jonathan/openssl
1
0
Fork 0
forked from rpms/openssl
Code Pull Requests Activity
Utilities from the general purpose cryptography library with TLS implementation
110 Commits 9 Branches 54 Tags 3.3 MiB
C 97.3%
Shell 2.7%
08d6c35051
Go to file
Clemens Lang 08d6c35051 FIPS self-test: RSA-OAEP, FFDHE2048, digest_sign 
Use RSA-OAEP in FIPS self-tests and support a fixed OAEP seed to make
the test deterministic as required for a known-answer test.

Switch the signature FIPS self-test to use the digest_sign and
digest_verify provider functions using the EVP_DigestSign and
EVP_DigestVerify APIs, as the existing signature self-test does not
cover hash computation.

Switch the existing Diffie-Hellman FIPS self-test to use FFDHE2048,
a known safe prime from RFC 7919.

Signed-off-by: Clemens Lang <cllang@redhat.com>
Resolves: rhbz#2102535
2022-08-01 17:18:12 +02:00
.gitignore Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0001-Aarch64-and-ppc64le-use-lib64.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0002-Use-more-general-default-values-in-openssl.cnf.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0003-Do-not-install-html-docs.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0004-Override-default-paths-for-the-CA-directory-tree.patch Fixes override of openssl_conf in openssl.cnf 2021-07-06 13:56:08 +02:00
0005-apps-ca-fix-md-option-help-text.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0006-Disable-signature-verification-with-totally-unsafe-h.patch Update to Beta1 version 2021-07-14 13:31:08 +02:00
0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0008-Add-FIPS_mode-compatibility-macro.patch Update to Beta1 version 2021-07-14 13:31:08 +02:00
0009-Add-Kernel-FIPS-mode-flag-support.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0011-Remove-EC-curves.patch Update to Beta1 version 2021-07-14 13:31:08 +02:00
0012-Disable-explicit-ec.patch Reworked patch forbidding explicit EC parameters 2022-05-06 16:51:28 +02:00
0013-FIPS-provider-explicit-ec.patch Adaptation of upstream patches disabling explicit EC parameters in FIPS mode 2022-05-06 17:41:32 +02:00
0014-FIPS-disable-explicit-ec.patch Adaptation of upstream patches disabling explicit EC parameters in FIPS mode 2022-05-06 17:41:32 +02:00
0015-FIPS-decoded-from-explicit.patch Strict certificates validation shouldn't allow explicit EC parameters 2022-06-24 17:17:35 +02:00
0024-load-legacy-prov.patch Always activate default provider via config 2021-11-23 16:52:23 +01:00
0025-for-tests.patch Always activate default provider via config 2021-11-23 16:52:23 +01:00
0031-tmp-Fix-test-names.patch KTLS and FIPS may interfere, so tests need to be tuned 2021-09-22 17:15:22 +02:00
0032-Force-fips.patch -config argument of openssl app should work properly 2022-05-12 13:29:27 +02:00
0033-FIPS-embed-hmac.patch Remove volatile attribute from HMAC to make annocheck happy 2022-01-21 13:48:28 +01:00
0034.fipsinstall_disable.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0035-speed-skip-unavailable-dgst.patch openssl speed should run in FIPS mode 2021-12-21 16:16:07 +01:00
0045-FIPS-services-minimize.patch Improve diagnostics when passing unsupported groups in TLS 2022-06-24 17:17:35 +02:00
0046-FIPS-s390x-hardening.patch On the s390x, zeroize all the copies of TLS premaster secret 2022-01-26 16:50:19 +01:00
0047-FIPS-early-KATS.patch KATS self-tests should run before HMAC verifcation 2022-01-21 13:48:28 +01:00
0048-correctly-handle-records.patch s_server: correctly handle 2^14 byte long records 2022-02-03 15:37:48 +01:00
0049-Selectively-disallow-SHA1-signatures.patch Fix RSA PSS padding with SHA-1 disabled 2022-03-10 13:29:29 +01:00
0050-FIPS-enable-pkcs12-mac.patch OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters 2022-02-22 16:32:34 +01:00
