Import OpenSSL-1.0.1g.
authorPeter Avalos <pavalos@dragonflybsd.org>
Tue, 8 Apr 2014 00:59:53 +0000 (17:59 -0700)
committerPeter Avalos <pavalos@dragonflybsd.org>
Tue, 8 Apr 2014 00:59:53 +0000 (17:59 -0700)
o Fix for CVE-2014-0160
o Add TLS padding extension workaround for broken servers.
o Fix for CVE-2014-0076
o Don't include gmt_unix_time in TLS server and client random values
o Fix for TLS record tampering bug CVE-2013-4353
o Fix for TLS version checking bug CVE-2013-6449
o Fix for DTLS retransmission bug CVE-2013-6450

114 files changed:
crypto/openssl/CHANGES
crypto/openssl/FAQ
crypto/openssl/NEWS
crypto/openssl/README
crypto/openssl/README.DELETED
crypto/openssl/apps/apps.c
crypto/openssl/apps/apps.h
crypto/openssl/apps/crl.c
crypto/openssl/apps/dgst.c
crypto/openssl/apps/ecparam.c
crypto/openssl/apps/openssl.c
crypto/openssl/apps/pkcs12.c
crypto/openssl/apps/req.c
crypto/openssl/crypto/aes/asm/bsaes-x86_64.pl
crypto/openssl/crypto/aes/asm/vpaes-x86_64.pl
crypto/openssl/crypto/asn1/a_int.c
crypto/openssl/crypto/asn1/asn1_err.c
crypto/openssl/crypto/bio/bss_dgram.c
crypto/openssl/crypto/bio/bss_log.c
crypto/openssl/crypto/bn/asm/x86_64-gf2m.pl
crypto/openssl/crypto/bn/asm/x86_64-mont5.pl
crypto/openssl/crypto/bn/bn.h
crypto/openssl/crypto/bn/bn_lib.c
crypto/openssl/crypto/bn/bn_nist.c
crypto/openssl/crypto/buffer/buffer.c
crypto/openssl/crypto/buffer/buffer.h
crypto/openssl/crypto/cms/cms_lib.c
crypto/openssl/crypto/cryptlib.c
crypto/openssl/crypto/ec/ec2_mult.c
crypto/openssl/crypto/ec/ec_ameth.c
crypto/openssl/crypto/ec/ec_asn1.c
crypto/openssl/crypto/ec/ec_lib.c
crypto/openssl/crypto/engine/eng_list.c
crypto/openssl/crypto/engine/eng_rdrand.c
crypto/openssl/crypto/evp/bio_b64.c
crypto/openssl/crypto/evp/digest.c
crypto/openssl/crypto/evp/e_aes.c
crypto/openssl/crypto/evp/e_aes_cbc_hmac_sha1.c
crypto/openssl/crypto/evp/e_des3.c
crypto/openssl/crypto/evp/p5_crpt2.c
crypto/openssl/crypto/modes/cbc128.c
crypto/openssl/crypto/modes/ccm128.c
crypto/openssl/crypto/modes/cts128.c
crypto/openssl/crypto/modes/gcm128.c
crypto/openssl/crypto/modes/modes_lcl.h
crypto/openssl/crypto/opensslv.h
crypto/openssl/crypto/pem/pem_info.c
crypto/openssl/crypto/pkcs12/p12_crt.c
crypto/openssl/crypto/rand/md_rand.c
crypto/openssl/crypto/rand/rand.h
crypto/openssl/crypto/rand/rand_err.c
crypto/openssl/crypto/rand/rand_lib.c
crypto/openssl/crypto/rsa/rsa_ameth.c
crypto/openssl/crypto/rsa/rsa_chk.c
crypto/openssl/crypto/rsa/rsa_pmeth.c
crypto/openssl/crypto/sha/asm/sha1-x86_64.pl
crypto/openssl/crypto/sha/sha512.c
crypto/openssl/crypto/srp/srp_grps.h
crypto/openssl/crypto/srp/srp_lib.c
crypto/openssl/crypto/symhacks.h
crypto/openssl/crypto/x509/by_dir.c
crypto/openssl/crypto/x509/x509_vfy.c
crypto/openssl/crypto/x509/x_all.c
crypto/openssl/crypto/x86cpuid.pl
crypto/openssl/doc/apps/config.pod
crypto/openssl/doc/apps/crl.pod
crypto/openssl/doc/apps/ec.pod
crypto/openssl/doc/apps/pkcs12.pod
crypto/openssl/doc/apps/req.pod
crypto/openssl/doc/apps/rsa.pod
crypto/openssl/doc/apps/s_client.pod
crypto/openssl/doc/apps/s_server.pod
crypto/openssl/doc/apps/ts.pod
crypto/openssl/doc/apps/tsget.pod
crypto/openssl/doc/crypto/BN_BLINDING_new.pod
crypto/openssl/doc/crypto/ERR_get_error.pod
crypto/openssl/doc/crypto/EVP_BytesToKey.pod
crypto/openssl/doc/crypto/EVP_EncryptInit.pod
crypto/openssl/doc/crypto/X509_STORE_CTX_get_error.pod
crypto/openssl/doc/crypto/X509_VERIFY_PARAM_set_flags.pod
crypto/openssl/doc/crypto/ecdsa.pod
crypto/openssl/doc/crypto/pem.pod
crypto/openssl/doc/ssl/SSL_CTX_set_client_CA_list.pod
crypto/openssl/doc/ssl/SSL_CTX_set_options.pod
crypto/openssl/doc/ssl/SSL_CTX_set_verify.pod
crypto/openssl/doc/ssl/SSL_CTX_use_psk_identity_hint.pod
crypto/openssl/doc/ssl/SSL_accept.pod
crypto/openssl/doc/ssl/SSL_connect.pod
crypto/openssl/doc/ssl/SSL_do_handshake.pod
crypto/openssl/doc/ssl/SSL_set_shutdown.pod
crypto/openssl/doc/ssl/SSL_shutdown.pod
crypto/openssl/e_os.h
crypto/openssl/engines/ccgost/gost89.h
crypto/openssl/engines/ccgost/gosthash.c
crypto/openssl/ssl/d1_both.c
crypto/openssl/ssl/d1_clnt.c
crypto/openssl/ssl/d1_lib.c
crypto/openssl/ssl/d1_pkt.c
crypto/openssl/ssl/d1_srvr.c
crypto/openssl/ssl/kssl.h
crypto/openssl/ssl/s23_clnt.c
crypto/openssl/ssl/s3_both.c
crypto/openssl/ssl/s3_cbc.c
crypto/openssl/ssl/s3_clnt.c
crypto/openssl/ssl/s3_lib.c
crypto/openssl/ssl/s3_pkt.c
crypto/openssl/ssl/s3_srvr.c
crypto/openssl/ssl/ssl.h
crypto/openssl/ssl/ssl3.h
crypto/openssl/ssl/ssl_lib.c
crypto/openssl/ssl/ssl_locl.h
crypto/openssl/ssl/t1_enc.c
crypto/openssl/ssl/t1_lib.c
crypto/openssl/ssl/tls1.h

index ca82ad2..4fcfd1d 100644 (file)
@@ -2,9 +2,60 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
+
+  *) A missing bounds check in the handling of the TLS heartbeat extension
+     can be used to reveal up to 64k of memory to a connected client or
+     server.
+
+     Thanks for Neel Mehta of Google Security for discovering this bug and to
+     Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
+     preparing the fix (CVE-2014-0160)
+     [Adam Langley, Bodo Moeller]
+
+  *) Fix for the attack described in the paper "Recovering OpenSSL
+     ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
+     by Yuval Yarom and Naomi Benger. Details can be obtained from:
+     http://eprint.iacr.org/2014/140
+
+     Thanks to Yuval Yarom and Naomi Benger for discovering this
+     flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
+     [Yuval Yarom and Naomi Benger]
+
+  *) TLS pad extension: draft-agl-tls-padding-03
+
+     Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
+     TLS client Hello record length value would otherwise be > 255 and
+     less that 512 pad with a dummy extension containing zeroes so it
+     is at least 512 bytes long.
+
+     [Adam Langley, Steve Henson]
+
+ Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
+
+  *) Fix for TLS record tampering bug. A carefully crafted invalid 
+     handshake could crash OpenSSL with a NULL pointer exception.
+     Thanks to Anton Johansson for reporting this issues.
+     (CVE-2013-4353)
+
+  *) Keep original DTLS digest and encryption contexts in retransmission
+     structures so we can use the previous session parameters if they need
+     to be resent. (CVE-2013-6450)
+     [Steve Henson]
+
+  *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
+     avoids preferring ECDHE-ECDSA ciphers when the client appears to be
+     Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
+     several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
+     is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
+     10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
+     [Rob Stradling, Adam Langley]
+
  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
 
-  *)
+  *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
+     supporting platforms or when small records were transferred.
+     [Andy Polyakov, Steve Henson]
 
  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
 
        Add command line options to s_client/s_server.
      [Steve Henson]
 
+ Changes between 1.0.0j and 1.0.0k [5 Feb 2013]
+
+  *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
+
+     This addresses the flaw in CBC record processing discovered by 
+     Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
+     at: http://www.isg.rhul.ac.uk/tls/     
+
+     Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
+     Security Group at Royal Holloway, University of London
+     (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
+     Emilia Käsper for the initial patch.
+     (CVE-2013-0169)
+     [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
+
+  *) Return an error when checking OCSP signatures when key is NULL.
+     This fixes a DoS attack. (CVE-2013-0166)
+     [Steve Henson]
+
+  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
+     the right response is stapled. Also change SSL_get_certificate()
+     so it returns the certificate actually sent.
+     See http://rt.openssl.org/Ticket/Display.html?id=2836.
+     (This is a backport)
+     [Rob Stradling <rob.stradling@comodo.com>]
+
+  *) Fix possible deadlock when decoding public keys.
+     [Steve Henson]
+
+ Changes between 1.0.0i and 1.0.0j [10 May 2012]
+
+  [NB: OpenSSL 1.0.0i and later 1.0.0 patch levels were released after
+  OpenSSL 1.0.1.]
+
+  *) Sanity check record length before skipping explicit IV in DTLS
+     to fix DoS attack.
+
+     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
+     fuzzing as a service testing platform.
+     (CVE-2012-2333)
+     [Steve Henson]
+
+  *) Initialise tkeylen properly when encrypting CMS messages.
+     Thanks to Solar Designer of Openwall for reporting this issue.
+     [Steve Henson]
+
+ Changes between 1.0.0h and 1.0.0i [19 Apr 2012]
+
+  *) Check for potentially exploitable overflows in asn1_d2i_read_bio
+     BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
+     in CRYPTO_realloc_clean.
+
+     Thanks to Tavis Ormandy, Google Security Team, for discovering this
+     issue and to Adam Langley <agl@chromium.org> for fixing it.
+     (CVE-2012-2110)
+     [Adam Langley (Google), Tavis Ormandy, Google Security Team]
+
  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
 
   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
   *) Change 'Configure' script to enable Camellia by default.
      [NTT]
 
+ Changes between 0.9.8x and 0.9.8y [5 Feb 2013]
+
+  *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
+
+     This addresses the flaw in CBC record processing discovered by 
+     Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
+     at: http://www.isg.rhul.ac.uk/tls/     
+
+     Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
+     Security Group at Royal Holloway, University of London
+     (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
+     Emilia Käsper for the initial patch.
+     (CVE-2013-0169)
+     [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
+
+  *) Return an error when checking OCSP signatures when key is NULL.
+     This fixes a DoS attack. (CVE-2013-0166)
+     [Steve Henson]
+
+  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
+     the right response is stapled. Also change SSL_get_certificate()
+     so it returns the certificate actually sent.
+     See http://rt.openssl.org/Ticket/Display.html?id=2836.
+     (This is a backport)
+     [Rob Stradling <rob.stradling@comodo.com>]
+
+  *) Fix possible deadlock when decoding public keys.
+     [Steve Henson]
+
+ Changes between 0.9.8w and 0.9.8x [10 May 2012]
+
+  *) Sanity check record length before skipping explicit IV in DTLS
+     to fix DoS attack.
+
+     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
+     fuzzing as a service testing platform.
+     (CVE-2012-2333)
+     [Steve Henson]
+
+  *) Initialise tkeylen properly when encrypting CMS messages.
+     Thanks to Solar Designer of Openwall for reporting this issue.
+     [Steve Henson]
+
+ Changes between 0.9.8v and 0.9.8w [23 Apr 2012]
+
+  *) The fix for CVE-2012-2110 did not take into account that the 
+     'len' argument to BUF_MEM_grow and BUF_MEM_grow_clean is an
+     int in OpenSSL 0.9.8, making it still vulnerable. Fix by 
+     rejecting negative len parameter. (CVE-2012-2131)
+     [Tomas Hoger <thoger@redhat.com>]
+
+ Changes between 0.9.8u and 0.9.8v [19 Apr 2012]
+
+  *) Check for potentially exploitable overflows in asn1_d2i_read_bio
+     BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
+     in CRYPTO_realloc_clean.
+
+     Thanks to Tavis Ormandy, Google Security Team, for discovering this
+     issue and to Adam Langley <agl@chromium.org> for fixing it.
+     (CVE-2012-2110)
+     [Adam Langley (Google), Tavis Ormandy, Google Security Team]
+
+ Changes between 0.9.8t and 0.9.8u [12 Mar 2012]
+
+  *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
+     in CMS and PKCS7 code. When RSA decryption fails use a random key for
+     content decryption and always return the same error. Note: this attack
+     needs on average 2^20 messages so it only affects automated senders. The
+     old behaviour can be reenabled in the CMS code by setting the
+     CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
+     an MMA defence is not necessary.
+     Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
+     this issue. (CVE-2012-0884)
+     [Steve Henson]
+
+  *) Fix CVE-2011-4619: make sure we really are receiving a 
+     client hello before rejecting multiple SGC restarts. Thanks to
+     Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug.
+     [Steve Henson]
+
  Changes between 0.9.8s and 0.9.8t [18 Jan 2012]
 
   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
      Development, Cisco Systems, Inc. for discovering this bug and
      preparing a fix. (CVE-2012-0050)
      [Antonio Martin]
-  
+
  Changes between 0.9.8r and 0.9.8s [4 Jan 2012]
 
   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
index 35780f8..59d1353 100644 (file)
@@ -768,6 +768,9 @@ openssl-security@openssl.org if you don't get a prompt reply at least
 acknowledging receipt then resend or mail it directly to one of the
 more active team members (e.g. Steve).
 
+Note that bugs only present in the openssl utility are not in general
+considered to be security issues. 
+
 [PROG] ========================================================================
 
 * Is OpenSSL thread-safe?
index 0269f22..ed486d1 100644 (file)
@@ -5,11 +5,24 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e:
+  Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
+
+      o Fix for CVE-2014-0160
+      o Add TLS padding extension workaround for broken servers.
+      o Fix for CVE-2014-0076
+
+  Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]
+
+      o Don't include gmt_unix_time in TLS server and client random values
+      o Fix for TLS record tampering bug CVE-2013-4353
+      o Fix for TLS version checking bug CVE-2013-6449
+      o Fix for DTLS retransmission bug CVE-2013-6450
+
+  Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e [11 Feb 2013]:
 
       o Corrected fix for CVE-2013-0169
 
-  Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d:
+  Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d [4 Feb 2013]:
 
       o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
       o Include the fips configuration module.
       o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
       o Fix for TLS AESNI record handling flaw CVE-2012-2686
 
-  Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c:
+  Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c [10 May 2012]:
 
       o Fix TLS/DTLS record length checking bug CVE-2012-2333
       o Don't attempt to use non-FIPS composite ciphers in FIPS mode.
 
