From 95337e666ccc766ecf5726ee5e1d8ce1467d6597 Mon Sep 17 00:00:00 2001 From: John Safranek Date: Wed, 12 Aug 2020 14:43:47 -0700 Subject: [PATCH] Release Update 1. Update the usual versions. 2. Update README and ChangeLog. 3. Modify genecc and renewcerts to update two certificate files that had expired. 4. Update the expired certificate files. --- ChangeLog.md | 114 ++++++++++++++++++-- README | 202 +++++++++++++++++++----------------- README.md | 202 +++++++++++++++++++----------------- certs/ecc/genecc.sh | 4 + certs/renewcerts.sh | 3 + certs/server-cert-chain.der | Bin 2384 -> 2543 bytes certs/server-ecc-self.der | Bin 788 -> 787 bytes configure.ac | 4 +- wolfssl.rc | Bin 4918 -> 4918 bytes wolfssl/version.h | 4 +- 10 files changed, 325 insertions(+), 208 deletions(-) diff --git a/ChangeLog.md b/ChangeLog.md index 897809aca..f63ee918f 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,25 +1,123 @@ -# wolfSSL Release 4.4.1 (XX/XX/2020) **IN DEVELOPMENT** +# wolfSSL Release 4.5.0 (August 13, 2020) -If you have questions about this release, then feel free to contact us on our +If you have questions about this release, feel free to contact us on our info@ address. -Release 4.4.1 of wolfSSL embedded TLS has bug fixes and new features including: +Release 4.5.0 of wolfSSL embedded TLS has bug fixes and new features including: ## New Feature Additions - * Place holder. +* Added Xilinx Vitis 2019.2 example and README updates +* TLS v1.3 is now enabled by default +* Building FIPS 140-2 code and test on Solaris +* Secure renegotiation with DTLS 1.2 +* Update RSA calls for hardware acceleration with Xilsecure +* Additional OpenSSL compatibility layer functions added +* Cypress PSoC6 wolfCrypt driver added +* Added STM32CubeIDE support +* Added certificate parsing and inspection to C# wrapper layer +* TLS v1.3 sniffer support added +* TSIP v1.09 for target board GR-ROSE support added +* Added support for the "X72N Envision Kit" evaluation board +* Support for ECC nonblocking using the configure options + "--enable-ecc=nonblock --enable-sp=yes,nonblock CFLAGS=-DWOLFSSL_PUBLIC_MP" +* Added wc_curve25519_make_pub function to generate a public key given the + private one ## Fixes - * Place holder. +* PIC32MZ hardware cache and large hashes fix +* AES-GCM use with EVP layer in compatibility layer code +* Fix for RSA_LOW_MEM with ARM build of SP code +* Sanity check on tag length with AES-CCM to conform with RFC 3610 +* Fixes for 32 and 64 bit software implementations of SP code when + WOLFSSL_SP_CACHE_RESISTANT is defined +* GCC warning fixes for GCC 9 and later +* Sanity check on HKDF expand length to conform with RFC 5869 +* Fixes for STM32 CubeMX HAL with AES-GCM +* Fixed point cache look up table (LUT) implementation fixes +* Fix for ARM 32bit SP code when calling div word +* Fix for potential out of bounds read when parsing CRLs +* Fix for potential out of bounds read with RSA unpadding +* AES-CCM optimized counter fix +* Updates to Xcode projects for new files and features +* Fix for adding CRL’s to a WOLFSSL_X509_STORE structure +* FIPSv2 build with opensslall build fixes +* Fixes for CryptoCell use with ECC and signature wrappers +* Fix for mod calculation with SP code dealing with 3072 bit keys +* Fix for handling certificates with multiple OU’s in name +* Fix for SP math implementation of sp_add_d and add a sanity check on + rshb range +* Fix for sanity check on padding with DES3 conversion of PEM to DER +* Sanity check for potential out of bounds read with fp_read_radix_16 ## Improvements/Optimizations - * Place holder. +* TLS 1.3 certificate verify update to handle 8192 bit RSA keys +* wpa_supplicant support with reduced code size option +* TLS 1.3 alerts encrypted when possible +* Many minor coverity fixes added +* Error checking when parsing PKCS12 DER +* IAR warning in test.c resolved +* ATECC608A improvements for use with Harmony 3 and PIC32 MZ +* Support for AES-GCM and wc_SignatureVerifyHash with static memory and no + malloc’s +* Enable SNI by default with JNI/JSSE builds +* NetBSD GCC compiler warnings resolved +* Additional test cases and code coverage added including curve25519 and + curve448 tests +* Option for user defined mutexes with WOLFSSL_USER_MUTEX +* Sniffer API’s for loading buffer directly +* Fixes and improvements from going through the