mirror of
https://github.com/openssl/openssl.git
synced 2025-02-23 14:42:15 +08:00
d9a7510747
In TLSv1.2 a pre-master secret value is passed from the client to the server encrypted using RSA PKCS1 type 2 padding in a ClientKeyExchange message. As well as the normal formatting rules for RSA PKCA1 type 2 padding TLS imposes some additional rules about what constitutes a well formed key. Specifically it must be exactly the right length and encode the TLS version originally requested by the client (as opposed to the actual negotiated version) in its first two bytes. All of these checks need to be done in constant time and, if they fail, then the TLS implementation is supposed to continue anyway with a random key (and therefore the connection will fail later on). This avoids padding oracle type attacks. This commit implements this within the RSA padding code so that we keep all the constant time padding logic in one place. A later commit will remove it from libssl. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10411) |
||
|---|---|---|
| .. | ||
| __DECC_INCLUDE_EPILOGUE.H | ||
| __DECC_INCLUDE_PROLOGUE.H | ||
| aria.h | ||
| asn1_dsa.h | ||
| asn1.h | ||
| async.h | ||
| bn_conf.h.in | ||
| bn_dh.h | ||
| bn_srp.h | ||
| bn.h | ||
| chacha.h | ||
| ciphermode_platform.h | ||
| cms.h | ||
| cryptlib.h | ||
| ctype.h | ||
| dso_conf.h.in | ||
| ec.h | ||
| engine.h | ||
| err.h | ||
| ess.h | ||
| evp.h | ||
| lhash.h | ||
| md32_common.h | ||
| modes.h | ||
| objects.h | ||
| poly1305.h | ||
| rand.h | ||
| rsa.h | ||
| serializer.h | ||
| sha.h | ||
| siphash.h | ||
| siv.h | ||
| sm2.h | ||
| sm2err.h | ||
| sm4.h | ||
| sparse_array.h | ||
| store.h | ||
| x509.h | ||