-  Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b:
+  Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b [26 Apr 2012]:
 
       o Fix compilation error on non-x86 platforms.
       o Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
       o Fix SSL_OP_NO_TLSv1_1 clash with SSL_OP_ALL in OpenSSL 1.0.0
 
-  Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a:
+  Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a [19 Apr 2012]:
 
       o Fix for ASN1 overflow bug CVE-2012-2110
       o Workarounds for some servers that hang on long client hellos.
       o Fix SEGV in AES code.
 
-  Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1:
+  Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]:
 
       o TLS/DTLS heartbeat support.
       o SCTP support.
       o Preliminary FIPS capability for unvalidated 2.0 FIPS module.
       o SRP support.
 
-  Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h:
+  Major changes between OpenSSL 1.0.0j and OpenSSL 1.0.0k [5 Feb 2013]:
+
+      o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
+      o Fix OCSP bad key DoS attack CVE-2013-0166
+
+  Major changes between OpenSSL 1.0.0i and OpenSSL 1.0.0j [10 May 2012]:
+
+      o Fix DTLS record length checking bug CVE-2012-2333
+
+  Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.0i [19 Apr 2012]:
+
+      o Fix for ASN1 overflow bug CVE-2012-2110
+
+  Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]:
 
       o Fix for CMS/PKCS#7 MMA CVE-2012-0884
       o Corrected fix for CVE-2011-4619
       o Various DTLS fixes.
 
-  Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g:
+  Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g [18 Jan 2012]:
 
       o Fix for DTLS DoS issue CVE-2012-0050
 
-  Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f:
+  Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f [4 Jan 2012]:
 
       o Fix for DTLS plaintext recovery attack CVE-2011-4108
       o Clear block padding bytes of SSL 3.0 records CVE-2011-4576
@@ -65,7 +91,7 @@
       o Check parameters are not NULL in GOST ENGINE CVE-2012-0027
       o Check for malformed RFC3779 data CVE-2011-4577
 
-  Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e:
+  Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e [6 Sep 2011]:
 
       o Fix for CRL vulnerability issue CVE-2011-3207
       o Fix for ECDH crashes CVE-2011-3210
       o Support ECDH ciphersuites for certificates using SHA2 algorithms.
       o Various DTLS fixes.
 
-  Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d:
+  Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d [8 Feb 2011]:
 
       o Fix for security issue CVE-2011-0014
 
-  Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c:
+  Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c [2 Dec 2010]:
 
       o Fix for security issue CVE-2010-4180
       o Fix for CVE-2010-4252
       o Fix various platform compilation issues.
       o Corrected fix for security issue CVE-2010-3864.
 
-  Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b:
+  Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b [16 Nov 2010]:
 
       o Fix for security issue CVE-2010-3864.
       o Fix for CVE-2010-2939
       o Fix WIN32 build system for GOST ENGINE.
 
-  Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a:
+  Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a [1 Jun 2010]:
 
       o Fix for security issue CVE-2010-1633.
       o GOST MAC and CFB fixes.
 
-  Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0:
+  Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0 [29 Mar 2010]:
 
       o RFC3280 path validation: sufficient to process PKITS tests.
       o Integrated support for PVK files and keyblobs.
       o Opaque PRF Input TLS extension support.
       o Updated time routines to avoid OS limitations.
 
-  Major changes between OpenSSL 0.9.8q and OpenSSL 0.9.8r:
+  Major changes between OpenSSL 0.9.8x and OpenSSL 0.9.8y [5 Feb 2013]:
+
+      o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
+      o Fix OCSP bad key DoS attack CVE-2013-0166
+
+  Major changes between OpenSSL 0.9.8w and OpenSSL 0.9.8x [10 May 2012]:
+
+      o Fix DTLS record length checking bug CVE-2012-2333
+
+  Major changes between OpenSSL 0.9.8v and OpenSSL 0.9.8w [23 Apr 2012]:
+
+      o Fix for CVE-2012-2131 (corrected fix for 0.9.8 and CVE-2012-2110)
+
+  Major changes between OpenSSL 0.9.8u and OpenSSL 0.9.8v [19 Apr 2012]:
+
+      o Fix for ASN1 overflow bug CVE-2012-2110
+
+  Major changes between OpenSSL 0.9.8t and OpenSSL 0.9.8u [12 Mar 2012]:
+
+      o Fix for CMS/PKCS#7 MMA CVE-2012-0884
+      o Corrected fix for CVE-2011-4619
+      o Various DTLS fixes.
+
+  Major changes between OpenSSL 0.9.8s and OpenSSL 0.9.8t [18 Jan 2012]:
+
+      o Fix for DTLS DoS issue CVE-2012-0050
+
+  Major changes between OpenSSL 0.9.8r and OpenSSL 0.9.8s [4 Jan 2012]:
+
+      o Fix for DTLS plaintext recovery attack CVE-2011-4108
+      o Fix policy check double free error CVE-2011-4109
+      o Clear block padding bytes of SSL 3.0 records CVE-2011-4576
+      o Only allow one SGC handshake restart for SSL/TLS CVE-2011-4619
+      o Check for malformed RFC3779 data CVE-2011-4577
+
+  Major changes between OpenSSL 0.9.8q and OpenSSL 0.9.8r [8 Feb 2011]:
 
       o Fix for security issue CVE-2011-0014
 
-  Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q:
+  Major changes between OpenSSL 0.9.8p and OpenSSL 0.9.8q [2 Dec 2010]:
 
       o Fix for security issue CVE-2010-4180
       o Fix for CVE-2010-4252
 
-  Major changes between OpenSSL 0.9.8o and OpenSSL 0.9.8p:
+  Major changes between OpenSSL 0.9.8o and OpenSSL 0.9.8p [16 Nov 2010]:
 
       o Fix for security issue CVE-2010-3864.
 
-  Major changes between OpenSSL 0.9.8n and OpenSSL 0.9.8o:
+  Major changes between OpenSSL 0.9.8n and OpenSSL 0.9.8o [1 Jun 2010]:
 
       o Fix for security issue CVE-2010-0742.
       o Various DTLS fixes.
       o Fix for no-rc4 compilation.
       o Chil ENGINE unload workaround.
 
-  Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n:
+  Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]:
 
       o CFB cipher definition fixes.
       o Fix security issues CVE-2010-0740 and CVE-2010-0433.
 
-  Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m:
+  Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m [25 Feb 2010]:
 
       o Cipher definition fixes.
       o Workaround for slow RAND_poll() on some WIN32 versions.
       o Ticket and SNI coexistence fixes.
       o Many fixes to DTLS handling. 
 
-  Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l:
+  Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]:
 
       o Temporary work around for CVE-2009-3555: disable renegotiation.
 
-  Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k:
+  Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k [25 Mar 2009]:
 
       o Fix various build issues.
       o Fix security issues (CVE-2009-0590, CVE-2009-0591, CVE-2009-0789)
 
-  Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j:
+  Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j [7 Jan 2009]:
 
       o Fix security issue (CVE-2008-5077)
       o Merge FIPS 140-2 branch code.
 
-  Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h:
+  Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h [28 May 2008]:
 
       o CryptoAPI ENGINE support.
       o Various precautionary measures.
       o Fix for bugs affecting certificate request creation.
       o Support for local machine keyset attribute in PKCS#12 files.
 
-  Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g:
+  Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g [19 Oct 2007]:
 
       o Backport of CMS functionality to 0.9.8.
       o Fixes for bugs introduced with 0.9.8f.
 
-  Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f:
+  Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f [11 Oct 2007]:
 
       o Add gcc 4.2 support.
       o Add support for AES and SSE2 assembly lanugauge optimization
       o RFC4507bis support.
       o TLS Extensions support.
 
-  Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e:
+  Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e [23 Feb 2007]:
 
       o Various ciphersuite selection fixes.
       o RFC3779 support.
 
-  Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d:
+  Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d [28 Sep 2006]:
 
       o Introduce limits to prevent malicious key DoS  (CVE-2006-2940)
       o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
       o Changes to ciphersuite selection algorithm
 
-  Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c:
+  Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c [5 Sep 2006]:
 
       o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
       o New cipher Camellia
 
-  Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b:
+  Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b [4 May 2006]:
 
       o Cipher string fixes.
       o Fixes for VC++ 2005.
       o Built in dynamic engine compilation support on Win32.
       o Fixes auto dynamic engine loading in Win32.
 
-  Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a:
+  Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a [11 Oct 2005]:
 
       o Fix potential SSL 2.0 rollback, CVE-2005-2969
       o Extended Windows CE support
 
-  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8:
+  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8 [5 Jul 2005]:
 
       o Major work on the BIGNUM library for higher efficiency and to
         make operations more streamlined and less contradictory.  This
       o Added initial support for Win64.
       o Added alternate pkg-config files.
 
-  Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m:
+  Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m [23 Feb 2007]:
 
       o FIPS 1.1.1 module linking.
       o Various ciphersuite selection fixes.
 
-  Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l:
+  Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l [28 Sep 2006]:
 
       o Introduce limits to prevent malicious key DoS  (CVE-2006-2940)
       o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
 
-  Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k:
+  Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k [5 Sep 2006]:
 
       o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
 
-  Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j:
+  Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j [4 May 2006]:
 
       o Visual C++ 2005 fixes.
       o Update Windows build system for FIPS.
 
-  Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i:
+  Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]:
 
       o Give EVP_MAX_MD_SIZE it's old value, except for a FIPS build.
 
-  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h:
+  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]:
 
       o Fix SSL 2.0 Rollback, CVE-2005-2969
       o Allow use of fixed-length exponent on DSA signing
       o Default fixed-window RSA, DSA, DH private-key operations
 
-  Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g:
+  Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g [11 Apr 2005]:
 
       o More compilation issues fixed.
       o Adaptation to more modern Kerberos API.
       o More constification.
       o Added processing of proxy certificates (RFC 3820).
 
-  Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f:
+  Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f [22 Mar 2005]:
 
       o Several compilation issues fixed.
       o Many memory allocation failure checks added.
       o Mandatory basic checks on certificates.
       o Performance improvements.
 
-  Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e:
+  Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e [25 Oct 2004]:
 
       o Fix race condition in CRL checking code.
       o Fixes to PKCS#7 (S/MIME) code.
 
-  Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d:
+  Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d [17 Mar 2004]:
 
       o Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
       o Security: Fix null-pointer assignment in do_change_cipher_spec()
       o Multiple X509 verification fixes
       o Speed up HMAC and other operations
 
-  Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c:
+  Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c [30 Sep 2003]:
 
       o Security: fix various ASN1 parsing bugs.
       o New -ignore_err option to OCSP utility.
       o Various interop and bug fixes in S/MIME code.
       o SSL/TLS protocol fix for unrequested client certificates.
 
-  Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b:
+  Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]:
 
       o Security: counter the Klima-Pokorny-Rosa extension of
         Bleichbacher's attack 
       o ASN.1: treat domainComponent correctly.
       o Documentation: fixes and additions.
 
-  Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a:
+  Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a [19 Feb 2003]:
 
       o Security: Important security related bugfixes.
       o Enhanced compatibility with MIT Kerberos.
       o SSL/TLS: now handles manual certificate chain building.
       o SSL/TLS: certain session ID malfunctions corrected.
 
-  Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7:
+  Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7 [30 Dec 2002]:
 
       o New library section OCSP.
       o Complete rewrite of ASN1 code.
       o SSL/TLS: add callback to retrieve SSL/TLS messages.
       o SSL/TLS: support AES cipher suites (RFC3268).
 
-  Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k:
+  Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k [30 Sep 2003]:
 
       o Security: fix various ASN1 parsing bugs.
       o SSL/TLS protocol fix for unrequested client certificates.
 
-  Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j:
+  Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]:
 
       o Security: counter the Klima-Pokorny-Rosa extension of
         Bleichbacher's attack 
       o Security: make RSA blinding default.
       o Build: shared library support fixes.
 
-  Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i:
+  Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i [19 Feb 2003]:
 
       o Important security related bugfixes.
 
-  Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h:
+  Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h [5 Dec 2002]:
 
       o New configuration targets for Tandem OSS and A/UX.
       o New OIDs for Microsoft attributes.
       o Fixes for smaller building problems.
       o Updates of manuals, FAQ and other instructive documents.
 
-  Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g:
+  Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g [9 Aug 2002]:
 
       o Important building fixes on Unix.
 
-  Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f:
+  Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f [8 Aug 2002]:
 
       o Various important bugfixes.
 
-  Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e:
+  Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e [30 Jul 2002]:
 
       o Important security related bugfixes.
       o Various SSL/TLS library bugfixes.
 
-  Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d:
+  Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d [9 May 2002]:
 
       o Various SSL/TLS library bugfixes.
       o Fix DH parameter generation for 'non-standard' generators.
 
-  Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c:
+  Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c [21 Dec 2001]:
 
       o Various SSL/TLS library bugfixes.
       o BIGNUM library fixes.
         Broadcom and Cryptographic Appliance's keyserver
         [in 0.9.6c-engine release].
 
-  Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b:
+  Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b [9 Jul 2001]:
 
       o Security fix: PRNG improvements.
       o Security fix: RSA OAEP check.
       o Increase default size for BIO buffering filter.
       o Compatibility fixes in some scripts.
 
-  Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a:
+  Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a [5 Apr 2001]:
 
       o Security fix: change behavior of OpenSSL to avoid using
         environment variables when running as root.
       o New function BN_rand_range().
       o Add "-rand" option to openssl s_client and s_server.
 
-  Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6:
+  Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6 [10 Oct 2000]:
 
       o Some documentation for BIO and SSL libraries.
       o Enhanced chain verification using key identifiers.
     [1] The support for external crypto devices is currently a separate
         distribution.  See the file README.ENGINE.
 
-  Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a:
+  Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]:
 
       o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8 
       o Shared library support for HPUX and Solaris-gcc
       o New 'rand' application
       o New way to check for existence of algorithms from scripts
 
-  Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5:
+  Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5 [25 May 2000]:
 
       o S/MIME support in new 'smime' command
       o Documentation for the OpenSSL command line application
       o Enhanced support for Alpha Linux
       o Experimental MacOS support
 
-  Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4:
+  Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4 [9 Aug 1999]:
 
       o Transparent support for PKCS#8 format private keys: these are used
         by several software packages and are more secure than the standard
       o New pipe-like BIO that allows using the SSL library when actual I/O
         must be handled by the application (BIO pair)
 
-  Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3:
+  Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3 [24 May 1999]:
       o Lots of enhancements and cleanups to the Configuration mechanism
       o RSA OEAP related fixes
       o Added `openssl ca -revoke' option for revoking a certificate
       o Sparc assembler bignum implementation, optimized hash functions
       o Option to disable selected ciphers
 
-  Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b:
+  Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b [22 Mar 1999]:
       o Fixed a security hole related to session resumption
       o Fixed RSA encryption routines for the p < q case
       o "ALL" in cipher lists now means "everything except NULL ciphers"
       o Lots of memory leak fixes.
       o Lots of bug fixes.
 
