denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,284 Commits 1 Branch 0 Tags
d305f251a53520db97c899ba1c1f40e239fb68fa
Commit Graph
1317 Commits
Author SHA1 Message Date
Andreas Steffen d305f251a5 Created libnttfft 
This makes Number Theoretic Transforms (NTT) based on the efficient
Fast-Fourier-Transform (FFT) available to multiple plugins.
 2016-07-29 12:36:15 +02:00
Andreas Steffen 65f2ecb86d Share twiddle factors table between 512 and 1024 point FFT 2016-07-29 12:36:14 +02:00
Andreas Steffen 68075fb7a7 Implemented FFT with n = 1024 and q = 11289 using Montgomery arithmetic 2016-07-29 12:36:14 +02:00
Andreas Steffen a7d626118f bliss: Implemented FFT with fast Montgomery arithmetic 2016-07-29 12:36:14 +02:00
Andreas Steffen 5ff88c9622 xof: Implemented SHAKE128 and SHAKE256 Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen 04208ac5d4 xof: Defined Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen 5ce749bcfc unit-tests: Decreased loop count of FFT speed test to 10'000 2016-07-22 21:27:42 +02:00
Andreas Steffen 10ebb3c914 unit-tests: Added bliss_fft_speed test 2016-07-22 11:58:10 +02:00
Tobias Brunner 1fafc56b95 Fixed some typos, courtesy of codespell 2016-07-04 12:18:51 +02:00
Tobias Brunner 7c81219bb8 plugin-loader: Allow selective modification of the default plugin list 
This change allows selectively modifying the default plugin list by setting
the `load` setting of individual plugins (e.g. to disable them or to change
their priority) without enabling charon.load_modular and having to configure
a section and a load statement for every plugin.
 2016-06-29 11:16:48 +02:00
Tobias Brunner fedec33f5a openssl: Update GCM/crypter API to OpenSSL 1.1.0 2016-06-29 11:09:38 +02:00
Tobias Brunner 97b1a27f43 openssl: Update HMAC API to OpenSSL 1.1.0 2016-06-29 11:09:38 +02:00
Tobias Brunner cd08eb84cb openssl: Don't use deprecated RAND_pseudo_bytes() 2016-06-29 11:09:38 +02:00
Tobias Brunner 985d7b1c67 openssl: Update PKCS#12 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner a9f388e368 openssl: Update PKCS#7 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 989ba4b6cd openssl: Update CRL API to OpenSSL 1.1.0 
There is currently no way to compare the outer and inner algorithms
encoded in a parsed CRL.  X509_CRL_verify() does not seem to check that
either, though (unlike X509_verify()).
 2016-06-29 11:09:37 +02:00
Tobias Brunner 08d7e1f190 openssl: Update x509 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 6688f7986e openssl: Update ECDSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 3fb2c8edb7 openssl: Update RSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 375a5ed240 openssl: Make some utilities take const BIGNUM pointers 2016-06-29 11:09:37 +02:00
Tobias Brunner 6d5df086f7 openssl: Add macro to define fallback functions for non-opaque OpenSSL versions 2016-06-29 11:09:37 +02:00
Tobias Brunner 54d629b7ad openssl: Update DH API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 1b36fbedf5 openssl: Update crypter API to OpenSSL 1.1.0 
EVP_CIPHER and EVP_CIPHER_CTX are now opaque types, the getters already
existed before.
 2016-06-29 11:09:37 +02:00
Tobias Brunner faa904fb0b openssl: Fix mapping from ASN1 to chunk_t with OpenSSL 1.1.0 
ASN1_OBJECT is now opaque.
 2016-06-29 11:09:37 +02:00
Tobias Brunner e2abe7ae97 openssl: Update initialization and cleanup for OpenSSL 1.1.0 
We can't call OPENSSL_cleanup() as that would prevent us from
re-initializing the library again (which we use in the Android app, that
loads/unloads plugins).
 2016-06-29 11:09:36 +02:00
Tobias Brunner a6c43a8d8a openssl: OpenSSL 1.1.0 is thread-safe so we don't have to setup callbacks 2016-06-29 11:09:36 +02:00
Tobias Brunner a046f929ce android: Use non-aliased cipher identifiers 
Some of these are also understood by BoringSSL.

Fixes #1510.
 2016-06-13 10:38:20 +02:00
Tobias Brunner 9aaea4dbfe x509: Properly wrap keyid in authorityKeyIdentifier in attribute certificates 
The correct encoding got lost in bdec2e4f52 ("refactored openac and
its attribute certificate factory").

