denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,214 Commits 1 Branch 0 Tags
db0c53c20788e7375d755501b93aae382f3337cc
Commit Graph
1632 Commits
Author SHA1 Message Date
Raphael Geissert 9a7049635e pkcs11: Look for the CKA_ID of the cert if it doesn't match the subjectKeyId 
charon-nm fails to find the private key when its CKA_ID doesn't match the
subjectKeyIdentifier of the X.509 certificate.  In such cases, the private
key builder now falls back to enumerating all the certificates, looking for
one that matches the supplied subjectKeyIdentifier.  It then uses the CKA_ID
of that certificate to find the corresponding private key.

It effectively means that PKCS#11 tokens where the only identifier to relate
the certificate, the public key, and the private key is the CKA_ID are now
supported by charon-nm.

Fixes #490.
 2016-10-04 12:09:04 +02:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Andreas Steffen c54d1ef12c bliss sampler unit-test: Fixed enumeration type 2016-09-22 10:46:39 +02:00
Andreas Steffen a3a8b4acae bliss: bliss_sampler expects XOF type 2016-09-22 09:23:47 +02:00
Andreas Steffen 188b190a70 mgf1: Refactored MGF1 as an XOF 2016-09-21 06:40:52 +02:00
Tobias Brunner 15cbe526ac unbound: Avoid unnecessary cloning of RR list that caused a memory leak 2016-09-20 15:36:14 +02:00
Tobias Brunner 3a25032c16 unbound: Fix memory leak 2016-09-20 15:36:14 +02:00
Tobias Brunner fe4ed4578f padlock: Use builtin bswap32() to fix compilation on FreeBSD 
Fixes #591.
 2016-08-31 10:52:55 +02:00
Andreas Steffen 3bca51e430 unit-tests: Removed unused variable 2016-08-11 17:01:33 +02:00
Andreas Steffen 1342bd3386 unit-tests: Created newhope unit-tests 2016-08-10 14:22:00 +02:00
Andreas Steffen 393688aea0 Created newhope plugin implementing the New Hope key exchange algorithm 2016-08-10 14:22:00 +02:00
Andreas Steffen 1fddb0b92e xof: Added ChaCha20 stream as XOF 2016-08-06 12:09:05 +02:00
Andreas Steffen b8070e2c85 integrity-test: Added ntru_param_sets to read-only segment 2016-07-29 12:36:15 +02:00
Andreas Steffen 17e4ca6ac9 integrity-test: Added bliss_param_sets to read-only segment 2016-07-29 12:36:15 +02:00
Andreas Steffen 7256c68da0 integrity-test: check code and ro segments of libnttfft 2016-07-29 12:36:15 +02:00
Andreas Steffen d305f251a5 Created libnttfft 
This makes Number Theoretic Transforms (NTT) based on the efficient
Fast-Fourier-Transform (FFT) available to multiple plugins.
 2016-07-29 12:36:15 +02:00
Andreas Steffen 65f2ecb86d Share twiddle factors table between 512 and 1024 point FFT 2016-07-29 12:36:14 +02:00
Andreas Steffen 68075fb7a7 Implemented FFT with n = 1024 and q = 11289 using Montgomery arithmetic 2016-07-29 12:36:14 +02:00
Andreas Steffen a7d626118f bliss: Implemented FFT with fast Montgomery arithmetic 2016-07-29 12:36:14 +02:00
Andreas Steffen 5ff88c9622 xof: Implemented SHAKE128 and SHAKE256 Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen 04208ac5d4 xof: Defined Extended Output Functions 2016-07-29 12:36:14 +02:00
Andreas Steffen 5ce749bcfc unit-tests: Decreased loop count of FFT speed test to 10'000 2016-07-22 21:27:42 +02:00
Andreas Steffen 10ebb3c914 unit-tests: Added bliss_fft_speed test 2016-07-22 11:58:10 +02:00
Tobias Brunner 1fafc56b95 Fixed some typos, courtesy of codespell 2016-07-04 12:18:51 +02:00
Tobias Brunner 7c81219bb8 plugin-loader: Allow selective modification of the default plugin list 
This change allows selectively modifying the default plugin list by setting
the `load` setting of individual plugins (e.g. to disable them or to change
their priority) without enabling charon.load_modular and having to configure
a section and a load statement for every plugin.
 2016-06-29 11:16:48 +02:00
Tobias Brunner fedec33f5a openssl: Update GCM/crypter API to OpenSSL 1.1.0 2016-06-29 11:09:38 +02:00
Tobias Brunner 97b1a27f43 openssl: Update HMAC API to OpenSSL 1.1.0 2016-06-29 11:09:38 +02:00
Tobias Brunner cd08eb84cb openssl: Don't use deprecated RAND_pseudo_bytes() 2016-06-29 11:09:38 +02:00
Tobias Brunner 985d7b1c67 openssl: Update PKCS#12 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner a9f388e368 openssl: Update PKCS#7 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 989ba4b6cd openssl: Update CRL API to OpenSSL 1.1.0 
There is currently no way to compare the outer and inner algorithms
encoded in a parsed CRL.  X509_CRL_verify() does not seem to check that
either, though (unlike X509_verify()).
 2016-06-29 11:09:37 +02:00
Tobias Brunner 08d7e1f190 openssl: Update x509 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 6688f7986e openssl: Update ECDSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 3fb2c8edb7 openssl: Update RSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 375a5ed240 openssl: Make some utilities take const BIGNUM pointers 2016-06-29 11:09:37 +02:00
Tobias Brunner 6d5df086f7 openssl: Add macro to define fallback functions for non-opaque OpenSSL versions 2016-06-29 11:09:37 +02:00
Tobias Brunner 54d629b7ad openssl: Update DH API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 1b36fbedf5 openssl: Update crypter API to OpenSSL 1.1.0 
EVP_CIPHER and EVP_CIPHER_CTX are now opaque types, the getters already
existed before.
 2016-06-29 11:09:37 +02:00
Tobias Brunner faa904fb0b openssl: Fix mapping from ASN1 to chunk_t with OpenSSL 1.1.0 
ASN1_OBJECT is now opaque.
 2016-06-29 11:09:37 +02:00
Tobias Brunner e2abe7ae97 openssl: Update initialization and cleanup for OpenSSL 1.1.0 
We can't call OPENSSL_cleanup() as that would prevent us from
re-initializing the library again (which we use in the Android app, that
loads/unloads plugins).
 2016-06-29 11:09:36 +02:00
Tobias Brunner a6c43a8d8a openssl: OpenSSL 1.1.0 is thread-safe so we don't have to setup callbacks 2016-06-29 11:09:36 +02:00
Tobias Brunner a046f929ce android: Use non-aliased cipher identifiers 
Some of these are also understood by BoringSSL.