-  Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c:
+  Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c [23 Dec 1998]:
       o Integration of the popular NO_RSA/NO_DSA patches
       o Initial support for compression inside the SSL record layer
       o Added BIO proxy and filtering functionality
index ad2d90f..10b74d1 100644 (file)
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.1e 11 Feb 2013
+ OpenSSL 1.0.1g 7 Apr 2014
 
  Copyright (c) 1998-2011 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
index d17c4b6..3b5b1d6 100644 (file)
@@ -20,6 +20,7 @@ VMS/
 apps/CA.com
 apps/CA.pl.in
 apps/Makefile
+apps/Makefile.save
 apps/ca-cert.srl
 apps/ca-key.pem
 apps/ca-req.pem
@@ -69,7 +70,9 @@ crypto/LPdir_win.c
 crypto/LPdir_win32.c
 crypto/LPdir_wince.c
 crypto/Makefile
+crypto/Makefile.save
 crypto/aes/Makefile
+crypto/aes/Makefile.save
 crypto/aes/aes_x86core.c
 crypto/aes/asm/aes-armv4.pl
 crypto/aes/asm/aes-ia64.S
@@ -83,9 +86,11 @@ crypto/arm_arch.h
 crypto/armcap.c
 crypto/armv4cpuid.S
 crypto/asn1/Makefile
+crypto/asn1/Makefile.save
 crypto/asn1/charmap.pl
 crypto/bf/INSTALL
 crypto/bf/Makefile
+crypto/bf/Makefile.save
 crypto/bf/asm/bf-686.pl
 crypto/bf/asm/readme
 crypto/bf/bf_cbc.c
@@ -94,8 +99,10 @@ crypto/bf/bfs.cpp
 crypto/bf/bfspeed.c
 crypto/bf/bftest.c
 crypto/bio/Makefile
+crypto/bio/Makefile.save
 crypto/bio/bss_rtcp.c
 crypto/bn/Makefile
+crypto/bn/Makefile.save
 crypto/bn/asm/README
 crypto/bn/asm/alpha-mont.pl
 crypto/bn/asm/armv4-gf2m.pl
@@ -133,17 +140,24 @@ crypto/bn/expspeed.c
 crypto/bn/exptest.c
 crypto/bn/vms-helper.c
 crypto/buffer/Makefile
+crypto/buffer/Makefile.save
 crypto/camellia/Makefile
+crypto/camellia/Makefile.save
 crypto/cast/Makefile
+crypto/cast/Makefile.save
 crypto/cast/asm/
 crypto/cast/cast_spd.c
 crypto/cast/castopts.c
 crypto/cast/casts.cpp
 crypto/cast/casttest.c
 crypto/cmac/Makefile
+crypto/cmac/Makefile.save
 crypto/cms/Makefile
+crypto/cms/Makefile.save
 crypto/comp/Makefile
+crypto/comp/Makefile.save
 crypto/conf/Makefile
+crypto/conf/Makefile.save
 crypto/conf/cnf_save.c
 crypto/conf/keysets.pl
 crypto/conf/ssleay.cnf
@@ -156,6 +170,7 @@ crypto/des/INSTALL
 crypto/des/Imakefile
 crypto/des/KERBEROS
 crypto/des/Makefile
+crypto/des/Makefile.save
 crypto/des/asm/des_enc.m4
 crypto/des/asm/readme
 crypto/des/des-lib.com
@@ -174,6 +189,7 @@ crypto/des/t/
 crypto/des/times/
 crypto/des/typemap
 crypto/dh/Makefile
+crypto/dh/Makefile.save
 crypto/dh/dh1024.pem
 crypto/dh/dh192.pem
 crypto/dh/dh2048.pem
@@ -186,52 +202,68 @@ crypto/dh/p1024.c
 crypto/dh/p192.c
 crypto/dh/p512.c
 crypto/dsa/Makefile
+crypto/dsa/Makefile.save
 crypto/dsa/dsagen.c
 crypto/dsa/dsatest.c
 crypto/dso/Makefile
+crypto/dso/Makefile.save
 crypto/dso/dso_beos.c
 crypto/dso/dso_vms.c
 crypto/dso/dso_win32.c
 crypto/ec/Makefile
+crypto/ec/Makefile.save
 crypto/ec/ectest.c
 crypto/ecdh/Makefile
+crypto/ecdh/Makefile.save
 crypto/ecdh/ecdhtest.c
 crypto/ecdsa/Makefile
+crypto/ecdsa/Makefile.save
 crypto/ecdsa/ecdsatest.c
 crypto/engine/Makefile
+crypto/engine/Makefile.save
 crypto/engine/enginetest.c
 crypto/err/Makefile
+crypto/err/Makefile.save
 crypto/err/openssl.ec
 crypto/evp/Makefile
+crypto/evp/Makefile.save
 crypto/evp/e_dsa.c
 crypto/evp/evp_test.c
 crypto/evp/evptests.txt
 crypto/fips_err.h
 crypto/hmac/Makefile
+crypto/hmac/Makefile.save
 crypto/hmac/hmactest.c
 crypto/ia64cpuid.S
 crypto/idea/Makefile
+crypto/idea/Makefile.save
 crypto/idea/idea_spd.c
 crypto/idea/ideatest.c
 crypto/install-crypto.com
 crypto/jpake/
 crypto/krb5/Makefile
+crypto/krb5/Makefile.save
 crypto/lhash/Makefile
+crypto/lhash/Makefile.save
 crypto/lhash/lh_test.c
 crypto/lhash/num.pl
 crypto/md2/
 crypto/md4/Makefile
+crypto/md4/Makefile.save
 crypto/md4/md4.c
 crypto/md4/md4s.cpp
 crypto/md4/md4test.c
 crypto/md5/Makefile
+crypto/md5/Makefile.save
 crypto/md5/asm/md5-ia64.S
 crypto/md5/md5.c
 crypto/md5/md5s.cpp
 crypto/md5/md5test.c
 crypto/mdc2/Makefile
+crypto/mdc2/Makefile.save
 crypto/mdc2/mdc2test.c
 crypto/modes/Makefile
+crypto/modes/Makefile.save
 crypto/modes/asm/ghash-alpha.pl
 crypto/modes/asm/ghash-armv4.pl
 crypto/modes/asm/ghash-ia64.pl
@@ -242,6 +274,7 @@ crypto/o_dir_test.c
 crypto/o_str.c
 crypto/o_str.h
 crypto/objects/Makefile
+crypto/objects/Makefile.save
 crypto/objects/obj_dat.pl
 crypto/objects/obj_mac.num
 crypto/objects/obj_xref.txt
@@ -249,17 +282,21 @@ crypto/objects/objects.pl
 crypto/objects/objects.txt
 crypto/objects/objxref.pl
 crypto/ocsp/Makefile
+crypto/ocsp/Makefile.save
 crypto/opensslconf.h
 crypto/opensslconf.h.in
 crypto/pariscid.pl
 crypto/pem/Makefile
+crypto/pem/Makefile.save
 crypto/pem/pkcs7.lis
 crypto/perlasm/ppc-xlate.pl
 crypto/perlasm/readme
 crypto/perlasm/x86masm.pl
 crypto/perlasm/x86nasm.pl
 crypto/pkcs12/Makefile
+crypto/pkcs12/Makefile.save
 crypto/pkcs7/Makefile
+crypto/pkcs7/Makefile.save
 crypto/pkcs7/bio_ber.c
 crypto/pkcs7/dec.c
 crypto/pkcs7/des.pem
@@ -277,17 +314,21 @@ crypto/pkcs7/verify.c
 crypto/ppccap.c
 crypto/ppccpuid.pl
 crypto/pqueue/Makefile
+crypto/pqueue/Makefile.save
 crypto/rand/Makefile
+crypto/rand/Makefile.save
 crypto/rand/rand_os2.c
 crypto/rand/rand_vms.c
 crypto/rand/rand_win.c
 crypto/rand/randtest.c
 crypto/rc2/Makefile
+crypto/rc2/Makefile.save
 crypto/rc2/rc2speed.c
 crypto/rc2/rc2test.c
 crypto/rc2/rrc2.doc
 crypto/rc2/tab.c
 crypto/rc4/Makefile
+crypto/rc4/Makefile.save
 crypto/rc4/asm/rc4-ia64.pl
 crypto/rc4/asm/rc4-parisc.pl
 crypto/rc4/asm/rc4-s390x.pl
@@ -298,15 +339,19 @@ crypto/rc4/rc4test.c
 crypto/rc4/rrc4.doc
 crypto/rc5/
 crypto/ripemd/Makefile
+crypto/ripemd/Makefile.save
 crypto/ripemd/asm/rips.cpp
 crypto/ripemd/rmd160.c
 crypto/ripemd/rmdtest.c
 crypto/rsa/Makefile
+crypto/rsa/Makefile.save
 crypto/rsa/rsa_test.c
 crypto/s390xcap.c
 crypto/s390xcpuid.S
 crypto/seed/Makefile
+crypto/seed/Makefile.save
 crypto/sha/Makefile
+crypto/sha/Makefile.save
 crypto/sha/asm/README
 crypto/sha/asm/sha1-alpha.pl
 crypto/sha/asm/sha1-armv4-large.pl
@@ -335,8 +380,10 @@ crypto/sha/shatest.c
 crypto/sparccpuid.S
 crypto/sparcv9cap.c
 crypto/srp/Makefile
+crypto/srp/Makefile.save
 crypto/srp/srptest.c
 crypto/stack/Makefile
+crypto/stack/Makefile.save
 crypto/store/
 crypto/threads/mttest.c
 crypto/threads/netware.bat
@@ -349,13 +396,19 @@ crypto/threads/purify.sh
 crypto/threads/solaris.sh
 crypto/threads/win32.bat
 crypto/ts/Makefile
+crypto/ts/Makefile.save
 crypto/txt_db/Makefile
+crypto/txt_db/Makefile.save
 crypto/ui/Makefile
+crypto/ui/Makefile.save
 crypto/vms_rms.h
 crypto/whrlpool/Makefile
+crypto/whrlpool/Makefile.save
 crypto/whrlpool/wp_test.c
 crypto/x509/Makefile
+crypto/x509/Makefile.save
 crypto/x509v3/Makefile
+crypto/x509v3/Makefile.save
 crypto/x509v3/tabtest.c
 crypto/x509v3/v3conf.c
 crypto/x509v3/v3prin.c
@@ -371,10 +424,12 @@ doc/openssl_button.html
 doc/ssleay.txt
 doc/standards.txt
 engines/Makefile
+engines/Makefile.save
 engines/alpha.opt
 engines/axp.opt
 engines/capierr.bat
 engines/ccgost/Makefile
+engines/ccgost/Makefile.save
 engines/ccgost/e_gost_err.proto
 engines/ccgost/gost.ec
 engines/e_4758cca.ec
@@ -402,6 +457,7 @@ os2/
 perl/
 shlib/
 ssl/Makefile
+ssl/Makefile.save
 ssl/install-ssl.com
 ssl/ssl-lib.com
 ssl/ssl_task.c
index 1096eee..b76db10 100644 (file)
@@ -586,12 +586,12 @@ int password_callback(char *buf, int bufsiz, int verify,
 
                if (ok >= 0)
                        ok = UI_add_input_string(ui,prompt,ui_flags,buf,
-                               PW_MIN_LENGTH,BUFSIZ-1);
+                               PW_MIN_LENGTH,bufsiz-1);
                if (ok >= 0 && verify)
                        {
                        buff = (char *)OPENSSL_malloc(bufsiz);
                        ok = UI_add_verify_string(ui,prompt,ui_flags,buff,
-                               PW_MIN_LENGTH,BUFSIZ-1, buf);
+                               PW_MIN_LENGTH,bufsiz-1, buf);
                        }
                if (ok >= 0)
                        do
@@ -2841,7 +2841,7 @@ double app_tminterval(int stop,int usertime)
 
        if (proc==NULL)
                {
-               if (GetVersion() < 0x80000000)
+               if (check_winnt())
                        proc = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,
                                                GetCurrentProcessId());
                if (proc==NULL) proc = (HANDLE)-1;
index c1ca99d..3aeb46c 100644 (file)
@@ -188,6 +188,7 @@ extern BIO *bio_err;
                        do { CONF_modules_unload(1); destroy_ui_method(); \
                        OBJ_cleanup(); EVP_cleanup(); ENGINE_cleanup(); \
                        CRYPTO_cleanup_all_ex_data(); ERR_remove_thread_state(NULL); \
+                       RAND_cleanup(); \
                        ERR_free_strings(); zlib_cleanup();} while(0)
 #  else
 #    define apps_startup() \
@@ -198,6 +199,7 @@ extern BIO *bio_err;
                        do { CONF_modules_unload(1); destroy_ui_method(); \
                        OBJ_cleanup(); EVP_cleanup(); \
                        CRYPTO_cleanup_all_ex_data(); ERR_remove_thread_state(NULL); \
+                       RAND_cleanup(); \
                        ERR_free_strings(); zlib_cleanup(); } while(0)
 #  endif
 #endif
index c395b2a..8797d30 100644 (file)
@@ -81,6 +81,9 @@ static const char *crl_usage[]={
 " -in arg         - input file - default stdin\n",
 " -out arg        - output file - default stdout\n",
 " -hash           - print hash value\n",
+#ifndef OPENSSL_NO_MD5
+" -hash_old       - print old-style (MD5) hash value\n",
+#endif
 " -fingerprint    - print the crl fingerprint\n",
 " -issuer         - print issuer DN\n",
 " -lastupdate     - lastUpdate field\n",
@@ -108,6 +111,9 @@ int MAIN(int argc, char **argv)
        int informat,outformat;
        char *infile=NULL,*outfile=NULL;
        int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
+#ifndef OPENSSL_NO_MD5
+       int hash_old=0;
+#endif
        int fingerprint = 0, crlnumber = 0;
        const char **pp;
        X509_STORE *store = NULL;
@@ -192,6 +198,10 @@ int MAIN(int argc, char **argv)
                        text = 1;
                else if (strcmp(*argv,"-hash") == 0)
                        hash= ++num;
+#ifndef OPENSSL_NO_MD5
+               else if (strcmp(*argv,"-hash_old") == 0)
+                       hash_old= ++num;
+#endif
                else if (strcmp(*argv,"-nameopt") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -304,6 +314,14 @@ bad:
                                BIO_printf(bio_out,"%08lx\n",
                                        X509_NAME_hash(X509_CRL_get_issuer(x)));
                                }
+#ifndef OPENSSL_NO_MD5
+                       if (hash_old == i)
+                               {
+                               BIO_printf(bio_out,"%08lx\n",
+                                       X509_NAME_hash_old(
+                                               X509_CRL_get_issuer(x)));
+                               }
+#endif
                        if (lastupdate == i)
                                {
                                BIO_printf(bio_out,"lastUpdate=");
index 81bd870..f4aec77 100644 (file)
@@ -427,9 +427,9 @@ int MAIN(int argc, char **argv)
                        goto end;
                        }
                if (do_verify)
-                       r = EVP_DigestVerifyInit(mctx, &pctx, md, e, sigkey);
+                       r = EVP_DigestVerifyInit(mctx, &pctx, md, NULL, sigkey);
                else
-                       r = EVP_DigestSignInit(mctx, &pctx, md, e, sigkey);
+                       r = EVP_DigestSignInit(mctx, &pctx, md, NULL, sigkey);
                if (!r)
                        {
                        BIO_printf(bio_err, "Error setting context\n");
index 465480b..976ebef 100644 (file)
  *                    in the asn1 der encoding
  *                    possible values: named_curve (default)
  *                                     explicit
- * -no_seed         - if 'explicit' parameters are choosen do not use the seed
+ * -no_seed         - if 'explicit' parameters are chosen do not use the seed
  * -genkey          - generate ec key
  * -rand file       - files to use for random number input
  * -engine e        - use engine e, possibly a hardware device
@@ -286,7 +286,7 @@ bad:
                BIO_printf(bio_err, "                                   "
                                " explicit\n");
                BIO_printf(bio_err, " -no_seed          if 'explicit'"
-                               " parameters are choosen do not"
+                               " parameters are chosen do not"
                                " use the seed\n");
                BIO_printf(bio_err, " -genkey           generate ec"
                                " key\n");
index 1c880d9..71e1e48 100644 (file)
 #include "apps.h"
 #include <openssl/bio.h>
 #include <openssl/crypto.h>
+#include <openssl/rand.h>
 #include <openssl/lhash.h>
 #include <openssl/conf.h>
 #include <openssl/x509.h>
index b54c6f8..4d62a7b 100644 (file)
@@ -112,7 +112,7 @@ int MAIN(int argc, char **argv)
     int maciter = PKCS12_DEFAULT_ITER;
     int twopass = 0;
     int keytype = 0;
-    int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
+    int cert_pbe;
     int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
     int ret = 1;
     int macver = 1;
@@ -130,6 +130,13 @@ int MAIN(int argc, char **argv)
 
     apps_startup();
 