DO-178 process were added +* Doxygen updates and fixes for auto documentation generation -## This release of wolfSSL includes fixes for X security vulnerabilities. +## This release of wolfSSL includes fixes for 5 security vulnerabilities. - * Place holder. +wolfSSL version 4.5.0 contains 5 vulnerability fixes: 2 fixes for TLS 1.3, +2 side channel attack mitigations, and 1 fix for a potential private key +leak in a specific use case. + +* In earlier versions of wolfSSL there exists a potential man in the middle + attack on TLS 1.3 clients. Malicious attackers with a privileged network + position can impersonate TLS 1.3 servers and bypass authentication. Users + that have applications with client side code and have TLS 1.3 turned on, + should update to the latest version of wolfSSL. Users that do not have + TLS 1.3 turned on, or that are server side only, are NOT affected by this + report. Thanks to Gerald Doussot from NCC group for the report. +* Denial of service attack on TLS 1.3 servers from repetitively sending + ChangeCipherSpecs messages. This denial of service results from the + relatively low effort of sending a ChangeCipherSpecs message versus the + effort of the server to process that message. Users with TLS 1.3 servers are + recommended to update to the most recent version of wolfSSL which limits the + number of TLS 1.3 ChangeCipherSpecs that can be received in order to avoid + this DoS attack. CVE-2020-12457 was reserved for the report. Thanks to + Lenny Wang of Tencent Security Xuanwu LAB. +* Potential cache timing attacks on public key operations in builds that are + not using SP (single precision). Users that have a system where malicious + agents could execute code on the system, are not using the SP build with + wolfSSL, and are doing private key operations on the system (such as signing + with a private key) are recommended to regenerate private keys and update to + the most recent version of wolfSSL. CVE-2020-15309 is reserved for this + issue. Thanks to Ida Bruhns from Universität zu Lübeck for the report. +* When using SGX with EC scalar multiplication the possibility of side-channel + attacks are present. To mitigate the risk of side channel attacks wolfSSL’s + single precision EC operations should be used instead. Release 4.5.0 turns + this on be default now with SGX builds and in previous versions of wolfSSL + this can be turned on by using the WOLFSSL_SP macros. Thank you to + Alejandro Cabrera Aldaya, Cesar Pereida García and Billy Bob Brumley from + the Network and Information Security Group (NISEC) at Tampere University for + the report. +* Leak of private key in the case that PEM format private keys are bundled in + with PEM certificates into a single file. This is due to the + misclassification of certificate type versus private key type when parsing + through the PEM file. To be affected, wolfSSL would need to have been built + with OPENSSL_EXTRA (--enable-opensslextra). Some build variants such as + --enable-all and --enable-opensslall also turn on this code path, checking + wolfssl/options.h for OPENSSL_EXTRA will show if the macro was used with the + build. If having built with the opensslextra enable option and having placed + PEM certificates with PEM private keys in the same file when loading up the + certificate file, then we recommend updating wolfSSL for this use case and + also recommend regenerating any private keys in the file. For additional vulnerability information visit the vulnerability page at https://www.wolfssl.com/docs/security-vulnerabilities/ diff --git a/README b/README index a5b36246a..e8ceea102 100644 --- a/README +++ b/README @@ -73,120 +73,126 @@ should be used for the enum name. *** end Notes *** -# wolfSSL Release 4.4.0 (04/22/2020) +# wolfSSL Release 4.5.0 (August 13, 2020) If you have questions about this release, feel free to contact us on our info@ address. -Release 4.4.0 of wolfSSL embedded TLS has bug fixes and new features including: +Release 4.5.0 of wolfSSL embedded TLS has bug fixes and new features including: ## New Feature Additions -* Hexagon support. -* DSP builds to offload ECC verify operations. -* Certificate Manager callback support. -* New APIs for running updates to ChaCha20/Poly1305 AEAD. -* Support for use with Apache. -* Add support for IBM s390x. -* PKCS8 support for ED25519. -* OpenVPN