denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,162 Commits 1 Branch 0 Tags
51dd2fd2db1ad3e10a20344e8025c5139455b944
Commit Graph
488 Commits
Author SHA1 Message Date
Tobias Brunner c2b878cd61 hasher: Add function to determine length of hashes 2017-11-08 16:48:10 +01:00
Tobias Brunner 677072accc public-key: Add RSASSA-PSS signature scheme identifier 2017-11-08 16:48:10 +01:00
Tobias Brunner 43b59d1323 ikev2: Don't use SHA-1 for RFC 7427 signature authentication 
RFC 8247 demoted it to MUST NOT.

References #2427.
 2017-11-08 16:47:24 +01:00
Tobias Brunner 0ae19f0ced configure: Fix gperf length parameter determination 
gperf is not actually a build dependency as the generated files are
shipped in the tarball.  So the type depends on the gperf version on
the host that ran gperf and created the tarball, which might not be
the same as that on the actual build host, and gperf might not even
be installed there, leaving the type undetermined.

Fixes: e0e4322973 ("configure: Detect type of length parameter for gperf generated function")
 2017-10-02 17:21:42 +02:00
Tobias Brunner e0e4322973 configure: Detect type of length parameter for gperf generated function 
Since 3.1 gperf uses size_t for the length parameter instead of an
unsigned int.
 2017-09-19 13:24:43 +02:00
Tobias Brunner ca280574ba Fixed some typos, courtesy of codespell 2017-08-07 17:22:01 +02:00
Tobias Brunner e0c78d7516 prf-plus: Wipe seed and internal buffer 
The buffer contains key material we handed out last and the seed can
contain the DH secret.

References #2388.
 2017-08-07 16:55:28 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Andreas Steffen efc1b98461 Allow x25519 as an alias of the curve25519 KE algorithm 2017-03-20 21:18:00 +01:00
Andreas Steffen db1ab1cd99 Reference Edwards-curve signature RFCs 2017-03-20 21:18:00 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Martin Willi 8935842c2e proposal: Add a curve25519 proposal keyword 2016-11-14 16:20:51 +01:00
Martin Willi a4195d3841 diffie-hellman: Add DH group identifiers for Curve25519 and Curve448 2016-11-14 16:20:51 +01:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Andreas Steffen 188b190a70 mgf1: Refactored MGF1 as an XOF 2016-09-21 06:40:52 +02:00
Thomas Egerer c6b9a3a485 proposal: Use proper list to get function pointer when adding custom parser 
Signed-off-by: Thomas Egerer <[email protected]>
 2016-08-29 16:02:07 +02:00
Andreas Steffen 393688aea0 Created newhope plugin implementing the New Hope key exchange algorithm 2016-08-10 14:22:00 +02:00
Andreas Steffen 1fddb0b92e xof: Added ChaCha20 stream as XOF 2016-08-06 12:09:05 +02:00
Andreas Steffen 04208ac5d4 xof: Defined Extended Output Functions 2016-07-29 12:36:14 +02:00
Tobias Brunner 2f211ced9c proposal: Parse modpnone as MODP_NONE(0) 2016-06-17 18:48:07 +02:00
Tobias Brunner 990c62cdcc crypto-factory: Stop after successfully creating one nonce generator 
Fixes: e2fc09c186 ("Add nonce generator interface")
 2016-06-17 18:48:02 +02:00
Tobias Brunner e8bddd64fc proposal: Use standard integer types for static keywords 2016-03-31 09:25:19 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner f6083d350c iv-gen: Use NULL IV generator for NULL encryption 
We don't need an IV for NULL encryption, so we wouldn't technically need
an IV generator.  But some of the code currently relies on an IV
generator to be present.  So we don't have to change that code and
handle IV size == 0 specially we use the new NULL IV generator, which
handles this transparently to the existing code.