+#ifdef OPENSSL_FIPS
+    if (FIPS_mode())
+       cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
+    else
+#endif
+    cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
+
     enc = EVP_des_ede3_cbc();
     if (bio_err == NULL ) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
 
index 8552658..5e034a8 100644 (file)
@@ -644,6 +644,11 @@ bad:
                if (inrand)
                        app_RAND_load_files(inrand);
 
+               if (!NCONF_get_number(req_conf,SECTION,BITS, &newkey))
+                       {
+                       newkey=DEFAULT_KEY_LENGTH;
+                       }
+
                if (keyalg)
                        {
                        genctx = set_keygen_ctx(bio_err, keyalg, &pkey_type, &newkey,
@@ -652,12 +657,6 @@ bad:
                                goto end;
                        }
        
-               if (newkey <= 0)
-                       {
-                       if (!NCONF_get_number(req_conf,SECTION,BITS, &newkey))
-                               newkey=DEFAULT_KEY_LENGTH;
-                       }
-
                if (newkey < MIN_KEY_LENGTH && (pkey_type == EVP_PKEY_RSA || pkey_type == EVP_PKEY_DSA))
                        {
                        BIO_printf(bio_err,"private key length is too short,\n");
@@ -1649,6 +1648,8 @@ static EVP_PKEY_CTX *set_keygen_ctx(BIO *err, const char *gstr, int *pkey_type,
                                keylen = atol(p + 1);
                                *pkeylen = keylen;
                                }
+                       else
+                               keylen = *pkeylen;
                        }
                else if (p)
                        paramfile = p + 1;
index ceb02b5..41b90f0 100644 (file)
@@ -83,9 +83,9 @@
 # Add decryption procedure. Performance in CPU cycles spent to decrypt
 # one byte out of 4096-byte buffer with 128-bit key is:
 #
-# Core 2       11.0
-# Nehalem      9.16
-# Atom         20.9
+# Core 2       9.83
+# Nehalem      7.74
+# Atom         19.0
 #
 # November 2011.
 #
@@ -456,6 +456,7 @@ sub MixColumns {
 # modified to emit output in order suitable for feeding back to aesenc[last]
 my @x=@_[0..7];
 my @t=@_[8..15];
+my $inv=@_[16];        # optional
 $code.=<<___;
        pshufd  \$0x93, @x[0], @t[0]    # x0 <<< 32
        pshufd  \$0x93, @x[1], @t[1]
@@ -497,7 +498,8 @@ $code.=<<___;
        pxor    @t[4], @t[0]
         pshufd \$0x4E, @x[2], @x[6]
        pxor    @t[5], @t[1]
-
+___
+$code.=<<___ if (!$inv);
        pxor    @t[3], @x[4]
        pxor    @t[7], @x[5]
        pxor    @t[6], @x[3]
@@ -505,9 +507,20 @@ $code.=<<___;
        pxor    @t[2], @x[6]
         movdqa @t[1], @x[7]
 ___
+$code.=<<___ if ($inv);
+       pxor    @x[4], @t[3]
+       pxor    @t[7], @x[5]
+       pxor    @x[3], @t[6]
+        movdqa @t[0], @x[3]
+       pxor    @t[2], @x[6]
+        movdqa @t[6], @x[2]
+        movdqa @t[1], @x[7]
+        movdqa @x[6], @x[4]
+        movdqa @t[3], @x[6]
+___
 }
 
-sub InvMixColumns {
+sub InvMixColumns_orig {
 my @x=@_[0..7];
 my @t=@_[8..15];
 
@@ -661,6 +674,54 @@ $code.=<<___;
 ___
 }
 
+sub InvMixColumns {
+my @x=@_[0..7];
+my @t=@_[8..15];
+
+# Thanks to Jussi Kivilinna for providing pointer to
+#
+# | 0e 0b 0d 09 |   | 02 03 01 01 |   | 05 00 04 00 |
+# | 09 0e 0b 0d | = | 01 02 03 01 | x | 00 05 00 04 |
+# | 0d 09 0e 0b |   | 01 01 02 03 |   | 04 00 05 00 |
+# | 0b 0d 09 0e |   | 03 01 01 02 |   | 00 04 00 05 |
+
+$code.=<<___;
+       # multiplication by 0x05-0x00-0x04-0x00
+       pshufd  \$0x4E, @x[0], @t[0]
+       pshufd  \$0x4E, @x[6], @t[6]
+       pxor    @x[0], @t[0]
+       pshufd  \$0x4E, @x[7], @t[7]
+       pxor    @x[6], @t[6]
+       pshufd  \$0x4E, @x[1], @t[1]
+       pxor    @x[7], @t[7]
+       pshufd  \$0x4E, @x[2], @t[2]
+       pxor    @x[1], @t[1]
+       pshufd  \$0x4E, @x[3], @t[3]
+       pxor    @x[2], @t[2]
+        pxor   @t[6], @x[0]
+        pxor   @t[6], @x[1]
+       pshufd  \$0x4E, @x[4], @t[4]
+       pxor    @x[3], @t[3]
+        pxor   @t[0], @x[2]
+        pxor   @t[1], @x[3]
+       pshufd  \$0x4E, @x[5], @t[5]
+       pxor    @x[4], @t[4]
+        pxor   @t[7], @x[1]
+        pxor   @t[2], @x[4]
+       pxor    @x[5], @t[5]
+
+        pxor   @t[7], @x[2]
+        pxor   @t[6], @x[3]
+        pxor   @t[6], @x[4]
+        pxor   @t[3], @x[5]
+        pxor   @t[4], @x[6]
+        pxor   @t[7], @x[4]
+        pxor   @t[7], @x[5]
+        pxor   @t[5], @x[7]
+___
+       &MixColumns     (@x,@t,1);      # flipped 2<->3 and 4<->6
+}
+
 sub aesenc {                           # not used
 my @b=@_[0..7];
 my @t=@_[8..15];
@@ -2028,6 +2089,8 @@ ___
 #      const unsigned char iv[16]);
 #
 my ($twmask,$twres,$twtmp)=@XMM[13..15];
+$arg6=~s/d$//;
+
 $code.=<<___;
 .globl bsaes_xts_encrypt
 .type  bsaes_xts_encrypt,\@abi-omnipotent
index 41f2e46..bd7f45b 100644 (file)
@@ -1060,7 +1060,7 @@ _vpaes_consts:
 .Lk_dsbo:      # decryption sbox final output
        .quad   0x1387EA537EF94000, 0xC7AA6DB9D4943E2D
        .quad   0x12D7560F93441D00, 0xCA4B8159D8C58E9C
-.asciz "Vector Permutaion AES for x86_64/SSSE3, Mike Hamburg (Stanford University)"
+.asciz "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)"
 .align 64
 .size  _vpaes_consts,.-_vpaes_consts
 ___
index ad0d250..297c45a 100644 (file)
@@ -116,7 +116,7 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
        int pad=0,ret,i,neg;
        unsigned char *p,*n,pb=0;
 
-       if ((a == NULL) || (a->data == NULL)) return(0);
+       if (a == NULL) return(0);
        neg=a->type & V_ASN1_NEG;
        if (a->length == 0)
                ret=1;
index 1a30bf1..aa60203 100644 (file)
@@ -305,7 +305,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE),"unknown public key type"},
 {ERR_REASON(ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM),"unknown signature algorithm"},
 {ERR_REASON(ASN1_R_UNKNOWN_TAG)          ,"unknown tag"},
-{ERR_REASON(ASN1_R_UNKOWN_FORMAT)        ,"unkown format"},
+{ERR_REASON(ASN1_R_UNKOWN_FORMAT)        ,"unknown format"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE),"unsupported any defined by type"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_CIPHER)   ,"unsupported cipher"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM),"unsupported encryption algorithm"},
index 8990909..54c012c 100644 (file)
@@ -906,8 +906,8 @@ BIO *BIO_new_dgram_sctp(int fd, int close_flag)
        memset(authchunks, 0, sizeof(sockopt_len));
        ret = getsockopt(fd, IPPROTO_SCTP, SCTP_LOCAL_AUTH_CHUNKS, authchunks, &sockopt_len);
        OPENSSL_assert(ret >= 0);
-       
-       for (p = (unsigned char*) authchunks + sizeof(sctp_assoc_t);
+
+       for (p = (unsigned char*) authchunks->gauth_chunks;
             p < (unsigned char*) authchunks + sockopt_len;
             p += sizeof(uint8_t))
                {
@@ -1197,7 +1197,7 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
                        ii = getsockopt(b->num, IPPROTO_SCTP, SCTP_PEER_AUTH_CHUNKS, authchunks, &optlen);
                        OPENSSL_assert(ii >= 0);
 
-                       for (p = (unsigned char*) authchunks + sizeof(sctp_assoc_t);
+                       for (p = (unsigned char*) authchunks->gauth_chunks;
                                 p < (unsigned char*) authchunks + optlen;
                                 p += sizeof(uint8_t))
                                {
index b7dce5c..2227b2b 100644 (file)
@@ -245,7 +245,7 @@ static int MS_CALLBACK slg_puts(BIO *bp, const char *str)
 
 static void xopenlog(BIO* bp, char* name, int level)
 {
-       if (GetVersion() < 0x80000000)
+       if (check_winnt())
                bp->ptr = RegisterEventSourceA(NULL,name);
        else
                bp->ptr = NULL;
index a30d4ef..226c66c 100644 (file)
@@ -31,7 +31,8 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
 die "can't locate x86_64-xlate.pl";
 
-open STDOUT,"| \"$^X\" $xlate $flavour $output";
+open OUT,"| \"$^X\" $xlate $flavour $output";
+*STDOUT=*OUT;
 
 ($lo,$hi)=("%rax","%rdx");     $a=$lo;
 ($i0,$i1)=("%rsi","%rdi");
index 8f8dc5a..dae0fe2 100755 (executable)
@@ -901,8 +901,8 @@ $code.=<<___;
        jnz     .Lgather
 ___
 $code.=<<___ if ($win64);
-       movaps  %xmm6,(%rsp)
-       movaps  %xmm7,0x10(%rsp)
+       movaps  (%rsp),%xmm6
+       movaps  0x10(%rsp),%xmm7
        lea     0x28(%rsp),%rsp
 ___
 $code.=<<___;
index f34248e..21a1a3f 100644 (file)
@@ -538,6 +538,8 @@ BIGNUM *BN_mod_inverse(BIGNUM *ret,
 BIGNUM *BN_mod_sqrt(BIGNUM *ret,
        const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
 
+void   BN_consttime_swap(BN_ULONG swap, BIGNUM *a, BIGNUM *b, int nwords);
+
 /* Deprecated versions */
 #ifndef OPENSSL_NO_DEPRECATED
 BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int safe,
@@ -774,11 +776,20 @@ int RAND_pseudo_bytes(unsigned char *buf,int num);
 
 #define bn_fix_top(a)          bn_check_top(a)
 
+#define bn_check_size(bn, bits) bn_wcheck_size(bn, ((bits+BN_BITS2-1))/BN_BITS2)
+#define bn_wcheck_size(bn, words) \
+       do { \
+               const BIGNUM *_bnum2 = (bn); \
+               assert(words <= (_bnum2)->dmax && words >= (_bnum2)->top); \
+       } while(0)
+
 #else /* !BN_DEBUG */
 
 #define bn_pollute(a)
 #define bn_check_top(a)
 #define bn_fix_top(a)          bn_correct_top(a)
+#define bn_check_size(bn, bits)
+#define bn_wcheck_size(bn, words)
 
 #endif
 
index 7a5676d..5461e6e 100644 (file)
@@ -824,3 +824,55 @@ int bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b,
                }
        return bn_cmp_words(a,b,cl);
        }
+
+/* 
+ * Constant-time conditional swap of a and b.  
+ * a and b are swapped if condition is not 0.  The code assumes that at most one bit of condition is set.
+ * nwords is the number of words to swap.  The code assumes that at least nwords are allocated in both a and b,
+ * and that no more than nwords are used by either a or b.
+ * a and b cannot be the same number
+ */
+void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
+       {
+       BN_ULONG t;
+       int i;
+
+       bn_wcheck_size(a, nwords);
+       bn_wcheck_size(b, nwords);
+
+       assert(a != b);
+       assert((condition & (condition - 1)) == 0);
+       assert(sizeof(BN_ULONG) >= sizeof(int));
+
+       condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;
+
+       t = (a->top^b->top) & condition;
+       a->top ^= t;
+       b->top ^= t;
+
+#define BN_CONSTTIME_SWAP(ind) \
+       do { \
+               t = (a->d[ind] ^ b->d[ind]) & condition; \
+               a->d[ind] ^= t; \
+               b->d[ind] ^= t; \
+       } while (0)
+
+
+       switch (nwords) {
+       default:
+               for (i = 10; i < nwords; i++) 
+                       BN_CONSTTIME_SWAP(i);
+               /* Fallthrough */
+       case 10: BN_CONSTTIME_SWAP(9); /* Fallthrough */
+       case 9: BN_CONSTTIME_SWAP(8); /* Fallthrough */
+       case 8: BN_CONSTTIME_SWAP(7); /* Fallthrough */
+       case 7: BN_CONSTTIME_SWAP(6); /* Fallthrough */
+       case 6: BN_CONSTTIME_SWAP(5); /* Fallthrough */
+       case 5: BN_CONSTTIME_SWAP(4); /* Fallthrough */
+       case 4: BN_CONSTTIME_SWAP(3); /* Fallthrough */
+       case 3: BN_CONSTTIME_SWAP(2); /* Fallthrough */
+       case 2: BN_CONSTTIME_SWAP(1); /* Fallthrough */
+       case 1: BN_CONSTTIME_SWAP(0);
+       }
+#undef BN_CONSTTIME_SWAP
+}
index 43caee4..e22968d 100644 (file)
@@ -286,26 +286,25 @@ const BIGNUM *BN_get0_nist_prime_521(void)
        }
 
 
-static void nist_cp_bn_0(BN_ULONG *buf, BN_ULONG *a, int top, int max)
+static void nist_cp_bn_0(BN_ULONG *dst, const BN_ULONG *src, int top, int max)
        {
        int i;
-       BN_ULONG *_tmp1 = (buf), *_tmp2 = (a);
 