support. -* Add P384 curve support to SP. -* Add BIO and EVP API. -* Add AES-OFB mode. -* Add AES-CFB mode. -* Add Curve448, X448, and Ed448. -* Add Renesas Synergy S7G2 build and hardware acceleration. +* Added Xilinx Vitis 2019.2 example and README updates +* TLS v1.3 is now enabled by default +* Building FIPS 140-2 code and test on Solaris +* Secure renegotiation with DTLS 1.2 +* Update RSA calls for hardware acceleration with Xilsecure +* Additional OpenSSL compatibility layer functions added +* Cypress PSoC6 wolfCrypt driver added +* Added STM32CubeIDE support +* Added certificate parsing and inspection to C# wrapper layer +* TLS v1.3 sniffer support added +* TSIP v1.09 for target board GR-ROSE support added +* Added support for the "X72N Envision Kit" evaluation board +* Support for ECC nonblocking using the configure options + "--enable-ecc=nonblock --enable-sp=yes,nonblock CFLAGS=-DWOLFSSL_PUBLIC_MP" +* Added wc_curve25519_make_pub function to generate a public key given the + private one ## Fixes -* Fix for RSA public encrypt / private sign with RSA key sizes over 2048-bit. -* Correct misspellings. -* Secure renegotiation fix. -* Fix memory leak when using ATECC and non-SECP256R1 curves for sign, verify, - or shared secret. -* Fix for K64 MMCAU with `WOLFSSL_SMALL_STACK_CACHE`. -* Fix the RSA verify only build. -* Fix in SP C implementation for small stack. -* Fix using the auth key id extension is set, hash might not be present. -* Fix when flattening certificate structure to include the subject alt names. -* Fixes for building with ECC sign/verify only. -* Fix for ECC and no cache resistance. -* Fix memory leak in DSA. -* Fix build on minGW. -* Fix `PemToDer()` call in `ProcessBuffer()` to set more than ECC. -* Fix for using RSA without SHA-512. -* Add some close tags to the echoserver HTTP example output. -* Miscellaneous fixes and updates for static analysis reports. -* Fixes for time structure support. -* Fixes for VxWorks support. -* Fixes for Async crypto support. -* Fix cache resist compile to work with SP C code. -* Fixes for Curve25519 x64 asm. -* Fix for SP x64 div. -* Fix for DTLS edge case where CCS and Finished come out of order and the - retransmit pool gets flushed. -* Fix for infinite loop in SHA-1 with small inputs. Thanks to Peter W. -* Fix for FIPS Hmac where `wc_HmacInit()` isn't used. `wc_HmacSetKey()` needs - to initialize the Hmac structure. Type is set to NONE, and checked against - NONE, not 0. -* Fixes for SP RSA private operations. -* Fixes for Xilinx SDK and Zynq UltraScale+ MPSoC -* Fix leak when building with HAVE_AESGCM and NO_AES_DECRYPT. Thanks G.G. -* Fixes for building ECC without ASN. -* Fix for async TLSv1.3 issues. -* Fix `wc_KeyPemToDer()` with PKCS1 and empty key. -* Omit `-fomit-frame-pointer` from CFLAGS in configure.ac. +* PIC32MZ hardware cache and large hashes fix +* AES-GCM use with EVP layer in compatibility layer code +* Fix for RSA_LOW_MEM with ARM build of SP code +* Sanity check on tag length with AES-CCM to conform with RFC 3610 +* Fixes for 32 and 64 bit software implementations of SP code when + WOLFSSL_SP_CACHE_RESISTANT is defined +* GCC warning fixes for GCC 9 and later +* Sanity check on HKDF expand length to conform with RFC 5869 +* Fixes for STM32 CubeMX HAL with AES-GCM +* Fixed point cache look up table (LUT) implementation fixes +* Fix for ARM 32bit SP code when calling div word +* Fix for potential out of bounds read when parsing CRLs +* Fix for potential out of bounds read with RSA unpadding +* AES-CCM optimized counter fix +* Updates to Xcode projects for new files and features +* Fix for adding CRL’s to a WOLFSSL_X509_STORE structure +* FIPSv2 build with opensslall build fixes +* Fixes for CryptoCell use with ECC and signature wrappers +* Fix for mod calculation with SP code dealing with 3072 bit keys +* Fix for handling certificates with multiple OU’s in name +* Fix for SP math implementation of sp_add_d and add a sanity check on + rshb range +* Fix for sanity check on padding with DES3 conversion of PEM to DER +* Sanity check for potential out of bounds read with fp_read_radix_16 ## Improvements/Optimizations -* Qt 5.12 and 5.13 support. -* Added more digest types to Cryptocell RSA sign/verify. -* Some memory usage improvements. -* Speed improvements for mp_rand. -* Improvements