Tobias Brunner
57cb4c8d2c
openssl: Add support for X25519 and X448
...
While X25519 was already added with 1.1.0a, its use would be a lot more
complicated, as the helpers like EVP_PKEY_new_raw_public_key() were only
added in 1.1.1, which also added X448.
2018-11-30 14:53:38 +01:00
Tobias Brunner
8b4c2a1d8e
openssl: Fix some const issues with OpenSSL 1.1.0
2018-10-31 15:50:36 +01:00
Tobias Brunner
fd3947d9e5
openssl: Don't use functions deprecated with OpenSSL 1.1.0
2018-10-31 15:50:36 +01:00
Tobias Brunner
ecfe67550d
signature-params: Provide option for maximum RSA/PSS salt length
...
However, the length now has to be resolved early, so we don't operate on
the negative constant values e.g. when generating the encoding.
2018-10-26 09:03:26 +02:00
ambiso
6b3dfe9c38
openssl: Remove extra semicolon
2018-10-24 09:49:25 +02:00
ambiso
b9e45b5b4a
openssl: Remove arbitrary keyid length check
2018-10-24 09:49:18 +02:00
ambiso
b148517c6b
openssl: Fix invalid keyid length check
...
Check was designed for base64 conversion, however a hex conversion is
being performed, which requires more memory.
2018-10-24 09:48:56 +02:00
Tobias Brunner
1b67166921
Unify format of HSR copyright statements
2018-05-23 16:32:53 +02:00
Tobias Brunner
9c6b102ee0
openssl: Fail CRL validity check if thisUpdate is in the future
2018-05-22 09:50:47 +02:00
Tobias Brunner
504e12326d
openssl: Set IKE compliance flag depending on keyUsage
2018-05-22 09:50:47 +02:00
Tobias Brunner
364395d2de
Treat RSASSA-PSS keys like rsaEncryption RSA keys
...
In theory we should treat any parameters and the identifier itself as
restriction to only use the key to create signatures accordingly (e.g.
only use RSA with PSS padding or even use specific hash algorithms).
But that's currently tricky as we'd have to store and pass this information
along with our private keys (i.e. use PKCS#8 to store them and change the
builder calls to pass along the identifier and parameters). That would
require quite some work.
2017-11-08 16:48:10 +01:00
Tobias Brunner
fb63012e0c
openssl: Add support for signature schemes with parameters
2017-11-08 16:48:10 +01:00
Tobias Brunner
024b979522
certificate: Return signature scheme and parameters from issued_by() method
...
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
2017-11-08 16:48:10 +01:00
Tobias Brunner
2f95d7195d
openssl: Add support for verifying RSASSA-PSS signatures
2017-11-08 16:48:10 +01:00
Tobias Brunner
51dd2fd2db
openssl: Add support for creating RSASSA-PSS signatures
2017-11-08 16:48:10 +01:00
Tobias Brunner
5ae3f5cea8
openssl: Add helper to determine EVP_MD from hash_algorithm_t
2017-11-08 16:48:10 +01:00
Tobias Brunner
03eda5a822
openssl: Add functions to determine missing RSA private key parameters
...
We only need n, e, and d. The parameters for the Chinese remainder
algorithm and even p and q can be determined from these.
2017-11-08 16:48:10 +01:00
Tobias Brunner
de280c2e03
private-key: Add optional parameters argument to sign() method
2017-11-08 16:48:10 +01:00
Tobias Brunner
a413571f3b
public-key: Add optional parameters argument to verify() method
2017-11-08 16:48:10 +01:00
Tobias Brunner
b2266280ef
openssl: Also load EC keys from an ENGINE
2017-11-02 09:42:52 +01:00
Tobias Brunner
78acaba6a1
openssl: Fix call of X509_CRL_get0_signature() with OpenSSL 1.1.0
...
The order of arguments in X509_CRL_get0_signature() is not the same as that
of X509_get0_signature().
Fixes: 989ba4b6cd
2017-10-10 10:09:08 +02:00
Tobias Brunner
46a62f0126
Define MODP_CUSTOM constructors as variadic functions
...
They now match the dh_constructor_t signature. This is a follow up for
the changes merged with b668bf3f9e
2017-09-18 12:07:26 +02:00
Tobias Brunner
86c10a958f
openssl: Add support for delta CRLs
2017-09-18 10:54:31 +02:00
Tobias Brunner
4e7b7db62f
certificates: Use shared destructor for x509_cdp_t
2017-09-18 10:54:19 +02:00
Tobias Brunner
e793d65acd
openssl: Properly handle flags in key usage extension
2017-06-14 10:03:13 +02:00
Tobias Brunner
95a63bf281
Migrate all enumerators to venumerate() interface change
2017-05-26 13:56:44 +02:00
Tobias Brunner
f20b3f7b2c
openssl: BoringSSL doesn't provide curve data for ECC Brainpool curves
2016-12-10 12:27:47 +01:00
Tobias Brunner
c72c6e9225
openssl: Fix AES-GCM with BoringSSL
...