 #ifdef BN_DEBUG
        OPENSSL_assert(top <= max);
 #endif
-       for (i = (top); i != 0; i--)
-               *_tmp1++ = *_tmp2++;
-       for (i = (max) - (top); i != 0; i--)
-               *_tmp1++ = (BN_ULONG) 0;
+       for (i = 0; i < top; i++)
+               dst[i] = src[i];
+       for (; i < max; i++)
+               dst[i] = 0;
        }
 
-static void nist_cp_bn(BN_ULONG *buf, BN_ULONG *a, int top)
+static void nist_cp_bn(BN_ULONG *dst, const BN_ULONG *src, int top)
        { 
        int i;
-       BN_ULONG *_tmp1 = (buf), *_tmp2 = (a);
-       for (i = (top); i != 0; i--)
-               *_tmp1++ = *_tmp2++;
+
+       for (i = 0; i < top; i++)
+               dst[i] = src[i];
        }
 
 #if BN_BITS2 == 64
@@ -451,8 +450,9 @@ int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
         */
        mask  = 0-(PTR_SIZE_INT)bn_sub_words(c_d,r_d,_nist_p_192[0],BN_NIST_192_TOP);
        mask &= 0-(PTR_SIZE_INT)carry;
+       res   = c_d;
        res   = (BN_ULONG *)
-        (((PTR_SIZE_INT)c_d&~mask) | ((PTR_SIZE_INT)r_d&mask));
+        (((PTR_SIZE_INT)res&~mask) | ((PTR_SIZE_INT)r_d&mask));
        nist_cp_bn(r_d, res, BN_NIST_192_TOP);
        r->top = BN_NIST_192_TOP;
        bn_correct_top(r);
@@ -479,8 +479,11 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
        int     top = a->top, i;
        int     carry;
        BN_ULONG *r_d, *a_d = a->d;
-       BN_ULONG buf[BN_NIST_224_TOP],
-                c_d[BN_NIST_224_TOP],
+       union   {
+               BN_ULONG        bn[BN_NIST_224_TOP];
+               unsigned int    ui[BN_NIST_224_TOP*sizeof(BN_ULONG)/sizeof(unsigned int)];
+               } buf;
+       BN_ULONG c_d[BN_NIST_224_TOP],
                *res;
        PTR_SIZE_INT mask;
        union { bn_addsub_f f; PTR_SIZE_INT p; } u;
@@ -519,18 +522,18 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
        /* copy upper 256 bits of 448 bit number ... */
        nist_cp_bn_0(c_d, a_d + (BN_NIST_224_TOP-1), top - (BN_NIST_224_TOP-1), BN_NIST_224_TOP);
        /* ... and right shift by 32 to obtain upper 224 bits */
-       nist_set_224(buf, c_d, 14, 13, 12, 11, 10, 9, 8);
+       nist_set_224(buf.bn, c_d, 14, 13, 12, 11, 10, 9, 8);
        /* truncate lower part to 224 bits too */
        r_d[BN_NIST_224_TOP-1] &= BN_MASK2l;
 #else
-       nist_cp_bn_0(buf, a_d + BN_NIST_224_TOP, top - BN_NIST_224_TOP, BN_NIST_224_TOP);
+       nist_cp_bn_0(buf.bn, a_d + BN_NIST_224_TOP, top - BN_NIST_224_TOP, BN_NIST_224_TOP);
 #endif
 
 #if defined(NIST_INT64) && BN_BITS2!=64
        {
        NIST_INT64              acc;    /* accumulator */
        unsigned int            *rp=(unsigned int *)r_d;
-       const unsigned int      *bp=(const unsigned int *)buf;
+       const unsigned int      *bp=(const unsigned int *)buf.ui;
 
        acc  = rp[0];   acc -= bp[7-7];
                        acc -= bp[11-7]; rp[0] = (unsigned int)acc; acc >>= 32;
@@ -565,13 +568,13 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
        {
        BN_ULONG t_d[BN_NIST_224_TOP];
 
-       nist_set_224(t_d, buf, 10, 9, 8, 7, 0, 0, 0);
+       nist_set_224(t_d, buf.bn, 10, 9, 8, 7, 0, 0, 0);
        carry = (int)bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP);
-       nist_set_224(t_d, buf, 0, 13, 12, 11, 0, 0, 0);
+       nist_set_224(t_d, buf.bn, 0, 13, 12, 11, 0, 0, 0);
        carry += (int)bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP);
-       nist_set_224(t_d, buf, 13, 12, 11, 10, 9, 8, 7);
+       nist_set_224(t_d, buf.bn, 13, 12, 11, 10, 9, 8, 7);
        carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP);
-       nist_set_224(t_d, buf, 0, 0, 0, 0, 13, 12, 11);
+       nist_set_224(t_d, buf.bn, 0, 0, 0, 0, 13, 12, 11);
        carry -= (int)bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP);
 
 #if BN_BITS2==64
@@ -606,7 +609,8 @@ int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
        /* otherwise it's effectively same as in BN_nist_mod_192... */
        mask  = 0-(PTR_SIZE_INT)(*u.f)(c_d,r_d,_nist_p_224[0],BN_NIST_224_TOP);
        mask &= 0-(PTR_SIZE_INT)carry;
-       res   = (BN_ULONG *)(((PTR_SIZE_INT)c_d&~mask) |
+       res   = c_d;
+       res   = (BN_ULONG *)(((PTR_SIZE_INT)res&~mask) |
         ((PTR_SIZE_INT)r_d&mask));
        nist_cp_bn(r_d, res, BN_NIST_224_TOP);
        r->top = BN_NIST_224_TOP;
@@ -805,7 +809,8 @@ int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 
        mask  = 0-(PTR_SIZE_INT)(*u.f)(c_d,r_d,_nist_p_256[0],BN_NIST_256_TOP);
        mask &= 0-(PTR_SIZE_INT)carry;
-       res   = (BN_ULONG *)(((PTR_SIZE_INT)c_d&~mask) |
+       res   = c_d;
+       res   = (BN_ULONG *)(((PTR_SIZE_INT)res&~mask) |
         ((PTR_SIZE_INT)r_d&mask));
        nist_cp_bn(r_d, res, BN_NIST_256_TOP);
        r->top = BN_NIST_256_TOP;
@@ -1026,7 +1031,8 @@ int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 
        mask  = 0-(PTR_SIZE_INT)(*u.f)(c_d,r_d,_nist_p_384[0],BN_NIST_384_TOP);
        mask &= 0-(PTR_SIZE_INT)carry;
-       res   = (BN_ULONG *)(((PTR_SIZE_INT)c_d&~mask) |
+       res   = c_d;
+       res   = (BN_ULONG *)(((PTR_SIZE_INT)res&~mask) |
         ((PTR_SIZE_INT)r_d&mask));
        nist_cp_bn(r_d, res, BN_NIST_384_TOP);
        r->top = BN_NIST_384_TOP;
@@ -1092,7 +1098,8 @@ int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,
 
        bn_add_words(r_d,r_d,t_d,BN_NIST_521_TOP);
        mask = 0-(PTR_SIZE_INT)bn_sub_words(t_d,r_d,_nist_p_521,BN_NIST_521_TOP);
-       res  = (BN_ULONG *)(((PTR_SIZE_INT)t_d&~mask) |
+       res  = t_d;
+       res  = (BN_ULONG *)(((PTR_SIZE_INT)res&~mask) |
         ((PTR_SIZE_INT)r_d&mask));
        nist_cp_bn(r_d,res,BN_NIST_521_TOP);
        r->top = BN_NIST_521_TOP;
index d7aa79a..d4a4ce4 100644 (file)
@@ -179,14 +179,14 @@ int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
        return(len);
        }
 
-void BUF_reverse(unsigned char *out, unsigned char *in, size_t size)
+void BUF_reverse(unsigned char *out, const unsigned char *in, size_t size)
        {
        size_t i;
        if (in)
                {
                out += size - 1;
                for (i = 0; i < size; i++)
-                       *in++ = *out--;
+                       *out-- = *in++;
                }
        else
                {
index 178e418..f8da32b 100644 (file)
@@ -88,7 +88,7 @@ int   BUF_MEM_grow_clean(BUF_MEM *str, size_t len);
 char * BUF_strdup(const char *str);
 char * BUF_strndup(const char *str, size_t siz);
 void * BUF_memdup(const void *data, size_t siz);
-void   BUF_reverse(unsigned char *out, unsigned char *in, size_t siz);
+void   BUF_reverse(unsigned char *out, const unsigned char *in, size_t siz);
 
 /* safe string functions */
 size_t BUF_strlcpy(char *dst,const char *src,size_t siz);
index b62d1bf..ba08279 100644 (file)
@@ -463,8 +463,6 @@ int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert)
        STACK_OF(CMS_CertificateChoices) **pcerts;
        int i;
        pcerts = cms_get0_certificate_choices(cms);
-       if (!pcerts)
-               return 0;
        if (!pcerts)
                return 0;
        for (i = 0; i < sk_CMS_CertificateChoices_num(*pcerts); i++)
index 304c6b7..0b77d8b 100644 (file)
@@ -889,7 +889,7 @@ void OPENSSL_showfatal (const char *fmta,...)
 
 #if defined(_WIN32_WINNT) && _WIN32_WINNT>=0x0333
     /* this -------------v--- guards NT-specific calls */
-    if (GetVersion() < 0x80000000 && OPENSSL_isservice() > 0)
+    if (check_winnt() && OPENSSL_isservice() > 0)
     {  HANDLE h = RegisterEventSource(0,_T("OPENSSL"));
        const TCHAR *pmsg=buf;
        ReportEvent(h,EVENTLOG_ERROR_TYPE,0,0,0,1,0,&pmsg,0);
index 26f4a78..1c575dc 100644 (file)
@@ -208,11 +208,15 @@ static int gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIG
        return ret;
        }
 
+
 /* Computes scalar*point and stores the result in r.
  * point can not equal r.
- * Uses algorithm 2P of
+ * Uses a modified algorithm 2P of
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
  *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
+ *
+ * To protect against side-channel attack the function uses constant time swap,
+ * avoiding conditional branches.
  */
 static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
        const EC_POINT *point, BN_CTX *ctx)
@@ -246,6 +250,11 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
        x2 = &r->X;
        z2 = &r->Y;
 
+       bn_wexpand(x1, group->field.top);
+       bn_wexpand(z1, group->field.top);
+       bn_wexpand(x2, group->field.top);
+       bn_wexpand(z2, group->field.top);
+
        if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
        if (!BN_one(z1)) goto err; /* z1 = 1 */
        if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
@@ -270,16 +279,12 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
                word = scalar->d[i];
                while (mask)
                        {
-                       if (word & mask)
-                               {
-                               if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
-                               if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
-                               }
-                       else
-                               {
-                               if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
-                               if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
-                               }
+                       BN_consttime_swap(word & mask, x1, x2, group->field.top);
+                       BN_consttime_swap(word & mask, z1, z2, group->field.top);
+                       if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
+                       if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
+                       BN_consttime_swap(word & mask, x1, x2, group->field.top);
+                       BN_consttime_swap(word & mask, z1, z2, group->field.top);
                        mask >>= 1;
                        }
                mask = BN_TBIT;
index 83909c1..0ce4524 100644 (file)
@@ -88,7 +88,7 @@ static int eckey_param2type(int *pptype, void **ppval, EC_KEY *ec_key)
                if (!pstr)
                        return 0;
                pstr->length = i2d_ECParameters(ec_key, &pstr->data);
-               if (pstr->length < 0)
+               if (pstr->length <= 0)
                        {
                        ASN1_STRING_free(pstr);
                        ECerr(EC_F_ECKEY_PARAM2TYPE, ERR_R_EC_LIB);
index 175eec5..145807b 100644 (file)
@@ -89,7 +89,8 @@ int EC_GROUP_get_trinomial_basis(const EC_GROUP *group, unsigned int *k)
        if (group == NULL)
                return 0;
 
-       if (EC_GROUP_method_of(group)->group_set_curve != ec_GF2m_simple_group_set_curve
+       if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
+           NID_X9_62_characteristic_two_field
            || !((group->poly[0] != 0) && (group->poly[1] != 0) && (group->poly[2] == 0)))
                {
                ECerr(EC_F_EC_GROUP_GET_TRINOMIAL_BASIS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -107,7 +108,8 @@ int EC_GROUP_get_pentanomial_basis(const EC_GROUP *group, unsigned int *k1,
        if (group == NULL)
                return 0;
 
-       if (EC_GROUP_method_of(group)->group_set_curve != ec_GF2m_simple_group_set_curve
+       if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) !=
+           NID_X9_62_characteristic_two_field
            || !((group->poly[0] != 0) && (group->poly[1] != 0) && (group->poly[2] != 0) && (group->poly[3] != 0) && (group->poly[4] == 0)))
                {
                ECerr(EC_F_EC_GROUP_GET_PENTANOMIAL_BASIS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
index 25247b5..de9a0cc 100644 (file)
@@ -480,10 +480,10 @@ int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
        if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=
            EC_METHOD_get_field_type(EC_GROUP_method_of(b)))
                return 1;
-       /* compare the curve name (if present) */
+       /* compare the curve name (if present in both) */
        if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
-           EC_GROUP_get_curve_name(a) == EC_GROUP_get_curve_name(b))
-               return 0;
+           EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
+               return 1;
 
        if (!ctx)
                ctx_new = ctx = BN_CTX_new();
@@ -993,12 +993,12 @@ int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b, BN
        if (group->meth->point_cmp == 0)
                {
                ECerr(EC_F_EC_POINT_CMP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-               return 0;
+               return -1;
                }
        if ((group->meth != a->meth) || (a->meth != b->meth))
                {
                ECerr(EC_F_EC_POINT_CMP, EC_R_INCOMPATIBLE_OBJECTS);
-               return 0;
+               return -1;
                }
        return group->meth->point_cmp(group, a, b, ctx);
        }
index 27846ed..95c8589 100644 (file)
@@ -408,6 +408,7 @@ ENGINE *ENGINE_by_id(const char *id)
                                !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) ||
                                !ENGINE_ctrl_cmd_string(iterator, "DIR_ADD",
                                        load_dir, 0) ||
+                               !ENGINE_ctrl_cmd_string(iterator, "LIST_ADD", "1", 0) ||
                                !ENGINE_ctrl_cmd_string(iterator, "LOAD", NULL, 0))
                                goto notfound;
                return iterator;
index a9ba5ae..4e9e91d 100644 (file)
@@ -104,6 +104,7 @@ static int bind_helper(ENGINE *e)
        {
        if (!ENGINE_set_id(e, engine_e_rdrand_id) ||
            !ENGINE_set_name(e, engine_e_rdrand_name) ||
+            !ENGINE_set_flags(e, ENGINE_FLAGS_NO_REGISTER_ALL) ||
            !ENGINE_set_init_function(e, rdrand_init) ||
            !ENGINE_set_RAND(e, &rdrand_meth) )
                return 0;
index 72a2a67..ac6d441 100644 (file)
@@ -264,7 +264,7 @@ static int b64_read(BIO *b, char *out, int outl)
                                }
 
                        /* we fell off the end without starting */
-                       if (j == i)
+                       if ((j == i) && (num == 0))
                                {
                                /* Is this is one long chunk?, if so, keep on
                                 * reading until a new line. */
index 6fc469f..d14e8e4 100644 (file)
@@ -366,8 +366,11 @@ int EVP_Digest(const void *data, size_t count,
 
 void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx)
        {
-       EVP_MD_CTX_cleanup(ctx);
-       OPENSSL_free(ctx);
+       if (ctx)
+               {
+               EVP_MD_CTX_cleanup(ctx);
+               OPENSSL_free(ctx);
+               }
        }
 
