809c30a5b9
Merge pull request #2128 from SparkiDev/pkcs11_ecc_server_fix
...
PKCS #11 id RSA - TLS don't convert length a la ecc
2019-02-28 19:05:33 -08:00
dc144df32a
PKCS #11 id RSA - TLS don't convert length a la ecc
2019-03-01 10:23:45 +10:00
b528997d30
Merge pull request #2103 from SparkiDev/pkcs11_hmac
...
PKCS #11 support for HMAC with MD5, SHA, SHA-2
2019-02-28 09:50:59 -08:00
a382a979cc
Merge pull request #2098 from kaleb-himes/ZD4793
...
Fix for single threaded case with double free on suites
2019-02-28 08:56:57 +10:00
e2e3b835d6
Merge pull request #2100 from SparkiDev/tls13_vers
...
Support FFDHE in TLS 1.2 and below. Better TLS 1.3 version support.
2019-02-27 14:55:29 -08:00
4226fb66f9
Merge pull request #2117 from SparkiDev/pkcs11_id_fix_2
...
PKCS #11 use private key id double free issue fixed
2019-02-27 14:19:43 -08:00
b189fc0ef8
Merge pull request #2120 from dgarske/nightly_fixes
...
Fixes for various nightly build configuration warnings
2019-02-27 14:15:40 -08:00
6ce28d74ff
rename function wolfSSL_sk_ASN1_OBJCET_pop
2019-02-26 16:55:03 -07:00
a3af2fc960
Fix for single threaded case with double free on suites.
2019-02-26 11:03:02 -08:00
38303cf27b
More spelling fixes.
2019-02-26 10:47:42 -08:00
a2f8747652
Fix DecodePrivateKey to return NOT_COMPILED_IN with PKCS#11
2019-02-26 09:22:03 +10:00
cb830a088f
Fix for configurations without specific algorithms
2019-02-26 09:22:03 +10:00
a44751cd39
PKCS #11 use private key id double free issue fixed
2019-02-26 08:27:59 +10:00
0360b38de4
Merge pull request #2116 from SparkiDev/pkcs11_id_fix_1
...
Fixes for PKCS #11 private key id and ECC
2019-02-25 13:09:15 -08:00
603a9b2e59
Merge pull request #2110 from dgarske/spelling
...
Fixes for various spelling errors
2019-02-25 13:04:12 -08:00
0e914d81dc
Fixes for PKCS #11 private key id and ECC
2019-02-25 11:17:56 +10:00
289f51a77d
Fixes for various spelling errors.
2019-02-21 13:29:44 -08:00
5932cdab15
cast on strlen return value
2019-02-21 13:04:38 -07:00
18d3e04dbf
remove null terminators on substrings
2019-02-20 16:39:18 -07:00
9c9221432f
Merge pull request #2087 from ejohnstown/aesgcm
...
Update TLS for AES-GCM/CCM changes
2019-02-20 11:43:06 -08:00
025fba8ec6
Merge pull request #2093 from dgarske/tls13_async_dh
...
Fix for TLSv1.3 with DH key share when using QAT
2019-02-20 09:16:54 -08:00
c2fbef2f7f
Refactor to populate preMasterSz on XMALLOC. Fix for DoClientKeyExchange and ecdhe_psk_kea, which assumes preMasterSz is zero. Fix for TLS v1.3 resumption not properly setting preMasterSz. Removed for TLS v1.3 PSK setup test for preMasterSz == 0, which is not required. Spelling fixes for tls13.c.
2019-02-19 13:01:21 -08:00
e3997558a9
Fixes from review and added REAMEs and setup.sh
...
Add README.md and setup.sh.
Add READMEs with license information.
2019-02-19 11:47:45 +10:00
5e1eee091a
Add threaded samples using buffers and sockets
2019-02-19 11:47:45 +10:00
3366acc9ce
Zephyr port of crypto
2019-02-19 11:47:44 +10:00
7aa5cd6f10
Support FFDHE in TLS 1.2 and below. Better TLS 1.3 version support.
...
Add support for the fixed FFDHE curves to TLS 1.2. Same curves in TLS
1.3 already. On by default - no checking of prime required.
Add option to require client to see FFDHE parameters from server as per
'may' requirements in RFC 7919.
Change TLS 1.3 ClientHello and ServerHello parsing to find the
SupportedVersions extension first and process it. Then it can handle
other extensions knowing which protocol we are using.
2019-02-18 14:51:59 +10:00
c0d1241786
Modify the TLSv1.3 calls to the AES-GCM and AES-CCM encrypt functions to
...
use the FIPS compatible APIs with external nonce.
