v22","%v23",@vperm[2]);
vesrlg (@m01[1],@m01[0],26);
vesrlg (@m23[1],@m23[0],26);
vesrlg (@m01[3],@m01[2],30);
vesrlg (@m23[3],@m23[2],30);
vesrlg (@m01[2],@m01[2],4);
vesrlg (@m23[2],@m23[2],4);
vn (@m01[4],@m01[4],$mask4);
vn (@m23[4],@m23[4],$mask4);
for (0..3) {
vn (@m01[$_],@m01[$_],$mask);
vn (@m23[$_],@m23[$_],$mask);
}
vaf (@m01[4],@m01[4],$padvec); # pad m01
vaf (@m23[4],@m23[4],$padvec); # pad m23
# acc = acc * r^4 + m01 * r^2 + m23
vlrepf (@r5[$_],"4*$_+108($ctx)") for (0..4); # load 5*r^2
vlrepf (@r[$_],"4*$_+88($ctx)") for (0..4); # load r^2
vmalof (@tmp[0],@m01[4],@r5[1],@m23[0]);
vmalof (@tmp[1],@m01[4],@r5[2],@m23[1]);
vmalof (@tmp[2],@m01[4],@r5[3],@m23[2]);
vmalof (@tmp[3],@m01[4],@r5[4],@m23[3]);
vmalof (@tmp[4],@m01[4],@r[0],@m23[4]);
vmalof (@tmp[0],@m01[3],@r5[2],@tmp[0]);
vmalof (@tmp[1],@m01[3],@r5[3],@tmp[1]);
vmalof (@tmp[2],@m01[3],@r5[4],@tmp[2]);
vmalof (@tmp[3],@m01[3],@r[0],@tmp[3]);
vmalof (@tmp[4],@m01[3],@r[1],@tmp[4]);
vmalof (@tmp[0],@m01[2],@r5[3],@tmp[0]);
vmalof (@tmp[1],@m01[2],@r5[4],@tmp[1]);
vmalof (@tmp[2],@m01[2],@r[0],@tmp[2]);
vmalof (@tmp[3],@m01[2],@r[1],@tmp[3]);
vmalof (@tmp[4],@m01[2],@r[2],@tmp[4]);
vmalof (@tmp[0],@m01[1],@r5[4],@tmp[0]);
vmalof (@tmp[1],@m01[1],@r[0],@tmp[1]);
vmalof (@tmp[2],@m01[1],@r[1],@tmp[2]);
vmalof (@tmp[3],@m01[1],@r[2],@tmp[3]);
vmalof (@tmp[4],@m01[1],@r[3],@tmp[4]);
vmalof (@tmp[0],@m01[0],@r[0],@tmp[0]);
vmalof (@tmp[1],@m01[0],@r[1],@tmp[1]);
vmalof (@tmp[2],@m01[0],@r[2],@tmp[2]);
vmalof (@tmp[3],@m01[0],@r[3],@tmp[3]);
vmalof (@tmp[4],@m01[0],@r[4],@tmp[4]);
vlrepf (@r5[$_],"4*$_+148($ctx)") for (0..4); # load 5*r^4
vlrepf (@r[$_],"4*$_+128($ctx)") for (0..4); # load r^4
vmalof (@tmp[0],@acc[4],@r5[1],@tmp[0]);
vmalof (@tmp[1],@acc[4],@r5[2],@tmp[1]);
vmalof (@tmp[2],@acc[4],@r5[3],@tmp[2]);
vmalof (@tmp[3],@acc[4],@r5[4],@tmp[3]);
vmalof (@tmp[4],@acc[4],@r[0],@tmp[4]);
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
REDUCE ();
la ($inp,"64($inp)");
brctg ("%r1",".Lvx_4x");
ALIGN (16);
LABEL (".Lvx_4x_done");
tml ($len,32);
jz (".Lvx_2x_done");
vlm ("%v20","%v21","0($inp)"); # load m0,m1
# m01 -> base 2^26
vperm (@m01[0],"%v20","%v21",@vperm[0]);
vperm (@m01[2],"%v20","%v21",@vperm[1]);
vperm (@m01[4],"%v20","%v21",@vperm[2]);
vesrlg (@m01[1],@m01[0],26);
vesrlg (@m01[3],@m01[2],30);
vesrlg (@m01[2],@m01[2],4);
vn (@m01[4],@m01[4],$mask4);
vn (@m01[$_],@m01[$_],$mask) for (0..3);
vaf (@m01[4],@m01[4],$padvec); # pad m01
# acc = acc * r^2+ m01
vlrepf (@r5[$_],"4*$_+108($ctx)") for (0..4); # load 5*r^2
vlrepf (@r[$_],"4*$_+88($ctx)") for (0..4); # load r^2
vmalof (@tmp[0],@acc[4],@r5[1],@m01[0]);
vmalof (@tmp[1],@acc[4],@r5[2],@m01[1]);
vmalof (@tmp[2],@acc[4],@r5[3],@m01[2]);
vmalof (@tmp[3],@acc[4],@r5[4],@m01[3]);
vmalof (@tmp[4],@acc[4],@r[0],@m01[4]);
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
REDUCE ();
la ($inp,"32($inp)");
ALIGN (16);
LABEL (".Lvx_2x_done");
tml ($len,16);
jz (".Lvx_done");
vleig ($padvec,0,0);
vzero ("%v20");
vl ("%v21","0($inp)"); # load m0
# m0 -> base 2^26
vperm (@m01[0],"%v20","%v21",@vperm[0]);
vperm (@m01[2],"%v20","%v21",@vperm[1]);
vperm (@m01[4],"%v20","%v21",@vperm[2]);
vesrlg (@m01[1],@m01[0],26);
vesrlg (@m01[3],@m01[2],30);
vesrlg (@m01[2],@m01[2],4);
vn (@m01[4],@m01[4],$mask4);
vn (@m01[$_],@m01[$_],$mask) for (0..3);
vaf (@m01[4],@m01[4],$padvec); # pad m0
# acc = acc * r + m01
vlrepf (@r5[$_],"4*$_+68($ctx)") for (0..4); # load 5*r
vlrepf (@r[$_],"4*$_+48($ctx)") for (0..4); # load r
vmalof (@tmp[0],@acc[4],@r5[1],@m01[0]);
vmalof (@tmp[1],@acc[4],@r5[2],@m01[1]);
vmalof (@tmp[2],@acc[4],@r5[3],@m01[2]);
vmalof (@tmp[3],@acc[4],@r5[4],@m01[3]);
vmalof (@tmp[4],@acc[4],@r[0],@m01[4]);
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
REDUCE ();
ALIGN (16);
LABEL (".Lvx_done");
vstef (@acc[$_],"4*$_($ctx)",1) for (0..4); # store acc
vstef (@acc[$_],"24+4*$_($ctx)",3) for (0..4);
if ($z) {