 /* This call frees resources associated with the context */
index 1bfb5d9..c7869b6 100644 (file)
@@ -842,7 +842,10 @@ static int aes_gcm_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                        gctx->ctr = NULL;
                        break;
                        }
+               else
 #endif
+               (void)0;        /* terminate potentially open 'else' */
+
                AES_set_encrypt_key(key, ctx->key_len * 8, &gctx->ks);
                CRYPTO_gcm128_init(&gctx->gcm, &gctx->ks, (block128_f)AES_encrypt);
 #ifdef AES_CTR_ASM
@@ -1083,14 +1086,17 @@ static int aes_xts_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                        xctx->xts.block1 = (block128_f)vpaes_decrypt;
                        }
 
-               vpaes_set_encrypt_key(key + ctx->key_len/2,
+                   vpaes_set_encrypt_key(key + ctx->key_len/2,
                                                ctx->key_len * 4, &xctx->ks2);
-               xctx->xts.block2 = (block128_f)vpaes_encrypt;
+                   xctx->xts.block2 = (block128_f)vpaes_encrypt;
 
-               xctx->xts.key1 = &xctx->ks1;
-               break;
-               }
+                   xctx->xts.key1 = &xctx->ks1;
+                   break;
+                   }
+               else
 #endif
+               (void)0;        /* terminate potentially open 'else' */
+
                if (enc)
                        {
                        AES_set_encrypt_key(key, ctx->key_len * 4, &xctx->ks1);
index 483e04b..fb2c884 100644 (file)
@@ -328,10 +328,11 @@ static int aesni_cbc_hmac_sha1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 
                                if (res!=SHA_CBLOCK) continue;
 
-                               mask = 0-((inp_len+8-j)>>(sizeof(j)*8-1));
+                               /* j is not incremented yet */
+                               mask = 0-((inp_len+7-j)>>(sizeof(j)*8-1));
                                data->u[SHA_LBLOCK-1] |= bitlen&mask;
                                sha1_block_data_order(&key->md,data,1);
-                               mask &= 0-((j-inp_len-73)>>(sizeof(j)*8-1));
+                               mask &= 0-((j-inp_len-72)>>(sizeof(j)*8-1));
                                pmac->u[0] |= key->md.h0 & mask;
                                pmac->u[1] |= key->md.h1 & mask;
                                pmac->u[2] |= key->md.h2 & mask;
index 1e69972..8d7b7de 100644 (file)
@@ -101,7 +101,7 @@ static int des_ede_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 static int des_ede_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                              const unsigned char *in, size_t inl)
 {
-       if (inl>=EVP_MAXCHUNK)
+       while (inl>=EVP_MAXCHUNK)
                {
                DES_ede3_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK,
                               &data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
@@ -132,7 +132,7 @@ static int des_ede_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
        printf("\n");
        }
 #endif    /* KSSL_DEBUG */
-       if (inl>=EVP_MAXCHUNK)
+       while (inl>=EVP_MAXCHUNK)
                {
                DES_ede3_cbc_encrypt(in, out, (long)EVP_MAXCHUNK,
                             &data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
@@ -151,7 +151,7 @@ static int des_ede_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 static int des_ede_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                              const unsigned char *in, size_t inl)
 {
-       if (inl>=EVP_MAXCHUNK)
+       while (inl>=EVP_MAXCHUNK)
                {
                DES_ede3_cfb64_encrypt(in, out, (long)EVP_MAXCHUNK, 
                               &data(ctx)->ks1, &data(ctx)->ks2, &data(ctx)->ks3,
index 975d004..fe3c6c8 100644 (file)
@@ -85,19 +85,24 @@ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
        unsigned char digtmp[EVP_MAX_MD_SIZE], *p, itmp[4];
        int cplen, j, k, tkeylen, mdlen;
        unsigned long i = 1;
-       HMAC_CTX hctx;
+       HMAC_CTX hctx_tpl, hctx;
 
        mdlen = EVP_MD_size(digest);
        if (mdlen < 0)
                return 0;
 
-       HMAC_CTX_init(&hctx);
+       HMAC_CTX_init(&hctx_tpl);
        p = out;
        tkeylen = keylen;
        if(!pass)
                passlen = 0;
        else if(passlen == -1)
                passlen = strlen(pass);
+       if (!HMAC_Init_ex(&hctx_tpl, pass, passlen, digest, NULL))
+               {
+               HMAC_CTX_cleanup(&hctx_tpl);
+               return 0;
+               }
        while(tkeylen)
                {
                if(tkeylen > mdlen)
@@ -111,19 +116,36 @@ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
                itmp[1] = (unsigned char)((i >> 16) & 0xff);
                itmp[2] = (unsigned char)((i >> 8) & 0xff);
                itmp[3] = (unsigned char)(i & 0xff);
-               if (!HMAC_Init_ex(&hctx, pass, passlen, digest, NULL)
-                       || !HMAC_Update(&hctx, salt, saltlen)
-                       || !HMAC_Update(&hctx, itmp, 4)
-                       || !HMAC_Final(&hctx, digtmp, NULL))
+               if (!HMAC_CTX_copy(&hctx, &hctx_tpl))
                        {
+                       HMAC_CTX_cleanup(&hctx_tpl);
+                       return 0;
+                       }
+               if (!HMAC_Update(&hctx, salt, saltlen)
+                   || !HMAC_Update(&hctx, itmp, 4)
+                   || !HMAC_Final(&hctx, digtmp, NULL))
+                       {
+                       HMAC_CTX_cleanup(&hctx_tpl);
                        HMAC_CTX_cleanup(&hctx);
                        return 0;
                        }
+               HMAC_CTX_cleanup(&hctx);
                memcpy(p, digtmp, cplen);
                for(j = 1; j < iter; j++)
                        {
-                       HMAC(digest, pass, passlen,
-                                digtmp, mdlen, digtmp, NULL);
+                       if (!HMAC_CTX_copy(&hctx, &hctx_tpl))
+                               {
+                               HMAC_CTX_cleanup(&hctx_tpl);
+                               return 0;
+                               }
+                       if (!HMAC_Update(&hctx, digtmp, mdlen)
+                           || !HMAC_Final(&hctx, digtmp, NULL))
+                               {
+                               HMAC_CTX_cleanup(&hctx_tpl);
+                               HMAC_CTX_cleanup(&hctx);
+                               return 0;
+                               }
+                       HMAC_CTX_cleanup(&hctx);
                        for(k = 0; k < cplen; k++)
                                p[k] ^= digtmp[k];
                        }
@@ -131,7 +153,7 @@ int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
                i++;
                p+= cplen;
                }
-       HMAC_CTX_cleanup(&hctx);
+       HMAC_CTX_cleanup(&hctx_tpl);
 #ifdef DEBUG_PKCS5V2
        fprintf(stderr, "Password:\n");
        h__dump (pass, passlen);
index 3d3782c..0e54f75 100644 (file)
@@ -117,7 +117,7 @@ void CRYPTO_cbc128_decrypt(const unsigned char *in, unsigned char *out,
                        unsigned char ivec[16], block128_f block)
 {
        size_t n;
-       union { size_t align; unsigned char c[16]; } tmp;
+       union { size_t t[16/sizeof(size_t)]; unsigned char c[16]; } tmp;
 
        assert(in && out && key && ivec);
 
@@ -137,11 +137,13 @@ void CRYPTO_cbc128_decrypt(const unsigned char *in, unsigned char *out,
                                out += 16;
                        }
                }
-               else {
+               else  if (16%sizeof(size_t) == 0) { /* always true */
                        while (len>=16) {
+                               size_t *out_t=(size_t *)out, *iv_t=(size_t *)iv;
+
                                (*block)(in, out, key);
-                               for(n=0; n<16; n+=sizeof(size_t))
-                                       *(size_t *)(out+n) ^= *(size_t *)(iv+n);
+                               for(n=0; n<16/sizeof(size_t); n++)
+                                       out_t[n] ^= iv_t[n];
                                iv = in;
                                len -= 16;
                                in  += 16;
@@ -165,15 +167,16 @@ void CRYPTO_cbc128_decrypt(const unsigned char *in, unsigned char *out,
                                out += 16;
                        }
                }
-               else {
-                       size_t c;
+               else if (16%sizeof(size_t) == 0) { /* always true */
                        while (len>=16) {
+                               size_t c, *out_t=(size_t *)out, *ivec_t=(size_t *)ivec;
+                               const size_t *in_t=(const size_t *)in;
+
                                (*block)(in, tmp.c, key);
-                               for(n=0; n<16; n+=sizeof(size_t)) {
-                                       c = *(size_t *)(in+n);
-                                       *(size_t *)(out+n) =
-                                       *(size_t *)(tmp.c+n) ^ *(size_t *)(ivec+n);
-                                       *(size_t *)(ivec+n) = c;
+                               for(n=0; n<16/sizeof(size_t); n++) {
+                                       c = in_t[n];
+                                       out_t[n] = tmp.t[n] ^ ivec_t[n];
+                                       ivec_t[n] = c;
                                }
                                len -= 16;
                                in  += 16;
index c9b35e5..3ce11d0 100644 (file)
@@ -87,7 +87,7 @@ int CRYPTO_ccm128_setiv(CCM128_CONTEXT *ctx,
                ctx->nonce.c[11] = (u8)(mlen>>(32%(sizeof(mlen)*8)));
        }
        else
-               *(u32*)(&ctx->nonce.c[8]) = 0;
+               ctx->nonce.u[1] = 0;
 
        ctx->nonce.c[12] = (u8)(mlen>>24);
        ctx->nonce.c[13] = (u8)(mlen>>16);
index c0e1f36..2d583de 100644 (file)
@@ -108,12 +108,8 @@ size_t CRYPTO_cts128_encrypt(const unsigned char *in, unsigned char *out,
        (*cbc)(in,out-16,residue,key,ivec,1);
        memcpy(out,tmp.c,residue);
 #else
-       {
-       size_t n;
-       for (n=0; n<16; n+=sizeof(size_t))
-               *(size_t *)(tmp.c+n) = 0;
+       memset(tmp.c,0,sizeof(tmp));
        memcpy(tmp.c,in,residue);
-       }
        memcpy(out,out-16,residue);
        (*cbc)(tmp.c,out-16,16,key,ivec,1);
 #endif
@@ -144,12 +140,8 @@ size_t CRYPTO_nistcts128_encrypt(const unsigned char *in, unsigned char *out,
 #if defined(CBC_HANDLES_TRUNCATED_IO)
        (*cbc)(in,out-16+residue,residue,key,ivec,1);
 #else
-       {
-       size_t n;
-       for (n=0; n<16; n+=sizeof(size_t))
-               *(size_t *)(tmp.c+n) = 0;
+       memset(tmp.c,0,sizeof(tmp));
        memcpy(tmp.c,in,residue);
-       }
        (*cbc)(tmp.c,out-16+residue,16,key,ivec,1);
 #endif
        return len+residue;
@@ -177,8 +169,7 @@ size_t CRYPTO_cts128_decrypt_block(const unsigned char *in, unsigned char *out,
 
        (*block)(in,tmp.c+16,key);
 
-       for (n=0; n<16; n+=sizeof(size_t))
-               *(size_t *)(tmp.c+n) = *(size_t *)(tmp.c+16+n);
+       memcpy(tmp.c,tmp.c+16,16);
        memcpy(tmp.c,in+16,residue);
        (*block)(tmp.c,tmp.c,key);
 
@@ -220,8 +211,7 @@ size_t CRYPTO_nistcts128_decrypt_block(const unsigned char *in, unsigned char *o
 
        (*block)(in+residue,tmp.c+16,key);
 
-       for (n=0; n<16; n+=sizeof(size_t))
-               *(size_t *)(tmp.c+n) = *(size_t *)(tmp.c+16+n);
+       memcpy(tmp.c,tmp.c+16,16);
        memcpy(tmp.c,in,residue);
        (*block)(tmp.c,tmp.c,key);
 
@@ -240,7 +230,7 @@ size_t CRYPTO_nistcts128_decrypt_block(const unsigned char *in, unsigned char *o
 size_t CRYPTO_cts128_decrypt(const unsigned char *in, unsigned char *out,
                        size_t len, const void *key,
                        unsigned char ivec[16], cbc128_f cbc)
-{      size_t residue, n;
+{      size_t residue;
        union { size_t align; unsigned char c[32]; } tmp;
 
        assert (in && out && key && ivec);
@@ -257,8 +247,7 @@ size_t CRYPTO_cts128_decrypt(const unsigned char *in, unsigned char *out,
                out += len;
        }
 
-       for (n=16; n<32; n+=sizeof(size_t))
-               *(size_t *)(tmp.c+n) = 0;
+       memset(tmp.c,0,sizeof(tmp));
        /* this places in[16] at &tmp.c[16] and decrypted block at &tmp.c[0] */
        (*cbc)(in,tmp.c,16,key,tmp.c+16,0);
 
@@ -275,7 +264,7 @@ size_t CRYPTO_cts128_decrypt(const unsigned char *in, unsigned char *out,
 size_t CRYPTO_nistcts128_decrypt(const unsigned char *in, unsigned char *out,
                        size_t len, const void *key,
                        unsigned char ivec[16], cbc128_f cbc)
-{      size_t residue, n;
+{      size_t residue;
        union { size_t align; unsigned char c[32]; } tmp;
 
        assert (in && out && key && ivec);
@@ -297,8 +286,7 @@ size_t CRYPTO_nistcts128_decrypt(const unsigned char *in, unsigned char *out,
                out += len;
        }
 
-       for (n=16; n<32; n+=sizeof(size_t))
-               *(size_t *)(tmp.c+n) = 0;
+       memset(tmp.c,0,sizeof(tmp));
        /* this places in[16] at &tmp.c[16] and decrypted block at &tmp.c[0] */
        (*cbc)(in+residue,tmp.c,16,key,tmp.c+16,0);
 
index 0e6ff8b..e1dc2b0 100644 (file)
@@ -810,7 +810,11 @@ void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx,const unsigned char *iv,size_t len)
                GCM_MUL(ctx,Yi);
 
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctr = BSWAP4(ctx->Yi.d[3]);
+#else
                        ctr = GETU32(ctx->Yi.c+12);
+#endif
                else
                        ctr = ctx->Yi.d[3];
        }
@@ -818,7 +822,11 @@ void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx,const unsigned char *iv,size_t len)
        (*ctx->block)(ctx->Yi.c,ctx->EK0.c,ctx->key);
        ++ctr;
        if (is_endian.little)
+#ifdef BSWAP4
+               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                PUTU32(ctx->Yi.c+12,ctr);
+#endif
        else
                ctx->Yi.d[3] = ctr;
 }
@@ -913,7 +921,11 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
        }
 
        if (is_endian.little)
+#ifdef BSWAP4
+               ctr = BSWAP4(ctx->Yi.d[3]);
+#else
                ctr = GETU32(ctx->Yi.c+12);
+#endif
        else
                ctr = ctx->Yi.d[3];
 