BoringSSL only supports a limited list of (hard-coded) algorithms via
EVP_get_cipherbyname(), which does not include AES-GCM. While BoringSSL
deprecated these functions they are also supported by OpenSSL (in BoringSSL
a completely new interface for AEADs was added, which OpenSSL currently does
not support).
2016-10-11 15:29:14 +02:00
Tobias Brunner
4a6f97d00b
openssl: Add a generic private key loader
2016-10-05 11:32:52 +02:00
Andreas Steffen
40f2589abf
gmp: Support of SHA-3 RSA signatures
2016-09-22 17:34:31 +02:00
Tobias Brunner
1fafc56b95
Fixed some typos, courtesy of codespell
2016-07-04 12:18:51 +02:00
Tobias Brunner
fedec33f5a
openssl: Update GCM/crypter API to OpenSSL 1.1.0
2016-06-29 11:09:38 +02:00
Tobias Brunner
97b1a27f43
openssl: Update HMAC API to OpenSSL 1.1.0
2016-06-29 11:09:38 +02:00
Tobias Brunner
cd08eb84cb
openssl: Don't use deprecated RAND_pseudo_bytes()
2016-06-29 11:09:38 +02:00
Tobias Brunner
985d7b1c67
openssl: Update PKCS#12 API to OpenSSL 1.1.0
2016-06-29 11:09:37 +02:00
Tobias Brunner
a9f388e368
openssl: Update PKCS#7 API to OpenSSL 1.1.0
2016-06-29 11:09:37 +02:00
Tobias Brunner
989ba4b6cd
openssl: Update CRL API to OpenSSL 1.1.0
...
There is currently no way to compare the outer and inner algorithms
encoded in a parsed CRL. X509_CRL_verify() does not seem to check that
either, though (unlike X509_verify()).
2016-06-29 11:09:37 +02:00
Tobias Brunner
08d7e1f190
openssl: Update x509 API to OpenSSL 1.1.0
2016-06-29 11:09:37 +02:00
Tobias Brunner
6688f7986e
openssl: Update ECDSA API to OpenSSL 1.1.0
2016-06-29 11:09:37 +02:00
Tobias Brunner
3fb2c8edb7
openssl: Update RSA API to OpenSSL 1.1.0
2016-06-29 11:09:37 +02:00
Tobias Brunner
375a5ed240
openssl: Make some utilities take const BIGNUM pointers
2016-06-29 11:09:37 +02:00
Tobias Brunner
6d5df086f7
openssl: Add macro to define fallback functions for non-opaque OpenSSL versions
2016-06-29 11:09:37 +02:00
Tobias Brunner
54d629b7ad
openssl: Update DH API to OpenSSL 1.1.0
2016-06-29 11:09:37 +02:00
Tobias Brunner
1b36fbedf5
openssl: Update crypter API to OpenSSL 1.1.0
...
EVP_CIPHER and EVP_CIPHER_CTX are now opaque types, the getters already
existed before.
2016-06-29 11:09:37 +02:00
Tobias Brunner
faa904fb0b
openssl: Fix mapping from ASN1 to chunk_t with OpenSSL 1.1.0
...
ASN1_OBJECT is now opaque.
2016-06-29 11:09:37 +02:00
Tobias Brunner
e2abe7ae97
openssl: Update initialization and cleanup for OpenSSL 1.1.0
...
We can't call OPENSSL_cleanup() as that would prevent us from
re-initializing the library again (which we use in the Android app, that
loads/unloads plugins).
2016-06-29 11:09:36 +02:00
Tobias Brunner
a6c43a8d8a
openssl: OpenSSL 1.1.0 is thread-safe so we don't have to setup callbacks
2016-06-29 11:09:36 +02:00
Tobias Brunner
a046f929ce
android: Use non-aliased cipher identifiers
...
Some of these are also understood by BoringSSL.
Fixes #1510 .
2016-06-13 10:38:20 +02:00
Tobias Brunner
47a46be597
openssl: BoringSSL does not support configuration
...
The other initialization functions are still defined but many are
apparently no-ops (this is also true for the threading initialization).
2016-04-15 10:32:53 +02:00
Tobias Brunner
c8a219a28d
openssl: The member storing the DH exponent length has been renamed in BoringSSL
2016-04-15 10:32:53 +02:00
Tobias Brunner