vlm ("%v8","%v15","0($sp)");
la ($sp,"$frame($sp)");
} else {
ld ("%f4","16*$SIZE_T+2*8($sp)");
ld ("%f6","16*$SIZE_T+3*8($sp)");
}
br ("%r14");
SIZE ("poly1305_blocks_vx",".-poly1305_blocks_vx");
}
################
# static void poly1305_emit_vx(void *ctx, unsigned char mac[16],
# const u32 nonce[4])
{
my ($ctx,$mac,$nonce) = map("%r$_",(2..4));
GLOBL ("poly1305_emit_vx");
TYPE ("poly1305_emit_vx","\@function");
ALIGN (16);
LABEL ("poly1305_emit_vx");
if ($z) {
aghi ($sp,-$frame);
vstm ("%v8","%v15","0($sp)");
} else {
std ("%f4","16*$SIZE_T+2*8($sp)");
std ("%f6","16*$SIZE_T+3*8($sp)");
}
larl ("%r5",".Lconst");
vlef (@acc[$_],"4*$_($ctx)",1) for (0..4); # load acc1
vlef (@acc[$_],"24+4*$_($ctx)",3) for (0..4); # load acc2
vlef (@r5[$_],"108+4*$_($ctx)",1) for (0..4); # load 5*r^2
vlef (@r[$_],"88+4*$_($ctx)",1) for (0..4); # load r^2
vlef (@r5[$_],"68+4*$_($ctx)",3) for (0..4); # load 5*r
vlef (@r[$_],"48+4*$_($ctx)",3) for (0..4); # load r
vl ($mask,"48(%r5)"); # load mask
# acc = acc1 * r^2 + acc2 * r
vmlof (@tmp[0],@acc[4],@r5[1]);
vmlof (@tmp[1],@acc[4],@r5[2]);
vmlof (@tmp[2],@acc[4],@r5[3]);
vmlof (@tmp[3],@acc[4],@r5[4]);
vmlof (@tmp[4],@acc[4],@r[0]);
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
vzero ("%v27");
vsumqg (@acc[$_],@acc[$_],"%v27") for (0..4);
REDUCE ();
vesrlg (@tmp[1],@acc[1],26);
vn (@acc[1],@acc[1],$mask);
vag (@acc[2],@acc[2],@tmp[1]); # carry 1->2
vesrlg (@tmp[2],@acc[2],26);
vn (@acc[2],@acc[2],$mask);
vag (@acc[3],@acc[3],@tmp[2]); # carry 2->3
vesrlg (@tmp[3],@acc[3],26);
vn (@acc[3],@acc[3],$mask);
vag (@acc[4],@acc[4],@tmp[3]); # carry 3->4
# acc -> base 2^64
vleib ("%v30",6*8,7);
vleib ("%v29",13*8,7);
vleib ("%v28",3*8,7);
veslg (@acc[1],@acc[1],26);
veslg (@acc[3],@acc[3],26);
vo (@acc[0],@acc[0],@acc[1]);
vo (@acc[2],@acc[2],@acc[3]);
veslg (@acc[2],@acc[2],4);
vslb (@acc[2],@acc[2],"%v30"); # <<52
vo (@acc[0],@acc[0],@acc[2]);
vslb (@tmp[4],@acc[4],"%v29"); # <<104
vo (@acc[0],@acc[0],@tmp[4]);
vsrlb (@acc[1],@acc[4],"%v28"); # >>24
# acc %= 2^130-5
vone ("%v26");
vleig ("%v27",5,1);
vone ("%v29");
vleig ("%v26",-4,1);
vaq (@tmp[0],@acc[0],"%v27");
vaccq (@tmp[1],@acc[0],"%v27");
vaq (@tmp[1],@tmp[1],"%v26");
vaccq (@tmp[1],@tmp[1],@acc[1]);
vaq (@tmp[1],@tmp[1],"%v29");
vn (@tmp[2],@tmp[1],@acc[0]);
vnc (@tmp[3],@tmp[0],@tmp[1]);
vo (@acc[0],@tmp[2],@tmp[3]);
# acc += nonce
vl (@vperm[0],"64(%r5)");
vlef (@tmp[0],"4*$_($nonce)",3-$_) for (0..3);
vaq (@acc[0],@acc[0],@tmp[0]);
vperm (@acc[0],@acc[0],@acc[0],@vperm[0]);
vst (@acc[0],"0($mac)"); # store mac
if ($z) {
vlm ("%v8","%v15","0($sp)");
la ($sp,"$frame($sp)");
} else {
ld ("%f4","16*$SIZE_T+2*8($sp)");
ld ("%f6","16*$SIZE_T+3*8($sp)");
}
br ("%r14");
SIZE ("poly1305_emit_vx",".-poly1305_emit_vx");
}
}
# NOVX CODE PATH
{
################
# static void poly1305_blocks(void *ctx, const unsigned char *inp, size_t len,
# u32 padbit)
{
my ($ctx,$inp,$len,$padbit) = map("%r$_",(2..5));
$code.=<<___;
.text
.globl poly1305_init
.type poly1305_init,\@function
.align 16
poly1305_init:
lghi %r0,0
lghi %r1,-1
stg %r0,0($ctx) # zero hash value
stg %r0,8($ctx)
stg %r0,16($ctx)
cl${g}r $inp,%r0
je .Lno_key
lrvg %r4,0($inp) # load little-endian key
lrvg %r5,8($inp)
nihl %r1,0xffc0 # 0xffffffc0ffffffff
srlg %r0,%r1,4 # 0x0ffffffc0fffffff
srlg %r1,%r1,4
nill %r1,0xfffc # 0x0ffffffc0ffffffc
ngr %r4,%r0
ngr %r5,%r1
stg %r4,32($ctx)
stg %r5,40($ctx)
.Lno_key:
lghi %r2,0
br %r14
.size poly1305_init,.-poly1305_init
___
{
my ($d0hi,$d0lo,$d1hi,$d1lo,$t0,$h0,$t1,$h1,$h2) = map("%r$_",(6..14));
my ($r0,$r1,$s1) = map("%r$_",(0..2));
GLOBL ("poly1305_blocks");
TYPE ("poly1305_blocks","\@function");
ALIGN (16);
LABEL ("poly1305_blocks");
$z? srlg ($len,$len,4) :srl ($len,4);
lghi ("%r0",0);
&{$z? \&clgr:\&clr} ($len,"%r0");
je (".Lno_data");
$code.=<<___;
.globl poly1305_blocks
.type poly1305_blocks,\@function
.align 16
poly1305_blocks:
