Go to file
David Benjamin 5b8fa431ae Make RSA key exchange code actually constant-time.
Using RSA_PKCS1_PADDING with RSA_private_decrypt is inherently unsafe.
The API requires writing output on success and touching the error queue
on error. Thus, although the padding check itself is constant-time as of
294d1e36c2, and the logic after the
decryption in the SSL code is constant-time as of
adb46dbc6d, the API boundary in the middle
still leaks whether the padding check succeeded, giving us our
much-loved Bleichenbacher padding oracle.

Instead, PKCS#1 padding must be handled by the caller which uses
RSA_NO_PADDING, in timing-sensitive code integrated with the
Bleichenbacher mitigation. Removing PKCS#1 padding in constant time is
actually much simpler when the expected length is a constant (and if
it's not a constant, avoiding a padding oracle seems unlikely), so just
do it inline.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1222
2016-06-21 20:55:54 +02:00
apps Allow proxy certs to be present when verifying a chain 2016-06-20 21:34:37 +02:00
Configurations Harmonise the different build files 2016-06-17 16:06:31 +02:00
crypto buf2hexstr: properly deal with empty string 2016-06-21 20:55:54 +02:00
demos
doc buf2hexstr: properly deal with empty string 2016-06-21 20:55:54 +02:00
engines Handle inability to create AFALG socket 2016-06-13 17:28:40 +01:00
external/perl
fuzz Update fuzz corpora 2016-06-14 19:30:41 +02:00
include make update 2016-06-20 21:34:37 +02:00
ms Revert "RT4526: Call TerminateProcess, not ExitProcess" 2016-06-16 17:37:37 +01:00
os-dep
ssl Make RSA key exchange code actually constant-time. 2016-06-21 20:55:54 +02:00
test OpenSSL::Test: Fix directory calculations in __cwd() 2016-06-21 14:52:34 +02:00
tools
util More doc cleanup 2016-06-21 07:03:34 -04:00
VMS
.gitattributes Make corpora binary. 2016-06-10 13:00:31 +01:00
.gitignore Add some accessor API's 2016-06-08 11:37:06 -04:00
.travis-create-release.sh
.travis.yml Travis: When testing install, install docs as well 2016-06-21 14:52:34 +02:00
ACKNOWLEDGEMENTS
appveyor.yml Appveyor: test install as well, via a fake deploy_script 2016-06-21 14:52:34 +02:00
AUTHORS
build.info Move the Configure generated header files to the top build.info 2016-06-14 22:11:38 +02:00
CHANGES Change default directory for the .rnd file on Windows and VMS 2016-06-20 11:06:40 +02:00
config
config.com
Configure Fix typo 2016-06-21 14:40:06 -04:00
CONTRIBUTING
e_os.h Change default directory for the .rnd file on Windows and VMS 2016-06-20 11:06:40 +02:00
FAQ
INSTALL
LICENSE
Makefile.shared
NEWS
NOTES.DJGPP
NOTES.PERL
NOTES.VMS
NOTES.WIN NOTES.WIN: use secure urls 2016-06-06 10:03:55 -04:00
README
README.ECC
README.ENGINE
README.FIPS

 OpenSSL 1.1.0-pre6-dev

 Copyright (c) 1998-2016 The OpenSSL Project
 Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
 All rights reserved.

 DESCRIPTION
 -----------

 The OpenSSL Project is a collaborative effort to develop a robust,
 commercial-grade, fully featured, and Open Source toolkit implementing the
 Transport Layer Security (TLS) protocols (including SSLv3) as well as a
 full-strength general purpose cryptographic library.

 OpenSSL is descended from the SSLeay library developed by Eric A. Young
 and Tim J. Hudson.  The OpenSSL toolkit is licensed under a dual-license (the
 OpenSSL license plus the SSLeay license), which means that you are free to
 get and use it for commercial and non-commercial purposes as long as you
 fulfill the conditions of both licenses.

 OVERVIEW
 --------

 The OpenSSL toolkit includes:

 libssl (with platform specific naming):
     Provides the client and server-side implementations for SSLv3 and TLS.

 libcrypto (with platform specific naming):
     Provides general cryptographic and X.509 support needed by SSL/TLS but
     not logically part of it.

 openssl:
     A command line tool that can be used for:
        Creation of key parameters
        Creation of X.509 certificates, CSRs and CRLs
        Calculation of message digests
        Encryption and decryption
        SSL/TLS client and server tests
        Handling of S/MIME signed or encrypted mail
        And more...

 INSTALLATION
 ------------

 See the appropriate file:
        INSTALL         Linux, Unix, Windows, OpenVMS, ...
        NOTES.*         INSTALL addendums for different platforms

 SUPPORT
 -------

 See the OpenSSL website www.openssl.org for details on how to obtain
 commercial technical support. Free community support is available through the
 openssl-users email list (see
 https://www.openssl.org/community/mailinglists.html for further details).

 If you have any problems with OpenSSL then please take the following steps
 first:

    - Download the current snapshot from ftp://ftp.openssl.org/snapshot/
      to see if the problem has already been addressed
    - Remove ASM versions of libraries
    - Remove compiler optimisation flags

 If you wish to report a bug then please include the following information in
 any bug report:

    - OpenSSL version: output of 'openssl version -a'
    - Any "Configure" options that you selected during compilation of the
      library if applicable (see INSTALL)
    - OS Name, Version, Hardware platform
    - Compiler Details (name, version)
    - Application Details (name, version)
    - Problem Description (steps that will reproduce the problem, if known)
    - Stack Traceback (if the application dumps core)

 Email the report to:

    rt@openssl.org

 In order to avoid spam, this is a moderated mailing list, and it might
 take a couple of days for the ticket to show up.  (We also scan posts to make
 sure that security disclosures aren't publically posted by mistake.) Mail
 to this address is recorded in the public RT (request tracker) database
 (see https://www.openssl.org/community/index.html#bugs for details) and
 also forwarded the public openssl-dev mailing list.  Confidential mail
 may be sent to openssl-security@openssl.org (PGP key available from the
 key servers).

 Please do NOT use this for general assistance or support queries.
 Just because something doesn't work the way you expect does not mean it
 is necessarily a bug in OpenSSL. Use the openssl-users email list for this type
 of query.

 You can also make GitHub pull requests. See the CONTRIBUTING file for more
 details.

 HOW TO CONTRIBUTE TO OpenSSL
 ----------------------------

 See CONTRIBUTING

 LEGALITIES
 ----------

 A number of nations, in particular the U.S., restrict the use or export
 of cryptography. If you are potentially subject to such restrictions
 you should seek competent professional legal advice before attempting to
 develop or distribute cryptographic code.