0051-Support-different-R_BITS-lengths-for-KBKDF.patch OpenSSL FIPS module should not build in non-approved algorithms 2022-05-05 17:34:49 +02:00
0052-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch Strict certificates validation shouldn't allow explicit EC parameters 2022-06-24 17:17:35 +02:00
0053-CVE-2022-0778.patch CVE-2022-0778 fix 2022-03-16 15:03:25 +01:00
0054-Replace-size-check-with-more-meaningful-pubkey-check.patch Fix occasional internal error in TLS when DHE is used 2022-03-22 13:04:16 +01:00
0055-nonlegacy-fetch-null-deref.patch Fix openssl curl error with LANG=tr_TR.utf8 2022-04-21 15:16:46 +02:00
0056-strcasecmp.patch OpenSSL FIPS module should not build in non-approved algorithms 2022-05-05 17:34:49 +02:00
0057-strcasecmp-fix.patch Fix regression in evp_pkey_name2type caused by tr_TR locale fix 2022-04-28 13:39:35 +02:00
0058-FIPS-limit-rsa-encrypt.patch FIPS provider should block RSA encryption for key transport. 2022-06-24 17:17:35 +02:00
0060-FIPS-KAT-signature-tests.patch Use KAT for ECDSA signature tests, s390 arch 2022-05-30 18:22:47 +02:00
0061-Deny-SHA-1-signature-verification-in-FIPS-provider.patch FIPS: Disable SHA1 signs and EVP_PKEY_{sign,verify} 2022-05-23 17:02:25 +02:00
0062-fips-Expose-a-FIPS-indicator.patch FIPS: Expose explicit indicator from fips.so 2022-06-09 17:13:33 +02:00
0063-CVE-2022-1473.patch CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory 2022-05-26 11:57:12 +02:00
0064-CVE-2022-1343.diff CVE-2022-1343 openssl: inacurate verification when using OCSP_NOCHECKS 2022-05-26 12:07:22 +02:00
0065-CVE-2022-1292.patch CVE-2022-1292 openssl: c_rehash script allows command injection 2022-05-26 12:14:19 +02:00
0066-replace-expired-certs.patch Replace expired certificates 2022-06-03 15:31:56 +02:00
0067-fix-ppc64-montgomery.patch Fix PPC64 Montgomery multiplication bug 2022-06-24 17:17:35 +02:00
0068-CVE-2022-2068.patch CVE-2022-2068: the c_rehash script allows command injection 2022-06-24 17:17:35 +02:00
0069-CVE-2022-2097.patch CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86 2022-07-05 14:04:20 +02:00
0070-EVP_PKEY_Q_keygen-Call-OPENSSL_init_crypto-to-init-s.patch Fix segfault in EVP_PKEY_Q_keygen() 2022-07-14 14:49:48 +02:00
0071-AES-GCM-performance-optimization.patch Improve AES-GCM & ChaCha20 perf on Power9+ ppc64le 2022-07-14 18:19:36 +02:00
0072-ChaCha20-performance-optimizations-for-ppc64le.patch Improve AES-GCM & ChaCha20 perf on Power9+ ppc64le 2022-07-14 18:19:36 +02:00
0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch FIPS self-test: RSA-OAEP, FFDHE2048, digest_sign 2022-08-01 17:18:12 +02:00
0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch FIPS self-test: RSA-OAEP, FFDHE2048, digest_sign 2022-08-01 17:18:12 +02:00
0075-FIPS-Use-FFDHE2048-in-self-test.patch FIPS self-test: RSA-OAEP, FFDHE2048, digest_sign 2022-08-01 17:18:12 +02:00
configuration-prefix.h Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
configuration-switch.h Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
ec_curve.c Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
ectest.c Reworked patch forbidding explicit EC parameters 2022-05-06 16:51:28 +02:00
gating.yaml Temporary manual test 2022-04-21 13:20:27 +02:00
genpatches Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
hobble-openssl RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
make-dummy-cert RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
Makefile.certificate RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
openssl.spec FIPS self-test: RSA-OAEP, FFDHE2048, digest_sign 2022-08-01 17:18:12 +02:00
renew-dummy-cert RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
rpminspect.yaml Make rpminspect happy 2021-12-10 14:19:15 +01:00
sources Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00