srl${g} $len,4 # fixed-up in 64-bit build
lghi %r0,0
cl${g}r $len,%r0
je .Lno_data
&{$z? \&stmg:\&stm} ("%r6","%r14","6*$SIZE_T($sp)");
stm${g} %r6,%r14,`6*$SIZE_T`($sp)
llgfr $padbit,$padbit # clear upper half, much needed with
llgfr ($padbit,$padbit); # clear upper half, much needed with
# non-64-bit ABI
lg $r0,32($ctx) # load key
lg $r1,40($ctx)
lg ($r0,"32($ctx)"); # load key
lg ($r1,"40($ctx)");
lg $h0,0($ctx) # load hash value
lg $h1,8($ctx)
lg $h2,16($ctx)
lg ($h0,"0($ctx)"); # load hash value
lg ($h1,"8($ctx)");
lg ($h2,"16($ctx)");
st$g $ctx,`2*$SIZE_T`($sp) # off-load $ctx
srlg $s1,$r1,2
algr $s1,$r1 # s1 = r1 + r1>>2
j .Loop
&{$z? \&stg:\&st} ($ctx,"2*$SIZE_T($sp)"); # off-load $ctx
srlg ($s1,$r1,2);
algr ($s1,$r1); # s1 = r1 + r1>>2
j (".Loop");
.align 16
.Loop:
lrvg $d0lo,0($inp) # load little-endian input
lrvg $d1lo,8($inp)
la $inp,16($inp)
ALIGN (16);
LABEL (".Loop");
lrvg ($d0lo,"0($inp)"); # load little-endian input
lrvg ($d1lo,"8($inp)");
la ($inp,"16($inp)");
algr $d0lo,$h0 # accumulate input
alcgr $d1lo,$h1
algr ($d0lo,$h0); # accumulate input
alcgr ($d1lo,$h1);
lgr $h0,$d0lo
mlgr $d0hi,$r0 # h0*r0 -> $d0hi:$d0lo
lgr $h1,$d1lo
mlgr $d1hi,$s1 # h1*5*r1 -> $d1hi:$d1lo
lgr ($h0,$d0lo);
mlgr ($d0hi,$r0); # h0*r0 -> $d0hi:$d0lo
lgr ($h1,$d1lo);
mlgr ($d1hi,$s1); # h1*5*r1 -> $d1hi:$d1lo
mlgr $t0,$r1 # h0*r1 -> $t0:$h0
mlgr $t1,$r0 # h1*r0 -> $t1:$h1
alcgr $h2,$padbit
mlgr ($t0,$r1); # h0*r1 -> $t0:$h0
mlgr ($t1,$r0); # h1*r0 -> $t1:$h1
alcgr ($h2,$padbit);
algr $d0lo,$d1lo
lgr $d1lo,$h2
alcgr $d0hi,$d1hi
lghi $d1hi,0
algr ($d0lo,$d1lo);
lgr ($d1lo,$h2);
alcgr ($d0hi,$d1hi);
lghi ($d1hi,0);
algr $h1,$h0
alcgr $t1,$t0
algr ($h1,$h0);
alcgr ($t1,$t0);
msgr $d1lo,$s1 # h2*s1
msgr $h2,$r0 # h2*r0
msgr ($d1lo,$s1); # h2*s1
msgr ($h2,$r0); # h2*r0
algr $h1,$d1lo
alcgr $t1,$d1hi # $d1hi is zero
algr ($h1,$d1lo);
alcgr ($t1,$d1hi); # $d1hi is zero
algr $h1,$d0hi
alcgr $h2,$t1
algr ($h1,$d0hi);
alcgr ($h2,$t1);
lghi $h0,-4 # final reduction step
ngr $h0,$h2
srlg $t0,$h2,2
algr $h0,$t0
lghi $t1,3
ngr $h2,$t1
lghi ($h0,-4); # final reduction step
ngr ($h0,$h2);
srlg ($t0,$h2,2);
algr ($h0,$t0);
lghi ($t1,3);
ngr ($h2,$t1);
algr $h0,$d0lo
alcgr $h1,$d1hi # $d1hi is still zero
alcgr $h2,$d1hi # $d1hi is still zero
algr ($h0,$d0lo);
alcgr ($h1,$d1hi); # $d1hi is still zero
alcgr ($h2,$d1hi); # $d1hi is still zero
brct$g $len,.Loop
&{$z? \&brctg:\&brct} ($len,".Loop");
l$g $ctx,`2*$SIZE_T`($sp) # restore $ctx
&{$z? \&lg:\&l} ($ctx,"2*$SIZE_T($sp)");# restore $ctx
stg $h0,0($ctx) # store hash value
stg $h1,8($ctx)
stg $h2,16($ctx)
stg ($h0,"0($ctx)"); # store hash value
stg ($h1,"8($ctx)");
stg ($h2,"16($ctx)");
lm${g} %r6,%r14,`6*$SIZE_T`($sp)
.Lno_data:
br %r14
.size poly1305_blocks,.-poly1305_blocks
___
&{$z? \&lmg:\&lm} ("%r6","%r14","6*$SIZE_T($sp)");
LABEL (".Lno_data");
br ("%r14");
SIZE ("poly1305_blocks",".-poly1305_blocks");
}
################
# static void poly1305_emit(void *ctx, unsigned char mac[16],
# const u32 nonce[4])
{
my ($mac,$nonce)=($inp,$len);
my ($ctx,$mac,$nonce) = map("%r$_",(2..4));
my ($h0,$h1,$h2,$d0,$d1)=map("%r$_",(5..9));
$code.=<<___;
.globl poly1305_emit
.type poly1305_emit,\@function
.align 16
poly1305_emit:
stm${g} %r6,%r9,`6*$SIZE_T`($sp)
GLOBL ("poly1305_emit");
TYPE ("poly1305_emit","\@function");
ALIGN (16);
LABEL ("poly1305_emit");
&{$z? \&stmg:\&stm} ("%r6","%r9","6*$SIZE_T($sp)");
lg $h0,0($ctx)
lg $h1,8($ctx)
lg $h2,16($ctx)
lg ($h0,"0($ctx)");
lg ($h1,"8($ctx)");
lg ($h2,"16($ctx)");
lghi %r0,5
lghi %r1,0
lgr $d0,$h0
lgr $d1,$h1
lghi ("%r0",5);
lghi ("%r1",0);
lgr ($d0,$h0);
lgr ($d1,$h1);
algr $h0,%r0 # compare to modulus
alcgr $h1,%r1
alcgr $h2,%r1
algr ($h0,"%r0"); # compare to modulus
alcgr ($h1,"%r1");
alcgr ($h2,"%r1");
srlg $h2,$h2,2 # did it borrow/carry?
slgr %r1,$h2 # 0-$h2>>2
lg $h2,0($nonce) # load nonce
lghi %r0,-1
lg $ctx,8($nonce)
xgr %r0,%r1 # ~%r1
srlg ($h2,$h2,2); # did it borrow/carry?