@@ -941,15 +953,21 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                    size_t j=GHASH_CHUNK;
 
                    while (j) {
+                       size_t *out_t=(size_t *)out;
+                       const size_t *in_t=(const size_t *)in;
+
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
-                       for (i=0; i<16; i+=sizeof(size_t))
-                               *(size_t *)(out+i) =
-                               *(size_t *)(in+i)^*(size_t *)(ctx->EKi.c+i);
+                       for (i=0; i<16/sizeof(size_t); ++i)
+                               out_t[i] = in_t[i] ^ ctx->EKi.t[i];
                        out += 16;
                        in  += 16;
                        j   -= 16;
@@ -961,15 +979,21 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                    size_t j=i;
 
                    while (len>=16) {
+                       size_t *out_t=(size_t *)out;
+                       const size_t *in_t=(const size_t *)in;
+
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
-                       for (i=0; i<16; i+=sizeof(size_t))
-                               *(size_t *)(out+i) =
-                               *(size_t *)(in+i)^*(size_t *)(ctx->EKi.c+i);
+                       for (i=0; i<16/sizeof(size_t); ++i)
+                               out_t[i] = in_t[i] ^ ctx->EKi.t[i];
                        out += 16;
                        in  += 16;
                        len -= 16;
@@ -978,16 +1002,22 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                }
 #else
                while (len>=16) {
+                       size_t *out_t=(size_t *)out;
+                       const size_t *in_t=(const size_t *)in;
+
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
-                       for (i=0; i<16; i+=sizeof(size_t))
-                               *(size_t *)(ctx->Xi.c+i) ^=
-                               *(size_t *)(out+i) =
-                               *(size_t *)(in+i)^*(size_t *)(ctx->EKi.c+i);
+                       for (i=0; i<16/sizeof(size_t); ++i)
+                               ctx->Xi.t[i] ^=
+                               out_t[i] = in_t[i]^ctx->EKi.t[i];
                        GCM_MUL(ctx,Xi);
                        out += 16;
                        in  += 16;
@@ -998,7 +1028,11 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
                        while (len--) {
@@ -1016,7 +1050,11 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
                }
@@ -1060,7 +1098,11 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
        }
 
        if (is_endian.little)
+#ifdef BSWAP4
+               ctr = BSWAP4(ctx->Yi.d[3]);
+#else
                ctr = GETU32(ctx->Yi.c+12);
+#endif
        else
                ctr = ctx->Yi.d[3];
 
@@ -1091,15 +1133,21 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
 
                    GHASH(ctx,in,GHASH_CHUNK);
                    while (j) {
+                       size_t *out_t=(size_t *)out;
+                       const size_t *in_t=(const size_t *)in;
+
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
-                       for (i=0; i<16; i+=sizeof(size_t))
-                               *(size_t *)(out+i) =
-                               *(size_t *)(in+i)^*(size_t *)(ctx->EKi.c+i);
+                       for (i=0; i<16/sizeof(size_t); ++i)
+                               out_t[i] = in_t[i]^ctx->EKi.t[i];
                        out += 16;
                        in  += 16;
                        j   -= 16;
@@ -1109,15 +1157,21 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                if ((i = (len&(size_t)-16))) {
                    GHASH(ctx,in,i);
                    while (len>=16) {
+                       size_t *out_t=(size_t *)out;
+                       const size_t *in_t=(const size_t *)in;
+
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
-                       for (i=0; i<16; i+=sizeof(size_t))
-                               *(size_t *)(out+i) =
-                               *(size_t *)(in+i)^*(size_t *)(ctx->EKi.c+i);
+                       for (i=0; i<16/sizeof(size_t); ++i)
+                               out_t[i] = in_t[i]^ctx->EKi.t[i];
                        out += 16;
                        in  += 16;
                        len -= 16;
@@ -1125,16 +1179,23 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                }
 #else
                while (len>=16) {
+                       size_t *out_t=(size_t *)out;
+                       const size_t *in_t=(const size_t *)in;
+
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
-                       for (i=0; i<16; i+=sizeof(size_t)) {
-                               size_t c = *(size_t *)(in+i);
-                               *(size_t *)(out+i) = c^*(size_t *)(ctx->EKi.c+i);
-                               *(size_t *)(ctx->Xi.c+i) ^= c;
+                       for (i=0; i<16/sizeof(size_t); ++i) {
+                               size_t c = in[i];
+                               out[i] = c^ctx->EKi.t[i];
+                               ctx->Xi.t[i] ^= c;
                        }
                        GCM_MUL(ctx,Xi);
                        out += 16;
@@ -1146,7 +1207,11 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
                        while (len--) {
@@ -1167,7 +1232,11 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx,
                        (*block)(ctx->Yi.c,ctx->EKi.c,key);
                        ++ctr;
                        if (is_endian.little)
+#ifdef BSWAP4
+                               ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                                PUTU32(ctx->Yi.c+12,ctr);
+#endif
                        else
                                ctx->Yi.d[3] = ctr;
                }
@@ -1212,7 +1281,11 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
        }
 
        if (is_endian.little)
+#ifdef BSWAP4
+               ctr = BSWAP4(ctx->Yi.d[3]);
+#else
                ctr = GETU32(ctx->Yi.c+12);
+#endif
        else
                ctr = ctx->Yi.d[3];
 
@@ -1234,7 +1307,11 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
                (*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
                ctr += GHASH_CHUNK/16;
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                        PUTU32(ctx->Yi.c+12,ctr);
+#endif
                else
                        ctx->Yi.d[3] = ctr;
                GHASH(ctx,out,GHASH_CHUNK);
@@ -1249,7 +1326,11 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
                (*stream)(in,out,j,key,ctx->Yi.c);
                ctr += (unsigned int)j;
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                        PUTU32(ctx->Yi.c+12,ctr);
+#endif
                else
                        ctx->Yi.d[3] = ctr;
                in  += i;
@@ -1269,7 +1350,11 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
                (*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
                ++ctr;
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                        PUTU32(ctx->Yi.c+12,ctr);
+#endif
                else
                        ctx->Yi.d[3] = ctr;
                while (len--) {
@@ -1311,7 +1396,11 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
        }
 
        if (is_endian.little)
+#ifdef BSWAP4
+               ctr = BSWAP4(ctx->Yi.d[3]);
+#else
                ctr = GETU32(ctx->Yi.c+12);
+#endif
        else
                ctr = ctx->Yi.d[3];
 
@@ -1336,7 +1425,11 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
                (*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
                ctr += GHASH_CHUNK/16;
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                        PUTU32(ctx->Yi.c+12,ctr);
+#endif
                else
                        ctx->Yi.d[3] = ctr;
                out += GHASH_CHUNK;
@@ -1362,7 +1455,11 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
                (*stream)(in,out,j,key,ctx->Yi.c);
                ctr += (unsigned int)j;
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                        PUTU32(ctx->Yi.c+12,ctr);
+#endif
                else
                        ctx->Yi.d[3] = ctr;
                out += i;
@@ -1373,7 +1470,11 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx,
                (*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
                ++ctr;
                if (is_endian.little)
+#ifdef BSWAP4
+                       ctx->Yi.d[3] = BSWAP4(ctr);
+#else
                        PUTU32(ctx->Yi.c+12,ctr);
+#endif
                else
                        ctx->Yi.d[3] = ctr;
                while (len--) {
@@ -1669,6 +1770,46 @@ static const u8  IV18[]={0x93,0x13,0x22,0x5d,0xf8,0x84,0x06,0xe5,0x55,0x90,0x9c,0
                        0xa2,0x41,0x89,0x97,0x20,0x0e,0xf8,0x2e,0x44,0xae,0x7e,0x3f},
                T18[]= {0xa4,0x4a,0x82,0x66,0xee,0x1c,0x8e,0xb0,0xc8,0xb5,0xd4,0xcf,0x5a,0xe9,0xf1,0x9a};
 
+/* Test Case 19 */
+#define K19 K1
+#define P19 P1
+#define IV19 IV1
+#define C19 C1
+static const u8 A19[]= {0xd9,0x31,0x32,0x25,0xf8,0x84,0x06,0xe5,0xa5,0x59,0x09,0xc5,0xaf,0xf5,0x26,0x9a,
+                       0x86,0xa7,0xa9,0x53,0x15,0x34,0xf7,0xda,0x2e,0x4c,0x30,0x3d,0x8a,0x31,0x8a,0x72,
+                       0x1c,0x3c,0x0c,0x95,0x95,0x68,0x09,0x53,0x2f,0xcf,0x0e,0x24,0x49,0xa6,0xb5,0x25,
+                       0xb1,0x6a,0xed,0xf5,0xaa,0x0d,0xe6,0x57,0xba,0x63,0x7b,0x39,0x1a,0xaf,0xd2,0x55,
+                       0x52,0x2d,0xc1,0xf0,0x99,0x56,0x7d,0x07,0xf4,0x7f,0x37,0xa3,0x2a,0x84,0x42,0x7d,
+                       0x64,0x3a,0x8c,0xdc,0xbf,0xe5,0xc0,0xc9,0x75,0x98,0xa2,0xbd,0x25,0x55,0xd1,0xaa,
+                       0x8c,0xb0,0x8e,0x48,0x59,0x0d,0xbb,0x3d,0xa7,0xb0,0x8b,0x10,0x56,0x82,0x88,0x38,
+                       0xc5,0xf6,0x1e,0x63,0x93,0xba,0x7a,0x0a,0xbc,0xc9,0xf6,0x62,0x89,0x80,0x15,0xad},
+               T19[]= {0x5f,0xea,0x79,0x3a,0x2d,0x6f,0x97,0x4d,0x37,0xe6,0x8e,0x0c,0xb8,0xff,0x94,0x92};
+
+/* Test Case 20 */
+#define K20 K1
+#define A20 A1
+static const u8 IV20[64]={0xff,0xff,0xff,0xff},        /* this results in 0xff in counter LSB */
+               P20[288],
+               C20[]= {0x56,0xb3,0x37,0x3c,0xa9,0xef,0x6e,0x4a,0x2b,0x64,0xfe,0x1e,0x9a,0x17,0xb6,0x14,
+                       0x25,0xf1,0x0d,0x47,0xa7,0x5a,0x5f,0xce,0x13,0xef,0xc6,0xbc,0x78,0x4a,0xf2,0x4f,
+                       0x41,0x41,0xbd,0xd4,0x8c,0xf7,0xc7,0x70,0x88,0x7a,0xfd,0x57,0x3c,0xca,0x54,0x18,
+                       0xa9,0xae,0xff,0xcd,0x7c,0x5c,0xed,0xdf,0xc6,0xa7,0x83,0x97,0xb9,0xa8,0x5b,0x49,
+                       0x9d,0xa5,0x58,0x25,0x72,0x67,0xca,0xab,0x2a,0xd0,0xb2,0x3c,0xa4,0x76,0xa5,0x3c,
+                       0xb1,0x7f,0xb4,0x1c,0x4b,0x8b,0x47,0x5c,0xb4,0xf3,0xf7,0x16,0x50,0x94,0xc2,0x29,
+                       0xc9,0xe8,0xc4,0xdc,0x0a,0x2a,0x5f,0xf1,0x90,0x3e,0x50,0x15,0x11,0x22,0x13,0x76,
+                       0xa1,0xcd,0xb8,0x36,0x4c,0x50,0x61,0xa2,0x0c,0xae,0x74,0xbc,0x4a,0xcd,0x76,0xce,
+                       0xb0,0xab,0xc9,0xfd,0x32,0x17,0xef,0x9f,0x8c,0x90,0xbe,0x40,0x2d,0xdf,0x6d,0x86,
+                       0x97,0xf4,0xf8,0x80,0xdf,0xf1,0x5b,0xfb,0x7a,0x6b,0x28,0x24,0x1e,0xc8,0xfe,0x18,
+                       0x3c,0x2d,0x59,0xe3,0xf9,0xdf,0xff,0x65,0x3c,0x71,0x26,0xf0,0xac,0xb9,0xe6,0x42,
+                       0x11,0xf4,0x2b,0xae,0x12,0xaf,0x46,0x2b,0x10,0x70,0xbe,0xf1,0xab,0x5e,0x36,0x06,
+                       0x87,0x2c,0xa1,0x0d,0xee,0x15,0xb3,0x24,0x9b,0x1a,0x1b,0x95,0x8f,0x23,0x13,0x4c,
+                       0x4b,0xcc,0xb7,0xd0,0x32,0x00,0xbc,0xe4,0x20,0xa2,0xf8,0xeb,0x66,0xdc,0xf3,0x64,
+                       0x4d,0x14,0x23,0xc1,0xb5,0x69,0x90,0x03,0xc1,0x3e,0xce,0xf4,0xbf,0x38,0xa3,0xb6,
+                       0x0e,0xed,0xc3,0x40,0x33,0xba,0xc1,0x90,0x27,0x83,0xdc,0x6d,0x89,0xe2,0xe7,0x74,
+                       0x18,0x8a,0x43,0x9c,0x7e,0xbc,0xc0,0x67,0x2d,0xbd,0xa4,0xdd,0xcf,0xb2,0x79,0x46,
+                       0x13,0xb0,0xbe,0x41,0x31,0x5e,0xf7,0x78,0x70,0x8a,0x70,0xee,0x7d,0x75,0x16,0x5c},
+               T20[]= {0x8b,0x30,0x7f,0x6b,0x33,0x28,0x6d,0x0a,0xb0,0x26,0xa9,0xed,0x3f,0xe1,0xe8,0x5f};
+
 #define TEST_CASE(n)   do {                                    \
        u8 out[sizeof(P##n)];                                   \
        AES_set_encrypt_key(K##n,sizeof(K##n)*8,&key);          \
@@ -1713,6 +1854,8 @@ int main()
        TEST_CASE(16);
        TEST_CASE(17);
        TEST_CASE(18);
+       TEST_CASE(19);
+       TEST_CASE(20);
 
 #ifdef OPENSSL_CPUID_OBJ
        {
@@ -1743,11 +1886,16 @@ int main()
                        ctr_t/(double)sizeof(buf),
                        (gcm_t-ctr_t)/(double)sizeof(buf));
 #ifdef GHASH
-       GHASH(&ctx,buf.c,sizeof(buf));
+       {
+       void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
+                               const u8 *inp,size_t len)       = ctx.ghash;
+
+       GHASH((&ctx),buf.c,sizeof(buf));
        start = OPENSSL_rdtsc();
-       for (i=0;i<100;++i) GHASH(&ctx,buf.c,sizeof(buf));
+       for (i=0;i<100;++i) GHASH((&ctx),buf.c,sizeof(buf));
        gcm_t = OPENSSL_rdtsc() - start;
        printf("%.2f\n",gcm_t/(double)sizeof(buf)/(double)i);
+       }
 #endif
        }
 #endif
index b6dc3c3..9d83e12 100644 (file)
@@ -29,10 +29,7 @@ typedef unsigned char u8;
 #if defined(__i386)    || defined(__i386__)    || \
     defined(__x86_64)  || defined(__x86_64__)  || \
     defined(_M_IX86)   || defined(_M_AMD64)    || defined(_M_X64) || \
-    defined(__s390__)  || defined(__s390x__)   || \
-    ( (defined(__arm__)        || defined(__arm)) && \
-      (defined(__ARM_ARCH_7__) || defined(__ARM_ARCH_7A__) || \
-       defined(__ARM_ARCH_7R__)        || defined(__ARM_ARCH_7M__)) )
+    defined(__s390__)  || defined(__s390x__)
 # undef STRICT_ALIGNMENT
 #endif
 
