Commit Graph

7320 Commits

Author SHA1 Message Date
John Safranek
369c2debde Test Fixes
1. Removed redundant forward declaration of RsaKey from hmac.h.
2. Updated gitignore with the first and last files.
3. Updated autogen with touching the first and last files.
2018-03-22 15:50:54 -07:00
John Safranek
9d4de6908c Test Fixes
1. AesGcmEncrypt_ex requires the RNG, remove function if RNG disabled.
2. Fix a couple function name changes in the example server.
3. Removed the old FIPS wrapping added to dh.h, was redundant.
4. Move include of random.h in the aes.h file.
5. Fix where ecc.c was being left out of old FIPS builds.
6. Exclude the AES-GCM internal IV test case when building without the RNG.
7. Fix api test where AES-GCM Encrypt was called with a too-long IV in old FIPS mode. Non-FIPS and new FIPS are allowed longer IVs.
2018-03-22 15:50:54 -07:00
John Safranek
84e36f012a FIPS Revalidation
1. AES-GCM encrypt IV length allowed to be 8-bits.
2018-03-22 15:50:54 -07:00
John Safranek
cc02098760 FIPS Revalidation
1. Update the const data and code segment tags for the Windown builds.
2018-03-22 15:50:54 -07:00
John Safranek
e3ea7e1efc FIPS Revalidation
1. Enabled ECC Cofactor DH for the FIPSv2 build.
2. Updated the wolfCrypt HMAC-SHA-3 test to leave out the set of test cases that use the four-byte key in FIPS mode.
2018-03-22 15:50:54 -07:00
John Safranek
a74e419446 FIPS Revalidation
1. Change to configure.ac to automatically enable HKDF in FIPSv2 builds.
2018-03-22 15:50:54 -07:00
John Safranek
85b3c9652a FIPS Revalidation
1. Change to configure.ac to automatically enable AES-CTR in FIPSv2 builds.
2. Move the aes-ni asm file into the boundary if enabled.
3. Enable AES-ECB by default.
2018-03-22 15:50:54 -07:00
John Safranek
5c452f26d7 AES-GCM
1. Updated the wolfCrypt GMAC test to leave out the test case with the 15-byte tag when building for FIPS.
2. Replace tabs with spaces.
2018-03-22 15:50:54 -07:00
John Safranek
94835b2c1b FIPS Revalidation
1. Updated CMAC to allow tag length from 4 to 16 bytes, inclusive.
2018-03-22 15:50:54 -07:00
John Safranek
675480adf9 FIPS Revalidation
1. Enable SHA-224 by default if building for FIPSv2.
2018-03-22 15:50:54 -07:00
John Safranek
2683fb29df FIPS Revalidation
1. Added new AES-GCM Encrypt API for FIPS where the IV is generated internally.
2. Fix the AES-NI guard flags so it can be used when FIPS enabled.
2018-03-22 15:50:54 -07:00
John Safranek
80e589c7d9 FIPS Revalidation
1. Added CMAC to the boundary.
2. Added DHE to the boundary.
2018-03-22 15:50:54 -07:00
John Safranek
8576dc4a6c FIPS Update
1. Moved the rest of the FIPS algorithms to FIPSv2.
2. Updated the fips-check and autogen scripts.
3. Updated the automake include for the crypto files.
4. Updated the example server to use the wolfSSL API and wolfSSL-based OpenSSL compatibility layer.
5. Added error code for the SHA-3 KAT.
6. Updated an test case in the API test for AES-GCM encrypt that is now considered a success case, but the FIPS mode was still treating as a failure.