slgr ("%r1",$h2); # 0-$h2>>2
lg ($h2,"0($nonce)"); # load nonce
lghi ("%r0",-1);
lg ($ctx,"8($nonce)");
xgr ("%r0","%r1"); # ~%r1
ngr $h0,%r1
ngr $d0,%r0
ngr $h1,%r1
ngr $d1,%r0
ogr $h0,$d0
rllg $d0,$h2,32 # flip nonce words
ogr $h1,$d1
rllg $d1,$ctx,32
ngr ($h0,"%r1");
ngr ($d0,"%r0");
ngr ($h1,"%r1");
ngr ($d1,"%r0");
ogr ($h0,$d0);
rllg ($d0,$h2,32); # flip nonce words
ogr ($h1,$d1);
rllg ($d1,$ctx,32);
algr $h0,$d0 # accumulate nonce
alcgr $h1,$d1
algr ($h0,$d0); # accumulate nonce
alcgr ($h1,$d1);
strvg $h0,0($mac) # write little-endian result
strvg $h1,8($mac)
strvg ($h0,"0($mac)"); # write little-endian result
strvg ($h1,"8($mac)");
lm${g} %r6,%r9,`6*$SIZE_T`($sp)
br %r14
.size poly1305_emit,.-poly1305_emit
.string "Poly1305 for s390x, CRYPTOGAMS by <appro\@openssl.org>"
___
&{$z? \&lmg:\&lm} ("%r6","%r9","6*$SIZE_T($sp)");
br ("%r14");
SIZE ("poly1305_emit",".-poly1305_emit");
}
}
################
$code =~ s/\`([^\`]*)\`/eval $1/gem;
$code =~ s/\b(srlg\s+)(%r[0-9]+\s*,)\s*([0-9]+)/$1$2$2$3/gm;
ALIGN (128);
LABEL (".Lconst");
LONG (0x00060504,0x03020100,0x00161514,0x13121110); # vperm op[m[1],m[0]]
LONG (0x000c0b0a,0x09080706,0x001c1b1a,0x19181716); # vperm op[m[3],m[2]]
LONG (0x00000000,0x000f0e0d,0x00000000,0x001f1e1d); # vperm op[ - ,m[4]]
LONG (0x00000000,0x03ffffff,0x00000000,0x03ffffff); # [0,2^26-1,0,2^26-1]
LONG (0x0f0e0d0c,0x0b0a0908,0x07060504,0x03020100); # vperm op endian
STRING ("\"Poly1305 for s390x, CRYPTOGAMS by <appro\@openssl.org>\"");
print $code;
close STDOUT;
PERLASM_END();
crypto/poly1305/build.info
+2 -5
View File
@@ -17,8 +17,5 @@ GENERATE[poly1305-armv8.S]=asm/poly1305-armv8.pl $(PERLASM_SCHEME)
INCLUDE[poly1305-armv8.o]=..
GENERATE[poly1305-mips.S]=asm/poly1305-mips.pl $(PERLASM_SCHEME)
INCLUDE[poly1305-mips.o]=..
BEGINRAW[Makefile(unix)]
{- $builddir -}/poly1305-%.S: {- $sourcedir -}/asm/poly1305-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile(unix)]
GENERATE[poly1305-c64xplus.S]=asm/poly1305-c64xplus.pl $(PERLASM_SCHEME)
GENERATE[poly1305-s390x.S]=asm/poly1305-s390x.pl $(PERLASM_SCHEME)
crypto/ppccap.c
+10 -1
View File
@@ -116,10 +116,19 @@ void poly1305_blocks_fpu(void *ctx, const unsigned char *inp, size_t len,
unsigned int padbit);
void poly1305_emit_fpu(void *ctx, unsigned char mac[16],
const unsigned int nonce[4]);
void poly1305_init_vsx(void *ctx, const unsigned char key[16]);
void poly1305_blocks_vsx(void *ctx, const unsigned char *inp, size_t len,
unsigned int padbit);
void poly1305_emit_vsx(void *ctx, unsigned char mac[16],
const unsigned int nonce[4]);
int poly1305_init(void *ctx, const unsigned char key[16], void *func[2]);
int poly1305_init(void *ctx, const unsigned char key[16], void *func[2])
{
if (sizeof(size_t) == 4 && (OPENSSL_ppccap_P & PPC_FPU)) {
if (OPENSSL_ppccap_P & PPC_CRYPTO207) {
poly1305_init_int(ctx, key);
func[0] = (void*)(uintptr_t)poly1305_blocks_vsx;
func[1] = (void*)(uintptr_t)poly1305_emit;
} else if (sizeof(size_t) == 4 && (OPENSSL_ppccap_P & PPC_FPU)) {
poly1305_init_fpu(ctx, key);
func[0] = (void*)(uintptr_t)poly1305_blocks_fpu;
func[1] = (void*)(uintptr_t)poly1305_emit_fpu;
crypto/rc4/build.info
+2 -6
View File
@@ -10,9 +10,5 @@ GENERATE[rc4-x86_64.s]=asm/rc4-x86_64.pl $(PERLASM_SCHEME)
GENERATE[rc4-md5-x86_64.s]=asm/rc4-md5-x86_64.pl $(PERLASM_SCHEME)
GENERATE[rc4-parisc.s]=asm/rc4-parisc.pl $(PERLASM_SCHEME)
BEGINRAW[Makefile]
# GNU make "catch all"
{- $builddir -}/rc4-%.s: {- $sourcedir -}/asm/rc4-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile]
GENERATE[rc4-c64xplus.s]=asm/rc4-c64xplus.pl $(PERLASM_SCHEME)
GENERATE[rc4-s390x.s]=asm/rc4-s390x.pl $(PERLASM_SCHEME)
crypto/sha/build.info
+12 -10
View File
@@ -26,6 +26,7 @@ GENERATE[sha256-mb-x86_64.s]=asm/sha256-mb-x86_64.pl $(PERLASM_SCHEME)
GENERATE[sha512-x86_64.s]=asm/sha512-x86_64.pl $(PERLASM_SCHEME)
GENERATE[keccak1600-x86_64.s]=asm/keccak1600-x86_64.pl $(PERLASM_SCHEME)
GENERATE[sha1-sparcv9a.S]=asm/sha1-sparcv9a.pl $(PERLASM_SCHEME)
GENERATE[sha1-sparcv9.S]=asm/sha1-sparcv9.pl $(PERLASM_SCHEME)
INCLUDE[sha1-sparcv9.o]=..
GENERATE[sha256-sparcv9.S]=asm/sha512-sparcv9.pl $(PERLASM_SCHEME)
@@ -76,14 +77,15 @@ GENERATE[sha512-s390x.S]=asm/sha512-s390x.pl $(PERLASM_SCHEME)
INCLUDE[sha512-s390x.o]=..