2019-02-15 13:52:23 -08:00
7275ee5f19
Merge pull request #2089 from SparkiDev/tls13_sup_ver
...
Make SupportedVersions respect SSL_OP_NO_TLSv*
2019-02-15 10:36:32 -08:00
d9a5898e91
Merge pull request #2082 from SparkiDev/parse_kse
...
Fix length passed to key share entry parsing
2019-02-15 10:31:14 -08:00
e47797f700
Make SupportedVersions respect SSL_OP_NO_TLSv*
2019-02-15 08:26:03 +10:00
e2d7b402e7
Update so TLSv1.3 will work. Needed to make the implicit IVs full sized
...
when copying. Added a flag to SetKeys() to skip the IV set (used for
TLSv1.3).
2019-02-14 12:04:32 -08:00
3223920fd9
Add a guard for AES-GCM and AES-CCM for the change in Encrypt for the
...
AES-AEAD type and macros.
2019-02-14 12:04:05 -08:00
cd7f8cc653
Update AES-GCM/CCM use in TLS with a wrapper to select the correct API
...
depending on using old FIPS, or non-FIPS/FIPSv2.
2019-02-14 12:04:05 -08:00
67e70d6cb6
Update TLS to use the new AES-GCM and AES-CCM APIs that output the IV on
...
encrypt rather than take the IV as an input.
2019-02-14 12:04:05 -08:00
d98ebc4da2
Reverted the Hmac_UpdateFinal change to call final as it causing constant timing issues. Improved the wc_HmacFree to handle the case were final isn't called for Crypto callbacks.
2019-02-13 10:24:53 -08:00
95db819d45
Fixes for warnings when building with --enable-pkcs11.
2019-02-12 16:05:48 -08:00
454687f429
Fix for TLS HMAC constant timing to ensure final is called for dummy operations. Added devCtx to AES for CryptoCb.
2019-02-12 16:03:10 -08:00
838652c03b
Added flags build option to hashing algorithms. This allows indicator to determine if hash will be "copied" as done during a TLS handshake.
2019-02-12 16:03:10 -08:00
7e3082906e
Fix for ensuring devId is passed into symmetric init.
2019-02-12 16:03:10 -08:00
f824c8c769
Merge pull request #2077 from ejohnstown/ocsp-ecdsa
...
OCSP and ECDSA Signers
2019-02-12 09:50:37 -07:00
e86aae00ed
Change to allow setting of devId for private key
2019-02-11 12:37:44 +10:00
47922a4d87
Support in SSL for setting a private key id
...
Works with PKCS #11 to use key on device.
2019-02-11 10:38:38 +10:00
88050de1ff
Fix length passed to key share entry parsing
2019-02-11 08:29:28 +10:00
b6d322cd14
fix typo revcd vs recvd and spell out to avoid confusion: received
2019-02-08 14:27:19 -07:00
6298074f93
OCSP and ECDSA Signers
...
OCSP uses an identified hash of the issuer's public key to identify the
certificate's signer. (Typically this is SHA-1, but can be any SHA
hash.) The AKID/SKID for the certificates usually are the SHA-1 hash of
the public key, but may be anything. We cannot depend on the AKID for
OCSP purposes. For OCSP lookups, wolfSSL calculates the hash of the
public key based on the copy saved for use with the handshake signing.
For RSA, that was fine. For ECDSA, we use the whole public key including
the curve ID, but for OCSP the curve ID isn't hashed. Stored the hash of
the public key at the point where we are looking at the key when reading
in the certificate, and saving the hash in the signer record.
2019-02-07 17:34:25 -08:00
e52f4494f0
Merge pull request #2069 from dgarske/fix_8192
...
Fixes for handling 6144 and 8192 bit with TLS v1.3
2019-02-07 15:02:40 -08:00
be4d6bc204
fix typo with getting cipher suite
2019-02-04 10:53:59 -07:00
b7179c2a54
Disallow SupportedGroups in ServerHello for TLS 1.3
...
But allowed when downgrading to TLS 1.2.
2019-02-04 09:04:11 +10:00
73fbf845f2
Merge pull request #2066 from SparkiDev/sec_reneg_scsv
...
Fix empty renegotiation info ciphersuite handling
2019-02-01 10:05:59 -08:00
14a2343118
Merge pull request #2064 from SparkiDev/tls13_dhkeysz
...
Set the DH key size for TLS 1.3 when secret calculated
2019-02-01 10:04:15 -08:00
David Garske
Sean Parkinson
toddouska
Jacob Barthelmeh
John Safranek
Kaleb Himes