to CRL and OCSP support. -* Refactor Poly1305 AEAD/MAC to reduce duplicate code. -* Add blinding to RSA key gen. -* Improvements to blinding. -* Improvement and expansion of OpenSSL Compatibility Layer. -* Improvements to ChaCha20. -* Improvements to X.509 processing. -* Improvements to ECC support. -* Improvement in detecting 64-bit support. -* Refactor to combine duplicate ECC parameter parsing code. -* Improve keyFormat to be set by algId and let later key parsing produce fail. -* Add test cases for 3072-bit and 4096-bit RSA keys. -* Improve signature wrapper and DH test cases. -* Improvements to the configure.ac script. -* Added constant time RSA q modinv p. -* Improve performance of SP Intel 64-bit asm. -* Added a few more functions to the ABI list. -* Improve TLS bidirectional shutdown behavior. -* OpenSSH 8.1 support. -* Improve performance of RSA/DH operations on x64. -* Add support for PKCS7/CMS Enveloped data with fragmented encrypted content. -* Example linker description for FIPS builds to enforce object ordering. -* C# wrapper improvements. Added TLS client example and TLSv1.3 methods. -* Allow setting MTU in DTLS. -* Improve PKCS12 create for outputting encrypted bundles. -* Constant time EC map to affine for private operations. -* Improve performance of RSA public key ops with TFM. -* Smaller table version of AES encrypt/decrypt. -* Support IAR with position independent code (ROPI). -* Improve speed of AArch64 assembly. -* Support AES-CTR on esp32. -* Add a no malloc option for small SP math. +* TLS 1.3 certificate verify update to handle 8192 bit RSA keys +* wpa_supplicant support with reduced code size option +* TLS 1.3 alerts encrypted when possible +* Many minor coverity fixes added +* Error checking when parsing PKCS12 DER +* IAR warning in test.c resolved +* ATECC608A improvements for use with Harmony 3 and PIC32 MZ +* Support for AES-GCM and wc_SignatureVerifyHash with static memory and no + malloc’s +* Enable SNI by default with JNI/JSSE builds +* NetBSD GCC compiler warnings resolved +* Additional test cases and code coverage added including curve25519 and + curve448 tests +* Option for user defined mutexes with WOLFSSL_USER_MUTEX +* Sniffer API’s for loading buffer directly +* Fixes and improvements from going through the DO-178 process were added +* Doxygen updates and fixes for auto documentation generation -## This release of wolfSSL includes fixes for 2 security vulnerabilities. +## This release of wolfSSL includes fixes for 5 security vulnerabilities. -* For fast math, use a constant time modular inverse when mapping to affine - when operation involves a private key - keygen, calc shared secret, sign. - Thank you to Alejandro Cabrera Aldaya, Cesar Pereida García and - Billy Bob Brumley from the Network and Information Security Group (NISEC) - at Tampere University for the report. +wolfSSL version 4.5.0 contains 5 vulnerability fixes: 2 fixes for TLS 1.3, +2 side channel attack mitigations, and 1 fix for a potential private key +leak in a specific use case. -* Change constant time and cache resistant ECC mulmod. Ensure points being - operated on change to make constant time. Thank you to Pietro Borrello at - Sapienza University of Rome. +* In earlier versions of wolfSSL there exists a potential man in the middle + attack on TLS 1.3 clients. Malicious attackers with a privileged network + position can impersonate TLS 1.3 servers and bypass authentication. Users + that have applications with client side code and have TLS 1.3 turned on, + should update to the latest version of wolfSSL. Users that do not have + TLS 1.3 turned on, or that are server side only, are NOT affected by this + report. Thanks to Gerald Doussot from NCC group for the report. +* Denial of service attack on TLS 1.3 servers from repetitively sending + ChangeCipherSpecs messages. This denial of service results from the + relatively low effort of sending a ChangeCipherSpecs message versus the + effort of the server to process that message. Users with TLS 1.3 servers are + recommended to update to the most recent version of wolfSSL which limits the + number of TLS 1.3 ChangeCipherSpecs that can be received in order to avoid + this DoS attack. CVE-2020-12457 was reserved for the report. Thanks to + Lenny Wang of Tencent Security Xuanwu LAB. +* Potential cache