Fixes #1370.
 2016-06-06 13:46:11 +02:00
Martin Willi 294ac097d6 af-alg: Silently skip probing algorithms if AF_ALG is not supported 
If the af-alg plugin is enabled, but kernel support is missing, we get
an error line during startup for each probed algorithm. This is way too
verbose, so just skip probing if AF_ALG is unsupported.
 2016-05-19 11:13:24 +02:00
Tobias Brunner 689bb34958 curl: Add TLS support if libcurl is built against BoringSSL 
We don't have to rely on the openssl plugin and its threading
initialization as BoringSSL is thread-safe out of the box.
 2016-04-15 10:32:53 +02:00
Tobias Brunner 47a46be597 openssl: BoringSSL does not support configuration 
The other initialization functions are still defined but many are
apparently no-ops (this is also true for the threading initialization).
 2016-04-15 10:32:53 +02:00
Tobias Brunner c8a219a28d openssl: The member storing the DH exponent length has been renamed in BoringSSL 2016-04-15 10:32:53 +02:00
Tobias Brunner 77df573a95 openssl: Use proper EVP macro to determine size of a hash 2016-04-15 10:32:52 +02:00
Tobias Brunner de9b3491ad curl: Handle LibreSSL like OpenSSL in regards to multi-threading 
LibreSSL is API compatible so our openssl plugin does not need any
changes and it works fine with the curl plugin.
 2016-04-15 10:31:19 +02:00
Tobias Brunner 7316a13bd1 pkcs11: Skip zero-padding of r and s when preparing EC signature 
They are zero padded to fill the buffer.

Fixes #1377.
 2016-04-05 16:17:10 +02:00
Andreas Steffen aaa4e478b1 Use u_int32_t legacy type in blowfish header file 2016-03-24 20:58:32 +01:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Andreas Steffen 87371460f6 vici: Support of raw public keys 2016-01-09 07:23:29 +01:00
Andreas Steffen a78e1c3b11 128 bit default security strength for IKE and ESP algorithms 
The default ESP cipher suite is now
    AES_CBC-128/HMAC_SHA2_256_128
and requires SHA-2 HMAC support in the Linux kernel (correctly implemented
since 2.6.33).

The default IKE cipher suite is now
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
if the openssl plugin is loaded or
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
if ECC is not available.

The use of the SHA-1 hash algorithm and the MODP_2048 DH group has been
deprecated and ENCR_CHACHA20_POLY1305 has been added to the default
IKE AEAD algorithms.
 2015-12-17 17:49:48 +01:00
Andreas Steffen 5e2b740a00 128 bit default security strength requires 3072 bit prime DH group 2015-12-14 10:39:40 +01:00
Andreas Steffen ef43df6cbe Allow msSmartcardLogon EKU to be built 2015-12-11 18:26:54 +01:00
Andreas Steffen fd90f0613c Print OCSP single responses 2015-12-11 18:26:53 +01:00
Martin Willi 8fa0c7bc77 byteorder: Add 32-bit unaligned little-endian conversion functions 2015-12-04 10:29:09 +01:00
Tobias Brunner e161238e8e revocation: Allow CRLs to be encoded in PEM format 
Since the textual representation for a CRL is now standardized
in RFC 7468 one could argue that we should accept that too, even
though RFC 5280 explicitly demands CRLs fetched via HTTP/FTP to
be in DER format.  But in particular for file URIs enforcing that
seems inconvenient.

Fixes #1203.
 2015-11-12 14:40:44 +01:00
Tobias Brunner 15d715dace curl: Be less strict when considering status codes as errors 
For file:// URIs the code is 0 on success. We now do the same libcurl
would do with CURLOPT_FAILONERROR enabled.

Fixes #1203.
 2015-11-12 14:40:37 +01:00
Tobias Brunner 305c4aa82c plugin-loader: Optionally use RTLD_NOW with dlopen() 
This can be useful when writing custom plugins as typos or missing
linker flags that result in unresolved symbols in the shared object
could otherwise cause late crashes.  In particular, if such a symbol
is used in a code path that is rarely executed.  During development
and testing using RTLD_NOW instead of RTLD_LAZY will prevent the
plugin from getting loaded and makes the error visible immediately.
 2015-11-09 14:37:08 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Andreas Steffen 83c1883d0b Use word-aligned XOR in sha3_absorb() 2015-11-03 21:35:09 +01:00
Andreas Steffen f6fede934b Support BLISS signatures with SHA-3 hash 2015-11-03 21:35:09 +01:00
Andreas Steffen a488584b5f Implemented SHA-3 hash algorithm including test vectors 2015-11-03 21:35:09 +01:00