denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,657 Commits 1 Branch 0 Tags
72bb7eec9c626859c46ce9d8d81dc89854eacb4d
Commit Graph
425 Commits
Author SHA1 Message Date
Andreas Steffen 72bb7eec9c Implemented get_byte() method for mgf1_bitspender class 
The new get_byte() method returns a pseudo-random byte at a time.
Changed the get_bits() interface to the same interface as get_byte().
Updated the mgf1 unit-tests accordingly.
 2014-11-29 14:51:16 +01:00
Andreas Steffen f673966b9f Started implementing BLISS signature generation 2014-11-29 14:51:16 +01:00
Andreas Steffen 988d477145 Implemented bitspender based on the MGF1 mask generator function 2014-11-29 14:51:15 +01:00
Andreas Steffen 1d3e080877 Moved mgf1 class to libstrongswan/crypto/mgf1 2014-11-29 14:51:15 +01:00
Martin Willi 46184b07c1 diffie-hellman: Explicitly initialize DH exponent sizes during initialization 
To avoid any race conditions when multiple threads call and initialize
diffie_hellman_get_params(), explicitly examine the optimum DH exponent size
during library initialization.

Fixes #655.
 2014-08-25 09:43:29 +02:00
Tobias Brunner 94dbbd8079 crypto-factory: Only sort RNGs by algorithm identifier 
Others remain in the order in which they were added, grouped by
algorithm identifier and sorted by benchmarking speed, if provided.
 2014-06-20 16:21:55 +02:00
Martin Willi 89c3ff6d2c windows: Check for clock_gettime() function itself as well 
CLOCK_THREAD_CPUTIME_ID seems to be defined sometimes even if clock_gettime() is
missing.
 2014-06-04 15:53:05 +02:00
Martin Willi 922ee2c529 windows: Add a common Windows header for platform specific wrappers 
Include some more basic system headers in utils.h, so we can use that common
header on the different platforms.
 2014-06-03 12:24:34 +02:00
Martin Willi 9ee8b3b41f enum: Don't directly include enum.h 
To allow enum.h to depend on utils.h definitions, avoid its direct inclusion.
Instead include utils.h, which includes enum.h as well.
 2014-05-16 15:42:07 +02:00
Martin Willi e5d73b0dfa aead: Support custom AEAD salt sizes 
The salt, or often called implicit nonce, varies between AEAD algorithms and
their use in protocols. For IKE and ESP, GCM uses 4 bytes, while CCM uses
3 bytes. With TLS, however, AEAD mode uses 4 bytes for both GCM and CCM.

Our GCM backends currently support 4 bytes and CCM 3 bytes only. This is fine
until we go for CCM mode support in TLS, which requires 4 byte nonces.
 2014-03-31 15:56:12 +02:00
Tobias Brunner 510c900479 crypto-tester: Don't fail if key size is not supported 
The Blowfish and Twofish implementations provided by the gcrypt plugin
only support specific key lengths, which we don't know when testing
against vectors (either during unit tests or during algorithm
registration).  The on_create test with a specific key length will be
skipped anyway, so there is no point in treating this failure differently.
 2014-03-20 15:49:05 +01:00
Tobias Brunner 636076d45d unit-tests: Actually verify registered algorithms against test vectors 
Previously, the {ns}.crypto_test.on_add option had to be enabled to
actually test the algorithms, which we can't enforce for the tests in
the test_runner as the option is already read when the crypto factory
is initialized.  Even so, we wouldn't want to do this for every unit
test, which would be the result of enabling that option.
 2014-03-20 15:49:05 +01:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Thomas Egerer 568e302260 proposal: Add possibility to register custom proposal keyword parser 
If a proposal string cannot be matched to a token using strcmp (e.g. if
you want to register a whole class of algorithms containing their ID,
like my_alg_2342), you can use the provided function to register a
parser that transforms the given string into a proposal token.