GENERATE[keccak1600-s390x.S]=asm/keccak1600-s390x.pl $(PERLASM_SCHEME)
BEGINRAW[Makefile(unix)]
##### SHA assembler implementations
GENERATE[sha1-c64xplus.S]=asm/sha1-c64xplus.pl $(PERLASM_SCHEME)
GENERATE[sha256-c64xplus.S]=asm/sha256-c64xplus.pl $(PERLASM_SCHEME)
GENERATE[sha512-c64xplus.S]=asm/sha512-c64xplus.pl $(PERLASM_SCHEME)
GENERATE[keccak1600-c64x.S]=asm/keccak1600-c64x.pl $(PERLASM_SCHEME)
# GNU make "catch all"
{- $builddir -}/sha1-%.S: {- $sourcedir -}/asm/sha1-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
{- $builddir -}/sha256-%.S: {- $sourcedir -}/asm/sha512-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
{- $builddir -}/sha512-%.S: {- $sourcedir -}/asm/sha512-%.pl
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
ENDRAW[Makefile(unix)]
# These are not yet used
GENERATE[keccak1600-avx2.S]=asm/keccak1600-avx2.pl $(PERLASM_SCHEME)
GENERATE[keccak1600-avx512.S]=asm/keccak1600-avx512.pl $(PERLASM_SCHEME)
GENERATE[keccak1600-avx512vl.S]=asm/keccak1600-avx512vl.pl $(PERLASM_SCHEME)
GENERATE[keccak1600-mmx.S]=asm/keccak1600-mmx.pl $(PERLASM_SCHEME)
GENERATE[keccak1600p8-ppc.S]=asm/keccak1600p8-ppc.pl $(PERLASM_SCHEME)
GENERATE[sha1-thumb.S]=asm/sha1-thumb.pl $(PERLASM_SCHEME)
crypto/srp/srp_vfy.c
+1 -1
View File
@@ -187,7 +187,7 @@ void SRP_user_pwd_free(SRP_user_pwd *user_pwd)
SRP_user_pwd *SRP_user_pwd_new(void)
{
SRP_user_pwd *ret;
if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) {
/* SRPerr(SRP_F_SRP_USER_PWD_NEW, ERR_R_MALLOC_FAILURE); */ /*ckerr_ignore*/
return NULL;
crypto/x509/x_crl.c
+12
View File
@@ -158,6 +158,18 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
int idx;
switch (operation) {
case ASN1_OP_D2I_PRE:
if (crl->meth->crl_free) {
if (!crl->meth->crl_free(crl))
return 0;
}
AUTHORITY_KEYID_free(crl->akid);
ISSUING_DIST_POINT_free(crl->idp);
ASN1_INTEGER_free(crl->crl_number);
ASN1_INTEGER_free(crl->base_crl_number);
sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free);
/* fall thru */
case ASN1_OP_NEW_POST:
crl->idp = NULL;
crl->akid = NULL;
crypto/x509/x_pubkey.c
+1
View File
@@ -36,6 +36,7 @@ static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
/* Attempt to decode public key and cache in pubkey structure. */
X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
EVP_PKEY_free(pubkey->pkey);
pubkey->pkey = NULL;
/*
* Opportunistically decode the key but remove any non fatal errors
* from the queue. Subsequent explicit attempts to decode/use the key
crypto/x509/x_x509.c
+23
View File
@@ -40,12 +40,35 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
switch (operation) {
case ASN1_OP_D2I_PRE:
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509, ret, &ret->ex_data);
X509_CERT_AUX_free(ret->aux);
ASN1_OCTET_STRING_free(ret->skid);
AUTHORITY_KEYID_free(ret->akid);
CRL_DIST_POINTS_free(ret->crldp);
policy_cache_free(ret->policy_cache);
GENERAL_NAMES_free(ret->altname);
NAME_CONSTRAINTS_free(ret->nc);
#ifndef OPENSSL_NO_RFC3779
sk_IPAddressFamily_pop_free(ret->rfc3779_addr, IPAddressFamily_free);
ASIdentifiers_free(ret->rfc3779_asid);
#endif
/* fall thru */
case ASN1_OP_NEW_POST:
ret->ex_cached = 0;
ret->ex_kusage = 0;
ret->ex_xkusage = 0;
ret->ex_nscert = 0;
ret->ex_flags = 0;
ret->ex_pathlen = -1;
ret->ex_pcpathlen = -1;
ret->skid = NULL;
ret->akid = NULL;
ret->policy_cache = NULL;
ret->altname = NULL;
ret->nc = NULL;
#ifndef OPENSSL_NO_RFC3779
ret->rfc3779_addr = NULL;
ret->rfc3779_asid = NULL;
demos/bio/accept.cnf
+1 -1
View File
@@ -6,7 +6,7 @@ Port = 4433
# Only support 3 curves
Curves = P-521:P-384:P-256
# Restricted signature algorithms
SignatureAlgorithms = RSA+SHA512:ECDSA+SHA512
SignatureAlgorithms = RSA+SHA512:ECDSA+SHA512
Certificate=server.pem
PrivateKey=server.pem
ChainCAFile=root.pem
demos/bio/connect.cnf
+1 -1
View File
@@ -6,4 +6,4 @@ Connect = localhost:4433
# Only support 3 curves
Curves = P-521:P-384:P-256
# Restricted signature algorithms
SignatureAlgorithms = RSA+SHA512:ECDSA+SHA512
SignatureAlgorithms = RSA+SHA512:ECDSA+SHA512
demos/bio/descrip.mms
+1 -1
View File
@@ -23,7 +23,7 @@ SHARED = TRUE
@ !
# Because we use an option file, we need to redefine this
.obj.exe :
.obj.exe :
$(LINK) $(LINKFLAGS) $<,OPT:/OPT
all : client-arg.exe client-conf.exe saccept.exe sconnect.exe -
demos/certs/README
+1 -1
View File
@@ -8,7 +8,7 @@ automatically using scripts. Example creates a root CA, an intermediate CA
signed by the root and several certificates signed by the intermediate CA.
The script then creates an empty index.txt file and adds entries for the
certificates and generates a CRL. Then one certificate is revoked and a
certificates and generates a CRL. Then one certificate is revoked and a
second CRL generated.
The script ocsprun.sh runs the test responder on port 8888 covering the
demos/certs/apps/mkxcerts.sh
+1 -1
View File
@@ -13,7 +13,7 @@ CN="OpenSSL Test RSA SHA-512 cert" $OPENSSL req \
-config apps.cnf -extensions usr_cert -x509 -nodes \
-keyout tsha512.pem -out tsha512.pem -new -days 3650 -sha512
# Create EC parameters
# Create EC parameters
$OPENSSL ecparam -name P-256 -out ecp256.pem
$OPENSSL ecparam -name P-384 -out ecp384.pem
demos/certs/mkcerts.sh
+1 -1
View File
@@ -42,7 +42,7 @@ CN="Test OCSP Responder Cert" $OPENSSL req -config ca.cnf -nodes \
$OPENSSL x509 -req -in respreq.pem -CA intca.pem -CAkey intkey.pem -days 3600 \
-extfile ca.cnf -extensions ocsp_cert -CAcreateserial -out resp.pem
# Example creating a PKCS#3 DH certificate.
# Example creating a PKCS#3 DH certificate.
# First DH parameters
doc/HOWTO/certificates.txt
+1 -1
View File
@@ -106,5 +106,5 @@ some applications, you don't even have to do that.
By now, you have your certificate and your private key and can start
using applications that depend on it.