timing attacks on public key operations in builds that are + not using SP (single precision). Users that have a system where malicious + agents could execute code on the system, are not using the SP build with + wolfSSL, and are doing private key operations on the system (such as signing + with a private key) are recommended to regenerate private keys and update to + the most recent version of wolfSSL. CVE-2020-15309 is reserved for this + issue. Thanks to Ida Bruhns from Universität zu Lübeck for the report. +* When using SGX with EC scalar multiplication the possibility of side-channel + attacks are present. To mitigate the risk of side channel attacks wolfSSL’s + single precision EC operations should be used instead. Release 4.5.0 turns + this on be default now with SGX builds and in previous versions of wolfSSL + this can be turned on by using the WOLFSSL_SP macros. Thank you to + Alejandro Cabrera Aldaya, Cesar Pereida García and Billy Bob Brumley from + the Network and Information Security Group (NISEC) at Tampere University for + the report. +* Leak of private key in the case that PEM format private keys are bundled in + with PEM certificates into a single file. This is due to the + misclassification of certificate type versus private key type when parsing + through the PEM file. To be affected, wolfSSL would need to have been built + with OPENSSL_EXTRA (--enable-opensslextra). Some build variants such as + --enable-all and --enable-opensslall also turn on this code path, checking + wolfssl/options.h for OPENSSL_EXTRA will show if the macro was used with the + build. If having built with the opensslextra enable option and having placed + PEM certificates with PEM private keys in the same file when loading up the + certificate file, then we recommend updating wolfSSL for this use case and + also recommend regenerating any private keys in the file. For additional vulnerability information visit the vulnerability page at https://www.wolfssl.com/docs/security-vulnerabilities/ diff --git a/README.md b/README.md index a5b36246a..e8ceea102 100644 --- a/README.md +++ b/README.md @@ -73,120 +73,126 @@ should be used for the enum name. *** end Notes *** -# wolfSSL Release 4.4.0 (04/22/2020) +# wolfSSL Release 4.5.0 (August 13, 2020) If you have questions about this release, feel free to contact us on our info@ address. -Release 4.4.0 of wolfSSL embedded TLS has bug fixes and new features including: +Release 4.5.0 of wolfSSL embedded TLS has bug fixes and new features including: ## New Feature Additions -* Hexagon support. -* DSP builds to offload ECC verify operations. -* Certificate Manager callback support. -* New APIs for running updates to ChaCha20/Poly1305 AEAD. -* Support for use with Apache. -* Add support for IBM s390x. -* PKCS8 support for ED25519. -* OpenVPN support. -* Add P384 curve support to SP. -* Add BIO and EVP API. -* Add AES-OFB mode. -* Add AES-CFB mode. -* Add Curve448, X448, and Ed448. -* Add Renesas Synergy S7G2 build and hardware acceleration. +* Added Xilinx Vitis 2019.2 example and README updates +* TLS v1.3 is now enabled by default +* Building FIPS 140-2 code and test on Solaris +* Secure renegotiation with DTLS 1.2 +* Update RSA calls for hardware acceleration with Xilsecure +* Additional OpenSSL compatibility layer functions added +* Cypress PSoC6 wolfCrypt driver added +* Added STM32CubeIDE support +* Added certificate parsing and inspection to C# wrapper layer +* TLS v1.3 sniffer support added +* TSIP v1.09 for target board GR-ROSE support added +* Added support for the "X72N Envision Kit" evaluation board +* Support for ECC nonblocking using the configure options + "--enable-ecc=nonblock --enable-sp=yes,nonblock CFLAGS=-DWOLFSSL_PUBLIC_MP" +* Added wc_curve25519_make_pub function to generate a public key given the + private one ## Fixes -* Fix for RSA public encrypt / private sign with RSA key sizes over 2048-bit. -* Correct misspellings. -* Secure renegotiation fix. -* Fix memory leak when using ATECC and non-SECP256R1 curves for sign, verify, - or shared secret. -* Fix for K64 MMCAU with `WOLFSSL_SMALL_STACK_CACHE`. -* Fix the RSA verify only build. -* Fix in SP C implementation for small stack. -* Fix using the auth key id extension is set, hash might not be present. -* Fix when flattening certificate structure to include the