Fixes #1510.
 2016-06-13 10:38:20 +02:00
Tobias Brunner 9aaea4dbfe x509: Properly wrap keyid in authorityKeyIdentifier in attribute certificates 
The correct encoding got lost in bdec2e4f52 ("refactored openac and
its attribute certificate factory").

Fixes #1370.
 2016-06-06 13:46:11 +02:00
Martin Willi 294ac097d6 af-alg: Silently skip probing algorithms if AF_ALG is not supported 
If the af-alg plugin is enabled, but kernel support is missing, we get
an error line during startup for each probed algorithm. This is way too
verbose, so just skip probing if AF_ALG is unsupported.
 2016-05-19 11:13:24 +02:00
Tobias Brunner 689bb34958 curl: Add TLS support if libcurl is built against BoringSSL 
We don't have to rely on the openssl plugin and its threading
initialization as BoringSSL is thread-safe out of the box.
 2016-04-15 10:32:53 +02:00
Tobias Brunner 47a46be597 openssl: BoringSSL does not support configuration 
The other initialization functions are still defined but many are
apparently no-ops (this is also true for the threading initialization).
 2016-04-15 10:32:53 +02:00
Tobias Brunner c8a219a28d openssl: The member storing the DH exponent length has been renamed in BoringSSL 2016-04-15 10:32:53 +02:00
Tobias Brunner 77df573a95 openssl: Use proper EVP macro to determine size of a hash 2016-04-15 10:32:52 +02:00
Tobias Brunner de9b3491ad curl: Handle LibreSSL like OpenSSL in regards to multi-threading 
LibreSSL is API compatible so our openssl plugin does not need any
changes and it works fine with the curl plugin.
 2016-04-15 10:31:19 +02:00
Tobias Brunner 7316a13bd1 pkcs11: Skip zero-padding of r and s when preparing EC signature 
They are zero padded to fill the buffer.

Fixes #1377.
 2016-04-05 16:17:10 +02:00