Before 3c81cb6fc3 ("aead: Create AEAD using traditional transforms
with an explicit IV generator") iv_gen_rand_t was used for NULL
encryption, which would work too but this way it's clearer.
 2015-11-09 11:09:18 +01:00
Tobias Brunner 403acf8614 crypto: Add NULL IV generator 
This does not actually allocate an IV and only accepts requests
for size == 0.
 2015-11-09 11:08:22 +01:00
Andreas Steffen 23a50e66f1 testing: Updated hasher tests 2015-11-06 16:05:44 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Andreas Steffen f6fede934b Support BLISS signatures with SHA-3 hash 2015-11-03 21:35:09 +01:00
Andreas Steffen de61e2cef4 Defined SHA-3 hashers 2015-11-03 19:07:15 +01:00
Martin Willi b211f283b7 proposal: Add a chacha20poly1305 proposal keyword 2015-06-29 17:32:13 +02:00
Martin Willi 9e110cc54c crypter: Define a ChaCha20/Poly1305 AEAD algorithm identifier 2015-06-29 17:32:03 +02:00
Martin Willi b756eea4f4 ivgen: Allow reusing the same message ID twice in sequential IV gen 
We use the message ID and fragment number as IV generator. As IKEv2 uses
distinct message ID counters for actively and passively initiated exchanges,
each IV would be used twice. As we explicitly reject such message IDs since
d0ed1079, original-responder initiated exchanges fail with counter mode ciphers.

This commit separates IV space in two halves for sequential IVs, and
automatically assigns once reused sequence numbers to the second half.

Fixes #980.
 2015-06-05 13:44:42 +02:00
Martin Willi ef31254d34 iv-gen: Fail getting shorter IV values than the used counter size 
While no algorithm actually uses such short IVs, we add a check here to ensure
we won't return just the lower bits of the counter.
 2015-06-01 09:42:10 +02:00
Martin Willi d0ed107910 iv-gen: Ensure external sequential IVs are actually sequential 
We allow gaps in IVs, but ensure that an IV is never used more than once.
 2015-06-01 09:42:10 +02:00
Martin Willi 80469c2168 crypto-factory: Remove obsolete transform testing functions 2015-04-15 14:38:43 +02:00
Martin Willi 1d55e0756a transform: Add a getter for the enum_names for a specific transform type 2015-04-15 14:38:43 +02:00
Martin Willi e03fb1fb26 crypto-factory: Add enumerator method to support individual transform testing 2015-04-15 14:38:43 +02:00
Martin Willi a94955e88a crypto-tester: Support testing DH groups using DH test vectors 2015-04-15 14:37:38 +02:00
Martin Willi 3941545fb9 diffie-hellman: Introduce an optional setter for the private value 
This allows us to work with deterministic values for testing purposes.
 2015-04-15 14:37:38 +02:00
Martin Willi 3a5106caea crypto-tester: Use the plugin feature key size to benchmark crypters/aeads 
We previously didn't pass the key size during algorithm registration, but this
resulted in benchmarking with the "default" key size the crypter uses when
passing 0 as key size.
 2015-04-15 11:35:26 +02:00
Martin Willi 71afe0a556 utils: Use memeq_const() for all cryptographic purposes 2015-04-14 11:53:31 +02:00
Martin Willi 3c81cb6fc3 aead: Create AEAD using traditional transforms with an explicit IV generator 
Real AEADs directly provide a suitable IV generator, but traditional crypters
do not. For some (stream) ciphers, we should use sequential IVs, for which
we pass an appropriate generator to the AEAD wrapper.
 2015-04-13 15:06:15 +02:00
Martin Willi a4549e5525 iv-gen: Add a generic constructor to create an IV gen from an algorithm 2015-04-13 15:06:15 +02:00
Martin Willi 9310d4250a crypto-tester: Explicitly exclude FIPS-PRF from append mode tests 
This was implicitly done by the seed length check before 58dda5d6, but we
now require an explicit check to avoid that unsupported use.
 2015-03-28 08:38:52 +01:00
Martin Willi 58dda5d6ab crypto-tester: Test set_key() after a doing a partial append on prf/signers 
While that use is uncommon in real-world use, nonetheless should HMAC set a
correct key and reset any underlying hasher.
 2015-03-27 15:53:47 +01:00
Martin Willi 0356089d0f diffie-hellman: Verify public DH values in backends 2015-03-23 17:54:03 +01:00
Martin Willi a777155ffe diffie-hellman: Add a bool return value to set_other_public_value() 2015-03-23 17:54:03 +01:00
Martin Willi 42431690e0 diffie-hellman: Add a bool return value to get_my_public_value() 2015-03-23 17:54:03 +01:00