subject alt names. -* Fixes for building with ECC sign/verify only. -* Fix for ECC and no cache resistance. -* Fix memory leak in DSA. -* Fix build on minGW. -* Fix `PemToDer()` call in `ProcessBuffer()` to set more than ECC. -* Fix for using RSA without SHA-512. -* Add some close tags to the echoserver HTTP example output. -* Miscellaneous fixes and updates for static analysis reports. -* Fixes for time structure support. -* Fixes for VxWorks support. -* Fixes for Async crypto support. -* Fix cache resist compile to work with SP C code. -* Fixes for Curve25519 x64 asm. -* Fix for SP x64 div. -* Fix for DTLS edge case where CCS and Finished come out of order and the - retransmit pool gets flushed. -* Fix for infinite loop in SHA-1 with small inputs. Thanks to Peter W. -* Fix for FIPS Hmac where `wc_HmacInit()` isn't used. `wc_HmacSetKey()` needs - to initialize the Hmac structure. Type is set to NONE, and checked against - NONE, not 0. -* Fixes for SP RSA private operations. -* Fixes for Xilinx SDK and Zynq UltraScale+ MPSoC -* Fix leak when building with HAVE_AESGCM and NO_AES_DECRYPT. Thanks G.G. -* Fixes for building ECC without ASN. -* Fix for async TLSv1.3 issues. -* Fix `wc_KeyPemToDer()` with PKCS1 and empty key. -* Omit `-fomit-frame-pointer` from CFLAGS in configure.ac. +* PIC32MZ hardware cache and large hashes fix +* AES-GCM use with EVP layer in compatibility layer code +* Fix for RSA_LOW_MEM with ARM build of SP code +* Sanity check on tag length with AES-CCM to conform with RFC 3610 +* Fixes for 32 and 64 bit software implementations of SP code when + WOLFSSL_SP_CACHE_RESISTANT is defined +* GCC warning fixes for GCC 9 and later +* Sanity check on HKDF expand length to conform with RFC 5869 +* Fixes for STM32 CubeMX HAL with AES-GCM +* Fixed point cache look up table (LUT) implementation fixes +* Fix for ARM 32bit SP code when calling div word +* Fix for potential out of bounds read when parsing CRLs +* Fix for potential out of bounds read with RSA unpadding +* AES-CCM optimized counter fix +* Updates to Xcode projects for new files and features +* Fix for adding CRL’s to a WOLFSSL_X509_STORE structure +* FIPSv2 build with opensslall build fixes +* Fixes for CryptoCell use with ECC and signature wrappers +* Fix for mod calculation with SP code dealing with 3072 bit keys +* Fix for handling certificates with multiple OU’s in name +* Fix for SP math implementation of sp_add_d and add a sanity check on + rshb range +* Fix for sanity check on padding with DES3 conversion of PEM to DER +* Sanity check for potential out of bounds read with fp_read_radix_16 ## Improvements/Optimizations -* Qt 5.12 and 5.13 support. -* Added more digest types to Cryptocell RSA sign/verify. -* Some memory usage improvements. -* Speed improvements for mp_rand. -* Improvements to CRL and OCSP support. -* Refactor Poly1305 AEAD/MAC to reduce duplicate code. -* Add blinding to RSA key gen. -* Improvements to blinding. -* Improvement and expansion of OpenSSL Compatibility Layer. -* Improvements to ChaCha20. -* Improvements to X.509 processing. -* Improvements to ECC support. -* Improvement in detecting 64-bit support. -* Refactor to combine duplicate ECC parameter parsing code. -* Improve keyFormat to be set by algId and let later key parsing produce fail. -* Add test cases for 3072-bit and 4096-bit RSA keys. -* Improve signature wrapper and DH test cases. -* Improvements to the configure.ac script. -* Added constant time RSA q modinv p. -* Improve performance of SP Intel 64-bit asm. -* Added a few more functions to the ABI list. -* Improve TLS bidirectional shutdown behavior. -* OpenSSH 8.1 support. -* Improve performance of RSA/DH operations on x64. -* Add support for PKCS7/CMS Enveloped data with fragmented encrypted content. -* Example linker description for FIPS builds to enforce object ordering. -* C# wrapper improvements. Added TLS client example and TLSv1.3 methods. -* Allow setting MTU in DTLS. -* Improve PKCS12 create for outputting encrypted bundles. -* Constant time EC map to affine for private operations. -* Improve performance of RSA public key ops with TFM. -* Smaller table version of AES encrypt/decrypt. -* Support IAR with position independent code (ROPI). -* Improve speed of AArch64 assembly. -* Support AES-CTR on esp32. -* Add a no malloc option for small SP