--
--
Richard Levitte
doc/HOWTO/proxy_certificates.txt
+1 -1
View File
@@ -315,5 +315,5 @@ certificates checked properly, using the code above:
SSL_CTX_set_cert_verify_callback(s_ctx, my_X509_verify_cert, &needed_rights);
--
--
Richard Levitte
doc/fingerprints.txt
+1 -1
View File
@@ -18,7 +18,7 @@ uid Richard Levitte <richard@opensslfoundation.com>
uid Richard Levitte <levitte@openssl.org>
uid Richard Levitte <richard@openssl.com>
pub 2048R/0E604491 2013-04-30
pub 2048R/0E604491 2013-04-30
Key fingerprint = 8657 ABB2 60F0 56B1 E519 0839 D9C4 D26D 0E60 4491
uid Matt Caswell <matt@openssl.org>
uid Matt Caswell <frodo@baggins.org>
doc/man1/ca.pod
+1 -1
View File
@@ -475,7 +475,7 @@ the B<-selfsign> command line option.
Note that it is valid in some circumstances for certificates to be created
without any subject. In the case where there are multiple certificates without
subjects this does not count as a duplicate.
subjects this does not count as a duplicate.
=item B<serial>
doc/man1/pkcs12.pod
+2 -1
View File
@@ -154,7 +154,8 @@ Don't attempt to verify the integrity MAC before reading the file.
Prompt for separate integrity and encryption passwords: most software
always assumes these are the same so this option will render such
PKCS#12 files unreadable.
PKCS#12 files unreadable. Cannot be used in combination with the options
-password, -passin (if importing) or -passout (if exporting).
=back
doc/man1/s_client.pod
+9
View File
@@ -102,6 +102,7 @@ B<openssl> B<s_client>
[B<-dtls1>]
[B<-dtls1_2>]
[B<-sctp>]
[B<-sctp_label_bug>]
[B<-fallback_scsv>]
[B<-async>]
[B<-max_send_frag>]
@@ -506,6 +507,14 @@ Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in
conjunction with B<-dtls>, B<-dtls1> or B<-dtls1_2>. This option is only
available where OpenSSL has support for SCTP enabled.
=item B<-sctp_label_bug>
Use the incorrect behaviour of older OpenSSL implementations when computing
endpoint-pair shared secrets for DTLS/SCTP. This allows communication with
older broken implementations but breaks interoperability with correct
implementations. Must be used in conjunction with B<-sctp>. This option is only
available where OpenSSL has support for SCTP enabled.
=item B<-fallback_scsv>
Send TLS_FALLBACK_SCSV in the ClientHello.
doc/man1/s_server.pod
+10 -1
View File
@@ -173,6 +173,7 @@ B<openssl> B<s_server>
[B<-dtls1>]
[B<-dtls1_2>]
[B<-sctp>]
[B<-sctp_label_bug>]
[B<-no_dhe>]
[B<-nextprotoneg val>]
[B<-use_srtp val>]
@@ -685,6 +686,14 @@ Use SCTP for the transport protocol instead of UDP in DTLS. Must be used in
conjunction with B<-dtls>, B<-dtls1> or B<-dtls1_2>. This option is only
available where OpenSSL has support for SCTP enabled.
=item B<-sctp_label_bug>
Use the incorrect behaviour of older OpenSSL implementations when computing
endpoint-pair shared secrets for DTLS/SCTP. This allows communication with
older broken implementations but breaks interoperability with correct
implementations. Must be used in conjunction with B<-sctp>. This option is only
available where OpenSSL has support for SCTP enabled.
=item B<-no_dhe>
If this option is set then no DH parameters will be loaded effectively
@@ -825,7 +834,7 @@ unknown cipher suites a client says it supports.
L<SSL_CONF_cmd(3)>, L<sess_id(1)>, L<s_client(1)>, L<ciphers(1)>
L<SSL_CTX_set_max_send_fragment(3)>,
L<SSL_CTX_set_split_send_fragment(3)>,
L<SSL_CTX_set_max_pipelines(3)>
L<SSL_CTX_set_max_pipelines(3)>
=head1 HISTORY
doc/man3/EVP_MAC.pod
+10 -7
View File
@@ -87,9 +87,6 @@ through diverse controls.
This should be called before calling EVP_MAC_update() and
EVP_MAC_final().
EVP_MAC_reset() resets the computation for the given context.
This may not be supported by the MAC implementation.
EVP_MAC_update() adds C<datalen> bytes from C<data> to the MAC input.
EVP_MAC_final() does the final computation and stores the result in
@@ -171,18 +168,23 @@ Some MAC implementations require an IV, this control sets the IV.
=item B<EVP_MAC_CTRL_SET_CUSTOM>
This control expects two arguments: C<unsigned char *key>, C<size_t keylen>
This control expects two arguments: C<unsigned char *custom>, C<size_t customlen>
Some MAC implementations (KMAC) require an Customization String,
Some MAC implementations (KMAC, BLAKE2) accept a Customization String,
this control sets the Customization String. The default value is "".
=item B<EVP_MAC_CTRL_SET_SALT>
This control expects two arguments: C<unsigned char *salt>, C<size_t saltlen>
This option is used by BLAKE2 MAC.
=item B<EVP_MAC_CTRL_SET_XOF>
This control expects one argument: C<int xof>
This option is used by KMAC.
=item B<EVP_MAC_CTRL_SET_FLAGS>
This control expects one argument: C<unsigned long flags>
@@ -231,7 +233,7 @@ created EVP_MAC_CTX, or NULL if allocation failed.
EVP_MAC_CTX_free() returns nothing at all.
EVP_MAC_CTX_copy(), EVP_MAC_reset(), EVP_MAC_init(), EVP_MAC_update(),
EVP_MAC_CTX_copy(), EVP_MAC_init(), EVP_MAC_update(),
and EVP_MAC_final() return 1 on success, 0 on error.
EVP_MAC_ctrl(), EVP_MAC_ctrl_str(), EVP_MAC_str2ctrl() and
@@ -346,6 +348,7 @@ F<./foo>)
=head1 SEE ALSO
L<EVP_MAC_BLAKE2(7)>,
L<EVP_MAC_CMAC(7)>,
L<EVP_MAC_GMAC(7)>,
L<EVP_MAC_HMAC(7)>,
doc/man3/EVP_PKEY_CTX_ctrl.pod
+15 -1
View File
@@ -23,6 +23,8 @@ EVP_PKEY_CTX_get_rsa_oaep_md,
EVP_PKEY_CTX_set0_rsa_oaep_label,
EVP_PKEY_CTX_get0_rsa_oaep_label,
EVP_PKEY_CTX_set_dsa_paramgen_bits,
EVP_PKEY_CTX_set_dsa_paramgen_q_bits,
EVP_PKEY_CTX_set_dsa_paramgen_md,
EVP_PKEY_CTX_set_dh_paramgen_prime_len,
EVP_PKEY_CTX_set_dh_paramgen_subprime_len,
EVP_PKEY_CTX_set_dh_paramgen_generator,
@@ -93,6 +95,8 @@ EVP_PKEY_CTX_set1_id, EVP_PKEY_CTX_get1_id, EVP_PKEY_CTX_get1_id_len
#include <openssl/dsa.h>
int EVP_PKEY_CTX_set_dsa_paramgen_bits(EVP_PKEY_CTX *ctx, int nbits);
int EVP_PKEY_CTX_set_dsa_paramgen_q_bits(EVP_PKEY_CTX *ctx, int qbits);
int EVP_PKEY_CTX_set_dsa_paramgen_md(EVP_PKEY_CTX *ctx, const EVP_MD *md);
#include <openssl/dh.h>
@@ -255,7 +259,17 @@ by the library and should not be freed by the caller.