2018-03-22 15:50:54 -07:00
John Safranek
c56c2ea8e4 FIPS Update
1. Move SHA-224 and SHA-256 into FIPSv2.
2. Move HMAC into FIPSv2.
3. Move Hash_DRBG into FIPSv2.
2018-03-22 15:50:54 -07:00
John Safranek
5cc93bdda4 FIPS Update
1. Add SHA-3 to the src/include.am so that it is always included in FIPSv2.
2. Tweak the SHA-3 header to follow the new FIPS pattern.
2018-03-22 15:50:54 -07:00
John Safranek
786c1ef956 AES-CCM FIPS
1. Add new error code for the AES-CCM FIPS KAT failure.
2. When enabling FIPSv2, force enable AES-CCM.
2018-03-22 15:50:53 -07:00
toddouska
aee6f4d0ca Merge pull request #1457 from dgarske/base16
Base16/64 improvements
2018-03-22 15:14:57 -07:00
toddouska
a92696edec Merge pull request #1454 from dgarske/noprivkey
Support for not loading a private key when using `HAVE_PK_CALLBACKS`
2018-03-22 12:47:22 -07:00
toddouska
040e0ab752 Merge pull request #1456 from dgarske/iocbname
Refactor IO callback function names to use `_CTX_`
2018-03-22 12:40:48 -07:00
toddouska
43f4faa7be Merge pull request #1452 from cconlon/mcapifix
fix unused param warning with NO_ERROR_STRINGS
2018-03-22 12:39:19 -07:00
David Garske
3bf325290d Base16/64 improvements:
* Add define `WOLFSSL_BASE16` to explicitly expose base16 support.
* Add `./configure --enable-base16` option (disabled by default in configure, but enabled in coding.h when required internally).
* Added base16 tests in test.c `base16_test`.
* Enabled base64 decode tests when `WOLFSSL_BASE64_ENCODE` is not defined.
2018-03-22 10:36:56 -07:00
Chris Conlon
2989c73411 Merge pull request #1447 from JacobBarthelmeh/PKCS7
remove pkcs7 requirement of x963kdf when ecc is disabled
2018-03-22 10:01:55 -06:00
David Garske
e564c973b6 Refactor IO callback function names to use _CTX_ to eliminate confusion about the first parameter. 2018-03-21 16:08:55 -07:00
David Garske
4b51431546 Fix for possible unused ctx in wolfSSL_CTX_IsPrivatePkSet when no ECC, RSA or ED25519. 2018-03-21 15:46:08 -07:00
toddouska
104f7a0170 Merge pull request #1451 from JacobBarthelmeh/Optimizations
Adjust X509 small build and add more macro guards
2018-03-21 15:15:27 -07:00
toddouska
f3d0879ed7 Merge pull request #1449 from dgarske/asn_nullterm
ASN improvements for building header/footer in `wc_DerToPemEx`
2018-03-21 15:13:46 -07:00
toddouska
2a356228be Merge pull request #1445 from SparkiDev/wpas_fix
Fixes for wpa_supplicant
2018-03-21 15:11:43 -07:00
David Garske
dbb34126f6 * Added support for not loading a private key for server or client when HAVE_PK_CALLBACK is defined and the private PK callback is set. Tested with all cipher suites, TLS 1.2/1.3, client/server certs, RSA/ECC/ED25519.
* Added PK callback context tests for client/server examples (`SetupPkCallbackContexts`).
* Added new test define for `TEST_PK_PRIVKEY` to allows simulating hardware based private key.
* Added new test.h function for loading PEM key file and converting to DER (`load_key_file`).
* Added way to get private key signature size (`GetPrivateKeySigSize`).
* Added new ECC API `wc_ecc_sig_size_calc` to return max signature size for a key size.
* Added inline comments to help track down handshake message types.
* Cleanup of RSS PSS terminating byte (0xbc) to use enum value.
* Fixed bug with PK callback for `myEccVerify` public key format.
* Fixed bug with PK callback for ED25519 verify key buffer in DoServerKeyExchange.
