denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,546 Commits 1 Branch 0 Tags
3f3680ec3fcbb23f27685b0283117182a7b340a7
Commit Graph
416 Commits
Author SHA1 Message Date
Martin Willi e5d73b0dfa aead: Support custom AEAD salt sizes 
The salt, or often called implicit nonce, varies between AEAD algorithms and
their use in protocols. For IKE and ESP, GCM uses 4 bytes, while CCM uses
3 bytes. With TLS, however, AEAD mode uses 4 bytes for both GCM and CCM.

Our GCM backends currently support 4 bytes and CCM 3 bytes only. This is fine
until we go for CCM mode support in TLS, which requires 4 byte nonces.
 2014-03-31 15:56:12 +02:00
Tobias Brunner 510c900479 crypto-tester: Don't fail if key size is not supported 
The Blowfish and Twofish implementations provided by the gcrypt plugin
only support specific key lengths, which we don't know when testing
against vectors (either during unit tests or during algorithm
registration).  The on_create test with a specific key length will be
skipped anyway, so there is no point in treating this failure differently.
 2014-03-20 15:49:05 +01:00
Tobias Brunner 636076d45d unit-tests: Actually verify registered algorithms against test vectors 
Previously, the {ns}.crypto_test.on_add option had to be enabled to
actually test the algorithms, which we can't enforce for the tests in
the test_runner as the option is already read when the crypto factory
is initialized.  Even so, we wouldn't want to do this for every unit
test, which would be the result of enabling that option.
 2014-03-20 15:49:05 +01:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Thomas Egerer 568e302260 proposal: Add possibility to register custom proposal keyword parser 
If a proposal string cannot be matched to a token using strcmp (e.g. if
you want to register a whole class of algorithms containing their ID,
like my_alg_2342), you can use the provided function to register a
parser that transforms the given string into a proposal token.

Signed-off-by: Thomas Egerer <[email protected]>
 2014-01-20 16:40:34 +01:00
Andreas Steffen 146ad86be5 Prototype implementation of IKE key exchange via NTRU encryption 2013-11-27 20:21:40 +01:00
Andreas Steffen cca372465d ecc: Added ECC Brainpool ECDH groups as registered with IANA 2013-10-17 11:57:04 +02:00
Andreas Steffen 6623dfa84d Revert refactoring which broke CentOS build 2013-10-13 19:56:04 +02:00
Tobias Brunner 0c6f6c4e34 iv_gen: Mask sequential IVs with a random salt 
This makes it harder to attack a HA setup, even if the sequence numbers were
not fully in sync.
 2013-10-11 15:55:40 +02:00
Tobias Brunner e8229ad558 iv_gen: Provide external sequence number (IKE, ESP) 
This prevents duplicate sequential IVs in case of a HA failover.
 2013-10-11 15:55:40 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00
Tobias Brunner b3e1eb2afe iv_gen: Add IV generator that allocates IVs sequentially 2013-10-11 15:55:40 +02:00
Tobias Brunner 53d1f2dbfd iv_gen: Add IV generator that allocates IVs randomly 
Uses RNG_WEAK as the code currently does elsewhere to allocate IVs.
 2013-10-11 15:55:40 +02:00
Tobias Brunner 403057aa5a crypto: Add generic interface for IV generators 2013-10-11 15:55:40 +02:00
Tobias Brunner b38f7f703b apidoc: Move mac_prf to prf Doxygen group 2013-10-11 15:55:40 +02:00
Tobias Brunner ec91f15e3b crypto-factory: Try next available RNG implementation if constructor fails 2013-10-11 15:13:25 +02:00
Tobias Brunner 2e22333fbc crypto-factory: Order entries by algorithm identifier and (optionally) speed 2013-10-11 15:13:25 +02:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Tobias Brunner cfca183d55 pkcs5: Add missing break statements when checking crypto primitives 2013-07-24 16:17:22 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi e9e4759733 crypto-factory: count the number of test vector failures during registration 2013-06-21 10:53:20 +02:00
Tobias Brunner 5d52087b54 Added missing string for full-length HMAC-SHA512 signer 2013-06-10 11:48:18 +02:00
Tobias Brunner 1f2a34d6d8 Add support for untruncated HMAC-SHA-512 2013-05-08 15:02:39 +02:00
Tobias Brunner d8be7d38bf Also support 128-bit RC2 2013-05-08 15:02:39 +02:00
Tobias Brunner 199fdcadae Function added to convert a hash algorithm to an HMAC integrity algorithm 2013-05-08 15:02:39 +02:00
Tobias Brunner 047fca1169 Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner 594d847f79 PKCS#5 wrapper can decrypt PKCS#12-like schemes 2013-05-08 15:02:38 +02:00
Tobias Brunner 162c06f2f5 Fix cleanup in crypto_tester if a crypter fails 2013-05-08 15:02:38 +02:00
Tobias Brunner 9d4fc8677f Add implementation of the RC2 block cipher (RFC 2268) 2013-05-08 15:02:34 +02:00
Tobias Brunner c734c2d875 Extract function to convert ASN.1 INTEGER object to u_int64_t 2013-05-08 14:53:08 +02:00
Tobias Brunner 4076e3ee91 Extract PKCS#5 handling from pkcs8 plugin to separate helper class 2013-05-08 14:53:08 +02:00
Tobias Brunner a89ebab62e Fix cleanup in crypto_tester if AEAD implementation fails 2013-02-28 18:17:42 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Martin Willi 03ba8f9e8c Move PKCS#9 attribute lists to pkcs7 plugin, as we currently use it there only 2012-12-19 10:32:08 +01:00
Martin Willi 1865fb929a Remove unused monolithic PKCS#7 code 2012-12-19 10:32:08 +01:00
Martin Willi 67ca44ccbd Rebuild PKCS#9 encoding after adding new attributes 2012-12-19 10:32:07 +01:00
Martin Willi 60c9b5da8d Don't store additional encoding for each PKCS#9 attribute 2012-12-19 10:32:07 +01:00
Martin Willi 7f9fedc9bd Unify PKCS#9 set_attribute* methods to a single add_attribute 
This way the PKCS#9 implementation does not have to know
the encoding types for values
 2012-12-19 10:32:07 +01:00
Martin Willi c1005c120c PKCS#9 coding style cleanups 2012-12-19 10:32:07 +01:00
Martin Willi f0c02e27c4 Remove external build_encoding method in PKCS#9 2012-12-19 10:32:07 +01:00
Tobias Brunner f9625952ad Moved settings_t to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner d5c143e5be Moved enum_name_t to utils folder 2012-10-24 16:00:50 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Martin Willi 60e59b7e7f Add proposal keywords to explicitly specify PRF algorithms 2012-10-24 11:49:36 +02:00
Tobias Brunner 91a8dc2dec Fixed RNG crypto tester 2012-09-28 19:13:40 +02:00
Tobias Brunner 24aa55867e Initialize g and p in create_dh factory method 2012-09-28 15:48:09 +02:00
Tobias Brunner 4e16d2e864 Fix Doxygen comment for proposal_keywords_t 
Two dots seem to mark the end of a list.
 2012-09-18 16:13:23 +02:00
Tobias Brunner 08ad639f32 Added algorithm lookup via kernel_interface_t to the various kernel interfaces 2012-09-13 15:48:49 +02:00