=head2 DSA parameters
The EVP_PKEY_CTX_set_dsa_paramgen_bits() macro sets the number of bits used
for DSA parameter generation to B<bits>. If not specified 1024 is used.
for DSA parameter generation to B<nbits>. If not specified, 1024 is used.
The EVP_PKEY_CTX_set_dsa_paramgen_q_bits() macro sets the number of bits in the
subprime parameter B<q> for DSA parameter generation to B<qbits>. If not
specified, 160 is used. If a digest function is specified below, this parameter
is ignored and instead, the number of bits in B<q> matches the size of the
digest.
The EVP_PKEY_CTX_set_dsa_paramgen_md() macro sets the digest function used for
DSA parameter generation to B<md>. If not specified, one of SHA-1, SHA-224, or
SHA-256 is selected to match the bit length of B<q> above.
=head2 DH parameters
doc/man3/EVP_PKEY_asn1_get_count.pod
+1 -1
View File
@@ -48,7 +48,7 @@ engine that implements it.
EVP_PKEY_asn1_get0_info() returns the public key ID, base public key
ID (both NIDs), any flags, the method description and PEM type string
associated with the public key ASN.1 method B<*ameth>.
associated with the public key ASN.1 method B<*ameth>.
EVP_PKEY_asn1_count(), EVP_PKEY_asn1_get0(), EVP_PKEY_asn1_find() and
EVP_PKEY_asn1_find_str() are not thread safe, but as long as all
doc/man3/HMAC.pod
+1 -1
View File
@@ -91,7 +91,7 @@ because reuse of an existing key with a different digest is not supported.
HMAC_Init() initializes a B<HMAC_CTX> structure to use the hash
function B<evp_md> and the key B<key> which is B<key_len> bytes
long.
long.
HMAC_Update() can be called repeatedly with chunks of the message to
be authenticated (B<len> bytes at B<data>).
doc/man3/OPENSSL_malloc.pod
+2 -4
View File
@@ -90,10 +90,8 @@ generally macro's that add the standard C B<__FILE__> and B<__LINE__>
parameters and call a lower-level B<CRYPTO_xxx> API.
Some functions do not add those parameters, but exist for consistency.
OPENSSL_malloc_init() sets the lower-level memory allocation functions
to their default implementation.
It is generally not necessary to call this, except perhaps in certain
shared-library situations.
OPENSSL_malloc_init() does nothing and does not need to be called. It is
included for compatibility with older versions of OpenSSL.
OPENSSL_malloc(), OPENSSL_realloc(), and OPENSSL_free() are like the
C malloc(), realloc(), and free() functions.
doc/man3/SSL_CTX_set0_CA_list.pod
+1 -1
View File
@@ -101,7 +101,7 @@ set CA names using the "client CA list" functions and then get them using the
used on the server side then the "client CA list" functions take precedence.
Typically, on the server side, the "client CA list " functions should be used in
preference. As noted above in most cases it is not necessary to set CA names on
the client side.
the client side.
SSL_CTX_set0_CA_list() sets the list of CAs to be sent to the peer to
B<name_list>. Ownership of B<name_list> is transferred to B<ctx> and
doc/man3/SSL_CTX_set_ctlog_list_file.pod
+1 -1
View File
@@ -24,7 +24,7 @@ See L<CTLOG_STORE_new(3)> for the file format.
=head1 NOTES
These functions will not clear the existing CT log list - it will be appended
to. To replace the existing list, use L<SSL_CTX_set0_ctlog_store> first.
to. To replace the existing list, use L<SSL_CTX_set0_ctlog_store> first.
If an error occurs whilst parsing a particular log entry in the file, that log
entry will be skipped.
doc/man3/SSL_CTX_set_mode.pod
+9
View File
@@ -121,6 +121,15 @@ Kernel TLS might not support all the features of OpenSSL. For instance,
renegotiation, and setting the maximum fragment size is not possible as of
Linux 4.20.
=item SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG
Older versions of OpenSSL had a bug in the computation of the label length
used for computing the endpoint-pair shared secret. The bug was that the
terminating zero was included in the length of the label. Setting this option
enables this behaviour to allow interoperability with such broken
implementations. Please note that setting this option breaks interoperability
with correct implementations. This option only applies to DTLS over SCTP.
=back
All modes are off by default except for SSL_MODE_AUTO_RETRY which is on by
doc/man3/SSL_CTX_set_record_padding_callback.pod
+2 -2
View File
@@ -19,10 +19,10 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
void SSL_set_record_padding_callback(SSL *ssl, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);
void *SSL_CTX_get_record_padding_callback_arg(SSL_CTX *ctx);
void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx);
void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg);
void *SSL_get_record_padding_callback_arg(SSL *ssl);
void *SSL_get_record_padding_callback_arg(const SSL *ssl);
int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size);
int SSL_set_block_padding(SSL *ssl, size_t block_size);
doc/man3/SSL_CTX_set_ssl_version.pod
+1 -1
View File
@@ -11,7 +11,7 @@ SSL_CTX_set_ssl_version, SSL_set_ssl_method, SSL_get_ssl_method
int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *method);
int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method);
const SSL_METHOD *SSL_get_ssl_method(SSL *ssl);
const SSL_METHOD *SSL_get_ssl_method(const SSL *ssl);
=head1 DESCRIPTION
doc/man3/SSL_key_update.pod
+2 -2
View File
@@ -14,11 +14,11 @@ SSL_renegotiate_pending
#include <openssl/ssl.h>
int SSL_key_update(SSL *s, int updatetype);
int SSL_get_key_update_type(SSL *s);
int SSL_get_key_update_type(const SSL *s);
int SSL_renegotiate(SSL *s);
int SSL_renegotiate_abbreviated(SSL *s);
int SSL_renegotiate_pending(SSL *s);
int SSL_renegotiate_pending(const SSL *s);
=head1 DESCRIPTION
doc/man3/SSL_read_early_data.pod
+1 -1
View File
@@ -93,7 +93,7 @@ the server.