2018-03-21 11:27:08 -07:00
Jacob Barthelmeh
26bb86690a fix for unused parameter warning 2018-03-21 10:06:06 -06:00
Chris Conlon
14bb14c6ab fix unused param warning with NO_ERROR_STRINGS 2018-03-21 09:56:08 -06:00
Jacob Barthelmeh
90f97f4a5a fix for unused variable 2018-03-21 09:16:43 -06:00
Jacob Barthelmeh
0aa3b5fa0e macros for conditionally compiling code 2018-03-21 00:09:29 -06:00
Jacob Barthelmeh
d9917049c4 use bit fields with WOLFSSL_CTX structure 2018-03-20 22:07:42 -06:00
Jacob Barthelmeh
087df8f1cd more macro guards to reduce size 2018-03-20 17:15:16 -06:00
Sean Parkinson
c9c2e1a8a7 Don't base signature algorithm support on certificate
The signature algorithm support is what you can do with another key, not
what you can do with your key.
2018-03-21 08:33:54 +10:00
Jacob Barthelmeh
4d65e4cc1e add WOLFSSL_NO_DH186 macro to optionally compile out DH186 function 2018-03-20 15:31:20 -06:00
Jacob Barthelmeh
df6ea54cd5 add support for PKCS8 decryption to OPENSSL_EXTRA_X509_SMALL build 2018-03-20 15:06:35 -06:00
toddouska
bba0a3e88c Merge pull request #1448 from dgarske/ecc_cleanup
ECC import/export cleanups and additions
2018-03-20 11:05:15 -07:00
toddouska
38d1eea8cd Merge pull request #1446 from SparkiDev/tls13_draft27
TLS v1.3 support for Draft 23 and Draft 27
2018-03-20 09:13:03 -07:00
toddouska
18879ce271 Merge pull request #1440 from dgarske/VerifyRsaSign_PKCallback
Added VerifyRsaSign PK callback
2018-03-20 09:02:18 -07:00
David Garske
764aec071c Further improvement to the null termination and newline logic in wc_DerToPemEx. 2018-03-19 22:58:18 -07:00
David Garske
59aa893260 Cleanup ECC point import/export code. Added new API wc_ecc_import_unsigned to allow importing public x/y and optional private as unsigned char. Cleanup wc_ecc_sign_hash to move the hardware crypto code into a separate function. Added missing tests for wc_ecc_export_public_raw, wc_ecc_export_private_raw and new test for wc_ecc_import_unsigned. 2018-03-19 13:28:57 -07:00
toddouska
87c70e76a9 Merge pull request #1441 from dgarske/ocsp_nb
Fix for handling OCSP with non-blocking
2018-03-19 12:05:59 -07:00
David Garske
2cc1a1c5bf Renamed callbacks for VerifySign to SignCheck. Switched the new callback context to use the one for the sign. Fix for callback pointer check on VerifyRsaSign. Added inline comments about the new RsaSignCheckCb and RsaPssSignCheckCb. 2018-03-19 10:19:24 -07:00
toddouska
cb8f8a953b Merge pull request #1438 from SparkiDev/nginx_pem_write
Fix PEM_write_bio_X509 to work with new BIO code
2018-03-19 09:13:51 -07:00
toddouska
1040cf9caa Merge pull request #1437 from dgarske/eccrsrawtosig
Added new ECC API `wc_ecc_rs_raw_to_sig`
2018-03-19 09:12:39 -07:00
Jacob Barthelmeh
467608b6c9 remove pkcs7 requirement of x963kdf when ecc is disabled 2018-03-19 10:08:46 -06:00
toddouska
7ce2efd572 Merge pull request #1431 from JacobBarthelmeh/Optimizations
more aes macro key size guards
2018-03-19 09:07:05 -07:00
toddouska
b28c6a394f Merge pull request #1428 from JacobBarthelmeh/Certs
Update to certificate renew scripts
2018-03-19 09:05:15 -07:00
Sean Parkinson
bd53d7ba59 TLS v1.3 support for Draft 23 and Draft 27
Draft 24: Second ClientHello usees version 0x0303 - no change.
Draft 25: The record layer header is now additional authentication data to
encryption.
Draft 26: Disallow SupportedVersion being used in ServerHello for
negotiating below TLS v1.3.
Draft 27: Older versions can be negotiated (by exclusion of 0x0304) in
SupportedVersion - no change.
2018-03-19 16:15:02 +10:00