Signed-off-by: Thomas Egerer <[email protected]>
 2014-01-20 16:40:34 +01:00
Andreas Steffen 146ad86be5 Prototype implementation of IKE key exchange via NTRU encryption 2013-11-27 20:21:40 +01:00
Andreas Steffen cca372465d ecc: Added ECC Brainpool ECDH groups as registered with IANA 2013-10-17 11:57:04 +02:00
Andreas Steffen 6623dfa84d Revert refactoring which broke CentOS build 2013-10-13 19:56:04 +02:00
Tobias Brunner 0c6f6c4e34 iv_gen: Mask sequential IVs with a random salt 
This makes it harder to attack a HA setup, even if the sequence numbers were
not fully in sync.
 2013-10-11 15:55:40 +02:00
Tobias Brunner e8229ad558 iv_gen: Provide external sequence number (IKE, ESP) 
This prevents duplicate sequential IVs in case of a HA failover.
 2013-10-11 15:55:40 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00
Tobias Brunner b3e1eb2afe iv_gen: Add IV generator that allocates IVs sequentially 2013-10-11 15:55:40 +02:00
Tobias Brunner 53d1f2dbfd iv_gen: Add IV generator that allocates IVs randomly 
Uses RNG_WEAK as the code currently does elsewhere to allocate IVs.
 2013-10-11 15:55:40 +02:00
Tobias Brunner 403057aa5a crypto: Add generic interface for IV generators 2013-10-11 15:55:40 +02:00
Tobias Brunner b38f7f703b apidoc: Move mac_prf to prf Doxygen group 2013-10-11 15:55:40 +02:00
Tobias Brunner ec91f15e3b crypto-factory: Try next available RNG implementation if constructor fails 2013-10-11 15:13:25 +02:00
Tobias Brunner 2e22333fbc crypto-factory: Order entries by algorithm identifier and (optionally) speed 2013-10-11 15:13:25 +02:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Tobias Brunner cfca183d55 pkcs5: Add missing break statements when checking crypto primitives 2013-07-24 16:17:22 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi e9e4759733 crypto-factory: count the number of test vector failures during registration 2013-06-21 10:53:20 +02:00
Tobias Brunner 5d52087b54 Added missing string for full-length HMAC-SHA512 signer 2013-06-10 11:48:18 +02:00
Tobias Brunner 1f2a34d6d8 Add support for untruncated HMAC-SHA-512 2013-05-08 15:02:39 +02:00
Tobias Brunner d8be7d38bf Also support 128-bit RC2 2013-05-08 15:02:39 +02:00
Tobias Brunner 199fdcadae Function added to convert a hash algorithm to an HMAC integrity algorithm 2013-05-08 15:02:39 +02:00
Tobias Brunner 047fca1169 Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner 594d847f79 PKCS#5 wrapper can decrypt PKCS#12-like schemes 2013-05-08 15:02:38 +02:00
Tobias Brunner 162c06f2f5 Fix cleanup in crypto_tester if a crypter fails 2013-05-08 15:02:38 +02:00
Tobias Brunner 9d4fc8677f Add implementation of the RC2 block cipher (RFC 2268) 2013-05-08 15:02:34 +02:00
Tobias Brunner c734c2d875 Extract function to convert ASN.1 INTEGER object to u_int64_t 2013-05-08 14:53:08 +02:00
Tobias Brunner 4076e3ee91 Extract PKCS#5 handling from pkcs8 plugin to separate helper class 2013-05-08 14:53:08 +02:00
Tobias Brunner a89ebab62e Fix cleanup in crypto_tester if AEAD implementation fails 2013-02-28 18:17:42 +01:00
Tobias Brunner ef33a4ab82 Fixed some typos, courtesy of codespell 2012-12-20 09:35:26 +01:00
Martin Willi 03ba8f9e8c Move PKCS#9 attribute lists to pkcs7 plugin, as we currently use it there only 2012-12-19 10:32:08 +01:00
Martin Willi 1865fb929a Remove unused monolithic PKCS#7 code 2012-12-19 10:32:08 +01:00
Martin Willi 67ca44ccbd Rebuild PKCS#9 encoding after adding new attributes 2012-12-19 10:32:07 +01:00
Martin Willi 60c9b5da8d Don't store additional encoding for each PKCS#9 attribute 2012-12-19 10:32:07 +01:00
Martin Willi 7f9fedc9bd Unify PKCS#9 set_attribute* methods to a single add_attribute 
This way the PKCS#9 implementation does not have to know
the encoding types for values
 2012-12-19 10:32:07 +01:00
Martin Willi c1005c120c PKCS#9 coding style cleanups 2012-12-19 10:32:07 +01:00
Martin Willi f0c02e27c4 Remove external build_encoding method in PKCS#9 2012-12-19 10:32:07 +01:00