A client uses the function SSL_write_early_data() to send early data. This
function is similar to the L<SSL_write_ex(3)> function, but with the following
differences. See L<SSL_write_ex(3)> for information on how to write bytes to
the underlying connection, and how to handle any errors that may arise. This
the underlying connection, and how to handle any errors that may arise. This
page describes the differences between SSL_write_early_data() and
L<SSL_write_ex(3)>.
doc/man3/d2i_PrivateKey.pod
+11 -7
View File
@@ -50,15 +50,19 @@ If the B<*a> is not NULL when calling d2i_PrivateKey() or d2i_AutoPrivateKey()
(i.e. an existing structure is being reused) and the key format is PKCS#8
then B<*a> will be freed and replaced on a successful call.
To decode a key with type B<EVP_PKEY_EC>, d2i_PublicKey() requires B<*a> to be
a non-NULL EVP_PKEY structure assigned an EC_KEY structure referencing the proper
EC_GROUP.
=head1 RETURN VALUES
d2i_PrivateKey() and d2i_AutoPrivateKey() return a valid B<EVP_KEY> structure
or B<NULL> if an error occurs. The error code can be obtained by calling
L<ERR_get_error(3)>.
The d2i_PrivateKey(), d2i_AutoPrivateKey(), d2i_PrivateKey_bio(), d2i_PrivateKey_fp(),
and d2i_PublicKey() functions return a valid B<EVP_KEY> structure or B<NULL> if an
error occurs. The error code can be obtained by calling L<ERR_get_error(3)>.
i2d_PrivateKey() returns the number of bytes successfully encoded or a
negative value if an error occurs. The error code can be obtained by calling
L<ERR_get_error(3)>.
i2d_PrivateKey() and i2d_PublicKey() return the number of bytes successfully
encoded or a negative value if an error occurs. The error code can be obtained
by calling L<ERR_get_error(3)>.
=head1 SEE ALSO
@@ -67,7 +71,7 @@ L<d2i_PKCS8PrivateKey_bio(3)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man7/EVP_MAC_BLAKE2.pod
+114
View File
@@ -0,0 +1,114 @@
=pod
=head1 NAME
EVP_MAC_BLAKE2 - The BLAKE2 EVP_MAC implementation
=head1 DESCRIPTION
Support for computing BLAKE2 MACs through the B<EVP_MAC> API.
=head2 Numeric identity
B<EVP_MAC_BLAKE2B> and B<EVP_MAC_BLAKE2S> are the numeric identities for this
implementation, and can be used in functions like EVP_MAC_CTX_new_id() and
EVP_get_macbynid().
=head2 Supported controls
The supported controls are:
=over 4
=item B<EVP_MAC_CTRL_SET_KEY>
This is a string value of at most 64 bytes for EVP_MAC_BLAKE2B
or 32 for EVP_MAC_BLAKE2S and at least 1 byte in both cases.
This must be set before calling EVP_MAC_init().
EVP_MAC_ctrl_str() takes two type strings for this control:
=over 4
=item "key"
The value string is used as is.
=item "hexkey"
The value string is expected to be a hexadecimal number, which will be
decoded before passing on as control value.
=back
=item B<EVP_MAC_CTRL_SET_CUSTOM>
This is an optional string value of at most 16 bytes for EVP_MAC_BLAKE2B
or 8 for EVP_MAC_BLAKE2S, set to all-NULL by default.
If used this must be set before calling EVP_MAC_init().
EVP_MAC_ctrl_str() takes two type strings for this control:
=over 4
=item "custom"
The value string is used as is.
=item "hexcustom"
The value string is expected to be a hexadecimal number, which will be
decoded before passing on as control value.
=back
=item B<EVP_MAC_CTRL_SET_SALT>
This is an optional string value of at most 16 bytes for EVP_MAC_BLAKE2B
or 8 for EVP_MAC_BLAKE2S, set to all-NULL by default.
If used this must be set before calling EVP_MAC_init().
EVP_MAC_ctrl_str() takes two type strings for this control:
=over 4
=item "salt"
The value string is used as is.
=item "hexsalt"
The value string is expected to be a hexadecimal number, which will be
decoded before passing on as control value.
=back
=item B<EVP_MAC_CTRL_SET_SIZE>
EVP_MAC_ctrl_str() type string: "outlen"
This is an optional value string containing a decimal number between 1 and
32 for EVP_MAC_BLAKE2S or 64 for EVP_MAC_BLAKE2B.
If it is not set it uses the default digest size of 32 and 64 respectively.
If used this must be set before calling EVP_MAC_init().
=back
=head1 SEE ALSO
L<EVP_MAC_ctrl(3)>, L<EVP_MAC(3)/CONTROLS>
=head1 HISTORY
The macros and functions described here were added to OpenSSL 3.0.0.
=head1 COPYRIGHT
Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
include/internal/thread_once.h
+6 -6
View File
@@ -13,7 +13,7 @@
* DEFINE_RUN_ONCE: Define an initialiser function that should be run exactly
* once. It takes no arguments and returns and int result (1 for success or
* 0 for failure). Typical usage might be:
*
*
* DEFINE_RUN_ONCE(myinitfunc)
* {
* do_some_initialisation();
@@ -45,7 +45,7 @@
* exactly once. This function will be declared as static within the file. It
* takes no arguments and returns and int result (1 for success or 0 for
* failure). Typical usage might be:
*
*
* DEFINE_RUN_ONCE_STATIC(myinitfunc)
* {
* do_some_initialisation();
@@ -74,10 +74,10 @@
* is used only one of the primary or the alternative initialiser function will
* ever be called - and that function will be called exactly once. Definitition
* of an alternative initialiser function MUST occur AFTER the definition of the
* primiary initialiser function.
*
* primiary initialiser function.
*
* Typical usage might be:
*
*
* DEFINE_RUN_ONCE_STATIC(myinitfunc)
* {
* do_some_initialisation();
@@ -86,7 +86,7 @@
*
* return 0;
* }
*
*
* DEFINE_RUN_ONCE_STATIC_ALT(myaltinitfunc, myinitfunc)
* {
* do_some_alternative_initialisation();
include/internal/tsan_assist.h
+1 -1
View File
@@ -6,7 +6,7 @@
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
/*
* Contemporary compilers implement lock-free atomic memory access
* primitives that facilitate writing "thread-opportunistic" or even real
include/openssl/crypto.h
+2 -7
View File
@@ -109,13 +109,8 @@ DEFINE_STACK_OF(void)
# define CRYPTO_EX_INDEX_DRBG 15
# define CRYPTO_EX_INDEX__COUNT 16
/*
* This is the default callbacks, but we can have others as well: this is
* needed in Win32 where the application malloc and the library malloc may
* not be the same.
*/
#define OPENSSL_malloc_init() \
CRYPTO_set_mem_functions(CRYPTO_malloc, CRYPTO_realloc, CRYPTO_free)
/* No longer needed, so this is a no-op */
#define OPENSSL_malloc_init() while(0) continue
int CRYPTO_mem_ctrl(int mode);

Some files were not shown because too many files have changed in this diff Show More