math. +* TLS 1.3 certificate verify update to handle 8192 bit RSA keys +* wpa_supplicant support with reduced code size option +* TLS 1.3 alerts encrypted when possible +* Many minor coverity fixes added +* Error checking when parsing PKCS12 DER +* IAR warning in test.c resolved +* ATECC608A improvements for use with Harmony 3 and PIC32 MZ +* Support for AES-GCM and wc_SignatureVerifyHash with static memory and no + malloc’s +* Enable SNI by default with JNI/JSSE builds +* NetBSD GCC compiler warnings resolved +* Additional test cases and code coverage added including curve25519 and + curve448 tests +* Option for user defined mutexes with WOLFSSL_USER_MUTEX +* Sniffer API’s for loading buffer directly +* Fixes and improvements from going through the DO-178 process were added +* Doxygen updates and fixes for auto documentation generation -## This release of wolfSSL includes fixes for 2 security vulnerabilities. +## This release of wolfSSL includes fixes for 5 security vulnerabilities. -* For fast math, use a constant time modular inverse when mapping to affine - when operation involves a private key - keygen, calc shared secret, sign. - Thank you to Alejandro Cabrera Aldaya, Cesar Pereida García and - Billy Bob Brumley from the Network and Information Security Group (NISEC) - at Tampere University for the report. +wolfSSL version 4.5.0 contains 5 vulnerability fixes: 2 fixes for TLS 1.3, +2 side channel attack mitigations, and 1 fix for a potential private key +leak in a specific use case. -* Change constant time and cache resistant ECC mulmod. Ensure points being - operated on change to make constant time. Thank you to Pietro Borrello at - Sapienza University of Rome. +* In earlier versions of wolfSSL there exists a potential man in the middle + attack on TLS 1.3 clients. Malicious attackers with a privileged network + position can impersonate TLS 1.3 servers and bypass authentication. Users + that have applications with client side code and have TLS 1.3 turned on, + should update to the latest version of wolfSSL. Users that do not have + TLS 1.3 turned on, or that are server side only, are NOT affected by this + report. Thanks to Gerald Doussot from NCC group for the report. +* Denial of service attack on TLS 1.3 servers from repetitively sending + ChangeCipherSpecs messages. This denial of service results from the + relatively low effort of sending a ChangeCipherSpecs message versus the + effort of the server to process that message. Users with TLS 1.3 servers are + recommended to update to the most recent version of wolfSSL which limits the + number of TLS 1.3 ChangeCipherSpecs that can be received in order to avoid + this DoS attack. CVE-2020-12457 was reserved for the report. Thanks to + Lenny Wang of Tencent Security Xuanwu LAB. +* Potential cache timing attacks on public key operations in builds that are + not using SP (single precision). Users that have a system where malicious + agents could execute code on the system, are not using the SP build with + wolfSSL, and are doing private key operations on the system (such as signing + with a private key) are recommended to regenerate private keys and update to + the most recent version of wolfSSL. CVE-2020-15309 is reserved for this + issue. Thanks to Ida Bruhns from Universität zu Lübeck for the report. +* When using SGX with EC scalar multiplication the possibility of side-channel + attacks are present. To mitigate the risk of side channel attacks wolfSSL’s + single precision EC operations should be used instead. Release 4.5.0 turns + this on be default now with SGX builds and in previous versions of wolfSSL + this can be turned on by using the WOLFSSL_SP macros. Thank you to + Alejandro Cabrera Aldaya, Cesar Pereida García and Billy Bob Brumley from + the Network and Information Security Group (NISEC) at Tampere University for + the report. +* Leak of private key in the case that PEM format private keys are bundled in + with PEM certificates into a single file. This is due to the + misclassification of certificate type versus private key type when parsing + through the PEM file. To be affected, wolfSSL would need to have been built + with OPENSSL_EXTRA (--enable-opensslextra). Some build variants such as + --enable-all and --enable-opensslall also turn on this code path, checking + wolfssl/options.h for OPENSSL_EXTRA will show if the macro was used with the + build. If having built with the opensslextra enable option and having placed + PEM certificates with PEM private keys in the same file when loading up the + certificate file, then we recommend updating wolfSSL for this use case and + also recommend regenerating any private keys in the file. For additional vulnerability information visit the vulnerability page at https://www.wolfssl.com/docs/security-vulnerabilities/ diff --git a/certs/ecc/genecc.sh b/certs/ecc/genecc.sh index 2efb033c9..025072b38 100755 --- a/certs/ecc/genecc.sh +++ b/certs/ecc/genecc.sh @@ -34,6 +34,10 @@ openssl x509 -req -in ./certs/server-ecc-req.pem -CA ./certs/ca-ecc-cert.pem -CA openssl ca -config ./certs/ecc/wolfssl.cnf -extensions server_cert -days 3650 -notext -md sha256 -in ./certs/server-ecc-req.pem -out ./certs/server-ecc.pem openssl x509 -in ./certs/server-ecc.pem -outform der -out ./certs/server-ecc.der +# Generate ECC 256-bit self-signed server cert +openssl x509 -req -in ./certs/server-ecc-req.pem -days 3650 -extfile ./certs/ecc/wolfssl.cnf -extensions server_cert -signkey ./certs/ecc-key.pem -text -out ./certs/server-ecc-self.pem +openssl x509 -inform pem -in ./certs/server-ecc-self.pem -outform der -out ./certs/server-ecc-self.der + rm ./certs/server-ecc-req.pem diff --git a/certs/renewcerts.sh b/certs/renewcerts.sh index 43c871825..f545162cf 100755 --- a/certs/renewcerts.sh +++ b/certs/renewcerts.sh @@ -14,6 +14,7 @@ # ca-ecc384-cert.der # server-cert.pem # server-cert.der +# server-cert-chain.der # server-ecc-rsa.pem # server-ecc.pem # 1024/client-cert.der @@ -497,6 +498,8 @@ run_renewcerts(){ check_result $? "Der Cert 11" openssl x509 -inform PEM -in server-ecc-comp.pem -outform DER -out server-ecc-comp.der check_result $? "Der Cert 12" + cat certs/server-cert.der certs/ca-cert.der >certs/server-cert-chain.der + check_result $? "Der Cert 13" echo "End of section" echo "---------------------------------------------------------------------" diff --git a/certs/server-cert-chain.der b/certs/server-cert-chain.der index 37a1929b63cf3ae7bff4b9cee1ad72a52580d2be..74df3d2a1372d35a60562961c949e823c630cfb9 100644 GIT binary patch delta 949 zcmca0^j?_5po!&$K@;<983$$MLgoEfjux zRhv0o)PM)1Oqhk$fSHl;zkv*hC&(gdAl$^AT9KGrkdvyHoS)myQqRD^XdnxcRb>$~ z5MkrcW@BV!WoKrDvzQEc**LY@JlekVGBR?rGB7tWGBTJ>d{%UZ`=fim?c@5`ApPbY z8?AG%tr4y)5&6&F`>v!s<^PUm*~W&J-4?(4KbLAMpL@!=Lbz3ATb8MTj?58$<@8r? zPft9;`uI)uKEeGrXRV$rKL5$A$Scp!oV(L3@b&Dy>!zjNtE#GYF)i4z^-f?HBJyU+GM|8nQwrs-Y*FF4&y_I_C{ z)xXzQCR<^jOwXyb8M~O%Kgrn0F@Eqp*4mW6((}7?ZT9W5mg3!FNApTnSO1oIIdQjU zvCKX7E$P+*fnUU5@32@f>$Q1wS-+)_rRl{}{|>1AE)I~>-Fa!(QytTOSpFL{ zF+X1*#mvOW#Dp~xCJL;Q#uLYz>sj|R3PR%+5(#`PVl0yj*+uyb8V5x@?|eJOj-gn0 z=|z^!^}p|Y*v@Oac3O$gr1Z79HIHUy8K2t3&l0sX{l{Z&+pia*1$MUc0adi%JXKuJ`D0q18%D@HU=bLpxTOM4U zw1CxW{*KZg(oerH$$7a-wOewso4md8dUwt9)!mWmudn-;oi>*I760yr@Jk-{wblpf z1+G7N`{K6PL-{53Vm5oP3x2v{wQ}~Y+O{X^32nuw}?aR^m%$k3?p;c`A+b0>n Kw{0`*ss#XE&UHor delta 782 zcmaDad_joApowLkK@)S^M2=1JhGqs9hK5E42Ij`*QR2LYmIkH<7ErE1zq%e^@<+Rz8$`aEthvf+W)00b41=Z zep<46=E^Kjg{7AYpUc?HWIyiy=f$)wU!4rjSu%QGJoIAE)Ry*hp|R8FpRf2FHhU>Y z?wW5)V~)J9x6`s*=Aoupt^45YvYv1c?%jq)hxXre_HkF0Xk2m9xXE$$uEe(MEtADn zRLxHLCTIIkt-O)&KhJNnt0Y){zdECnF?;jML(^^?JQG#-op&C`gSndBEpGjnCuX^A-BA^D#y^yC$1INp zQ=Ct!x(9K6|FUnx#lqaBL0+i=o7VctKFDFb@!PrK*%KafgC>?$22IS97BDk0GBF{- zZlb^{8GNxZ`2o}P%{gr9u&9{DPGMB=P4;l{Dw>v1sM@qr=Tt)Urw+UGf+bOcUUzQZ z_!gnVdO7Uo%YO6seRkIWmCP7U-FP(3e)+|>^7pDXT<li9`WoMgpyK1Isg2%Nd zQB%$>`c+VGVRoc-i?{N>!g>0)*^Y0WqxiwD=JmuMF`R!}oR@6&W8qOUEX?vav3mE5 zbHCC>rL3A}I2&)}lb7rKVSZ2g+13SL7IklznXqd{?i59ihS<;h)7G9W(x}Svcy~TI z)3E1gU)nA2iqsd(R^C6(IE7peiqU0Rr`Gtvb~!1GQs9-YhOlZ mUEA(AWl_zGHGazi?6i&MWjIMciA+y?b$nLf9GTF?o}BXz%v`c3K+lcoq53tJCuL?Y v|9QP_zgWbi$S}PIw+qGb7|^+3qh@T499MVdGb delta 151 zcmbQtHib>Xpov+)powYg0%j&gCMHgX_io3R%-)@Fd7{K(DKi5LLqj7219M}GC~;mx zO9N8_3kY}P)k};VFr|~%Gf8`SG8niqDKdP#u*|O6Smk0BYrGua-r8*Am!H}`f3{uu yKC9hu^Y*#`CPju133tyex*hiB=9edrRj+I~sakugDt6bAP2Xx+j_*x6sQ>`7YdVg diff --git a/wolfssl/version.h b/wolfssl/version.h index eda79bd86..fe258fcca 100644 --- a/wolfssl/version.h +++ b/wolfssl/version.h @@ -28,8 +28,8 @@ extern "C" { #endif -#define LIBWOLFSSL_VERSION_STRING "4.4.1" -#define LIBWOLFSSL_VERSION_HEX 0x04004001 +#define LIBWOLFSSL_VERSION_STRING "4.5.0" +#define LIBWOLFSSL_VERSION_HEX 0x04005000 #ifdef __cplusplus }