@@ -101,8 +98,8 @@ typedef struct { u64 hi,lo; } u128;
 
 struct gcm128_context {
        /* Following 6 names follow names in GCM specification */
-       union { u64 u[2]; u32 d[4]; u8 c[16]; } Yi,EKi,EK0,len,
-                                               Xi,H;
+       union { u64 u[2]; u32 d[4]; u8 c[16]; size_t t[16/sizeof(size_t)]; }
+         Yi,EKi,EK0,len,Xi,H;
        /* Relative position of Xi, H and pre-computed Htable is used
         * in some assembler modules, i.e. don't change the order! */
 #if TABLE_BITS==8
index 5bc8e53..ebe7180 100644 (file)
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-#define OPENSSL_VERSION_NUMBER 0x1000105fL
+#define OPENSSL_VERSION_NUMBER 0x1000107fL
 #ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT   "OpenSSL 1.0.1e-fips 11 Feb 2013"
+#define OPENSSL_VERSION_TEXT   "OpenSSL 1.0.1g-fips 7 Apr 2014"
 #else
-#define OPENSSL_VERSION_TEXT   "OpenSSL 1.0.1e 11 Feb 2013"
+#define OPENSSL_VERSION_TEXT   "OpenSSL 1.0.1g 7 Apr 2014"
 #endif
 #define OPENSSL_VERSION_PTEXT  " part of " OPENSSL_VERSION_TEXT
 
index 1b2be52..cc7f24a 100644 (file)
@@ -167,6 +167,7 @@ start:
 #ifndef OPENSSL_NO_RSA
                        if (strcmp(name,PEM_STRING_RSA) == 0)
                        {
+                       d2i=(D2I_OF(void))d2i_RSAPrivateKey;
                        if (xi->x_pkey != NULL) 
                                {
                                if (!sk_X509_INFO_push(ret,xi)) goto err;
index 96b131d..a34915d 100644 (file)
@@ -90,7 +90,14 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
 
        /* Set defaults */
        if (!nid_cert)
+               {
+#ifdef OPENSSL_FIPS
+               if (FIPS_mode())
+                       nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
+               else
+#endif
                nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
+               }
        if (!nid_key)
                nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
        if (!iter)
index 1e3bcb9..aee1c30 100644 (file)
@@ -198,6 +198,9 @@ static void ssleay_rand_add(const void *buf, int num, double add)
        EVP_MD_CTX m;
        int do_not_lock;
 
+       if (!num)
+               return;
+
        /*
         * (Based on the rand(3) manpage)
         *
@@ -380,8 +383,11 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
         * are fed into the hash function and the results are kept in the
         * global 'md'.
         */
-
-       CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+#ifdef OPENSSL_FIPS
+       /* NB: in FIPS mode we are already under a lock */
+       if (!FIPS_mode())
+#endif
+               CRYPTO_w_lock(CRYPTO_LOCK_RAND);
 
        /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
        CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
@@ -460,7 +466,10 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
 
        /* before unlocking, we must clear 'crypto_lock_rand' */
        crypto_lock_rand = 0;
-       CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+#ifdef OPENSSL_FIPS
+       if (!FIPS_mode())
+#endif
+               CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
        while (num > 0)
                {
@@ -512,10 +521,16 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
        MD_Init(&m);
        MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
        MD_Update(&m,local_md,MD_DIGEST_LENGTH);
-       CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+#ifdef OPENSSL_FIPS
+       if (!FIPS_mode())
+#endif
+               CRYPTO_w_lock(CRYPTO_LOCK_RAND);
        MD_Update(&m,md,MD_DIGEST_LENGTH);
        MD_Final(&m,md);
-       CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+#ifdef OPENSSL_FIPS
+       if (!FIPS_mode())
+#endif
+               CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
        EVP_MD_CTX_cleanup(&m);
        if (ok)
index dc8fcf9..bb5520e 100644 (file)
@@ -138,6 +138,7 @@ void ERR_load_RAND_strings(void);
 #define RAND_F_SSLEAY_RAND_BYTES                        100
 
 /* Reason codes. */
+#define RAND_R_DUAL_EC_DRBG_DISABLED                    104
 #define RAND_R_ERROR_INITIALISING_DRBG                  102
 #define RAND_R_ERROR_INSTANTIATING_DRBG                         103
 #define RAND_R_NO_FIPS_RANDOM_METHOD_SET                101
index b8586c8..c4c80fc 100644 (file)
@@ -78,6 +78,7 @@ static ERR_STRING_DATA RAND_str_functs[]=
 
 static ERR_STRING_DATA RAND_str_reasons[]=
        {
+{ERR_REASON(RAND_R_DUAL_EC_DRBG_DISABLED),"dual ec drbg disabled"},
 {ERR_REASON(RAND_R_ERROR_INITIALISING_DRBG),"error initialising drbg"},
 {ERR_REASON(RAND_R_ERROR_INSTANTIATING_DRBG),"error instantiating drbg"},
 {ERR_REASON(RAND_R_NO_FIPS_RANDOM_METHOD_SET),"no fips random method set"},
index 476a0cd..5ac0e14 100644 (file)
@@ -269,6 +269,14 @@ int RAND_init_fips(void)
        DRBG_CTX *dctx;
        size_t plen;
        unsigned char pers[32], *p;
+#ifndef OPENSSL_ALLOW_DUAL_EC_DRBG
+       if (fips_drbg_type >> 16)
+               {
+               RANDerr(RAND_F_RAND_INIT_FIPS, RAND_R_DUAL_EC_DRBG_DISABLED);
+               return 0;
+               }
+#endif
+               
        dctx = FIPS_get_default_drbg();
         if (FIPS_drbg_init(dctx, fips_drbg_type, fips_drbg_flags) <= 0)
                {
index 2460910..5a2062f 100644 (file)
@@ -351,27 +351,27 @@ static int rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss,
 
        if (!BIO_indent(bp, indent, 128))
                goto err;
-       if (BIO_puts(bp, "Salt Length: ") <= 0)
+       if (BIO_puts(bp, "Salt Length: 0x") <= 0)
                        goto err;
        if (pss->saltLength)
                {
                if (i2a_ASN1_INTEGER(bp, pss->saltLength) <= 0)
                        goto err;
                }
-       else if (BIO_puts(bp, "20 (default)") <= 0)
+       else if (BIO_puts(bp, "0x14 (default)") <= 0)
                goto err;
        BIO_puts(bp, "\n");
 
        if (!BIO_indent(bp, indent, 128))
                goto err;
-       if (BIO_puts(bp, "Trailer Field: ") <= 0)
+       if (BIO_puts(bp, "Trailer Field: 0x") <= 0)
                        goto err;
        if (pss->trailerField)
                {
                if (i2a_ASN1_INTEGER(bp, pss->trailerField) <= 0)
                        goto err;
                }
-       else if (BIO_puts(bp, "0xbc (default)") <= 0)
+       else if (BIO_puts(bp, "BC (default)") <= 0)
                goto err;
        BIO_puts(bp, "\n");
        
index 9d848db..cc30e77 100644 (file)
@@ -59,6 +59,12 @@ int RSA_check_key(const RSA *key)
        BN_CTX *ctx;
        int r;
        int ret=1;
+
+       if (!key->p || !key->q || !key->n || !key->e || !key->d)
+               {
+               RSAerr(RSA_F_RSA_CHECK_KEY, RSA_R_VALUE_MISSING);
+               return 0;
+               }
        
        i = BN_new();
        j = BN_new();
index 5b2ecf5..157aa5c 100644 (file)
@@ -611,6 +611,8 @@ static int pkey_rsa_ctrl_str(EVP_PKEY_CTX *ctx,
                        pm = RSA_NO_PADDING;
                else if (!strcmp(value, "oeap"))
                        pm = RSA_PKCS1_OAEP_PADDING;
+               else if (!strcmp(value, "oaep"))
+                       pm = RSA_PKCS1_OAEP_PADDING;
                else if (!strcmp(value, "x931"))
                        pm = RSA_X931_PADDING;
                else if (!strcmp(value, "pss"))
index cfdc45c..f15c7ec 100755 (executable)
@@ -745,7 +745,7 @@ $code.=<<___;
        mov     %rdi,$ctx       # reassigned argument
        mov     %rsi,$inp       # reassigned argument
        mov     %rdx,$num       # reassigned argument
-       vzeroall
+       vzeroupper
 
        shl     \$6,$num
        add     $inp,$num
@@ -1038,7 +1038,7 @@ ___
        &Xtail_avx(\&body_20_39);
 
 $code.=<<___;
-       vzeroall
+       vzeroupper
 
        add     0($ctx),$A                      # update context
        add     4($ctx),@T[0]
index 50dd7dc..50c229d 100644 (file)
@@ -232,7 +232,14 @@ int SHA384_Update (SHA512_CTX *c, const void *data, size_t len)
 {   return SHA512_Update (c,data,len);   }
 
 void SHA512_Transform (SHA512_CTX *c, const unsigned char *data)
-{   sha512_block_data_order (c,data,1);  }
+       {
+#ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
+       if ((size_t)data%sizeof(c->u.d[0]) != 0)
+               memcpy(c->u.p,data,sizeof(c->u.p)),
+               data = c->u.p;
+#endif
+       sha512_block_data_order (c,data,1);
+       }
 
 unsigned char *SHA384(const unsigned char *d, size_t n, unsigned char *md)
        {
index d77c9ff..8e3c35e 100644 (file)
@@ -1,22 +1,22 @@
 /* start of generated data */
 
 static BN_ULONG bn_group_1024_value[] = {
-       bn_pack4(9FC6,1D2F,C0EB,06E3),
-       bn_pack4(FD51,38FE,8376,435B),
-       bn_pack4(2FD4,CBF4,976E,AA9A),
-       bn_pack4(68ED,BC3C,0572,6CC0),
-       bn_pack4(C529,F566,660E,57EC),
-       bn_pack4(8255,9B29,7BCF,1885),
-       bn_pack4(CE8E,F4AD,69B1,5D49),
-       bn_pack4(5DC7,D7B4,6154,D6B6),
-       bn_pack4(8E49,5C1D,6089,DAD1),
-       bn_pack4(E0D5,D8E2,50B9,8BE4),
-       bn_pack4(383B,4813,D692,C6E0),
-       bn_pack4(D674,DF74,96EA,81D3),
-       bn_pack4(9EA2,314C,9C25,6576),
-       bn_pack4(6072,6187,75FF,3C0B),
-       bn_pack4(9C33,F80A,FA8F,C5E8),
-       bn_pack4(EEAF,0AB9,ADB3,8DD6)
+       bn_pack4(0x9FC6,0x1D2F,0xC0EB,0x06E3),
+       bn_pack4(0xFD51,0x38FE,0x8376,0x435B),
+       bn_pack4(0x2FD4,0xCBF4,0x976E,0xAA9A),
+       bn_pack4(0x68ED,0xBC3C,0x0572,0x6CC0),
+       bn_pack4(0xC529,0xF566,0x660E,0x57EC),
+       bn_pack4(0x8255,0x9B29,0x7BCF,0x1885),
+       bn_pack4(0xCE8E,0xF4AD,0x69B1,0x5D49),
+       bn_pack4(0x5DC7,0xD7B4,0x6154,0xD6B6),
+       bn_pack4(0x8E49,0x5C1D,0x6089,0xDAD1),
+       bn_pack4(0xE0D5,0xD8E2,0x50B9,0x8BE4),
+       bn_pack4(0x383B,0x4813,0xD692,0xC6E0),
+       bn_pack4(0xD674,0xDF74,0x96EA,0x81D3),
+       bn_pack4(0x9EA2,0x314C,0x9C25,0x6576),
+       bn_pack4(0x6072,0x6187,0x75FF,0x3C0B),
+       bn_pack4(0x9C33,0xF80A,0xFA8F,0xC5E8),
+       bn_pack4(0xEEAF,0x0AB9,0xADB3,0x8DD6)
 };
 static BIGNUM bn_group_1024 = {
        bn_group_1024_value,
@@ -27,30 +27,30 @@ static BIGNUM bn_group_1024 = {
 };
 
 static BN_ULONG bn_group_1536_value[] = {
-       bn_pack4(CF76,E3FE,D135,F9BB),
-       bn_pack4(1518,0F93,499A,234D),
-       bn_pack4(8CE7,A28C,2442,C6F3),
-       bn_pack4(5A02,1FFF,5E91,479E),
-       bn_pack4(7F8A,2FE9,B8B5,292E),
-       bn_pack4(837C,264A,E3A9,BEB8),
-       bn_pack4(E442,734A,F7CC,B7AE),
-       bn_pack4(6577,2E43,7D6C,7F8C),
-       bn_pack4(DB2F,D53D,24B7,C486),
-       bn_pack4(6EDF,0195,3934,9627),
-       bn_pack4(158B,FD3E,2B9C,8CF5),
-       bn_pack4(764E,3F4B,53DD,9DA1),
-       bn_pack4(4754,8381,DBC5,B1FC),
-       bn_pack4(9B60,9E0B,E3BA,B63D),
-       bn_pack4(8134,B1C8,B979,8914),
-       bn_pack4(DF02,8A7C,EC67,F0D0),
-       bn_pack4(80B6,55BB,9A22,E8DC),
-       bn_pack4(1558,903B,A0D0,F843),
-       bn_pack4(51C6,A94B,E460,7A29),
-       bn_pack4(5F4F,5F55,6E27,CBDE),
-       bn_pack4(BEEE,A961,4B19,CC4D),
-       bn_pack4(DBA5,1DF4,99AC,4C80),
-       bn_pack4(B1F1,2A86,17A4,7BBB),
-       bn_pack4(9DEF,3CAF,B939,277A)
+       bn_pack4(0xCF76,0xE3FE,0xD135,0xF9BB),
+       bn_pack4(0x1518,0x0F93,0x499A,0x234D),
+       bn_pack4(0x8CE7,0xA28C,0x2442,0xC6F3),
+       bn_pack4(0x5A02,0x1FFF,0x5E91,0x479E),
+       bn_pack4(0x7F8A,0x2FE9,0xB8B5,0x292E),
+       bn_pack4(0x837C,0x264A,0xE3A9,0xBEB8),
+       bn_pack4(0xE442,0x734A,0xF7CC,0xB7AE),
+       bn_pack4(0x6577,0x2E43,0x7D6C,0x7F8C),
+       bn_pack4(0xDB2F,0xD53D,0x24B7,0xC486),
+       bn_pack4(0x6EDF,0x0195,0x3934,0x9627),
+       bn_pack4(0x158B,0xFD3E,0x2B9C,0x8CF5),
+       bn_pack4(0x764E,0x3F4B,0x53DD,0x9DA1),
+       bn_pack4(0x4754,0x8381,0xDBC5,0xB1FC),
+       bn_pack4(0x9B60,0x9E0B,0xE3BA,0xB63D),
+       bn_pack4(0x8134,0xB1C8,0xB979,0x8914),
+       bn_pack4(0xDF02,0x8A7C,0xEC67,0xF0D0),
+       bn_pack4(0x80B6,0x55BB,0x9A22,0xE8DC),
+       bn_pack4(0x1558,0x903B,0xA0D0,0xF843),
+       bn_pack4(0x51C6,0xA94B,0xE460,0x7A29),
+       bn_pack4(0x5F4F,0x5F55,0x6E27,0xCBDE),
+       bn_pack4(0xBEEE,0xA961,0x4B19,0xCC4D),
+       bn_pack4(0xDBA5,0x1DF4,0x99AC,0x4C80),
+       bn_pack4(0xB1F1,0x2A86,0x17A4,0x7BBB),
+       bn_pack4(0x9DEF,0x3CAF,0xB939,0x277A)
 };
 static BIGNUM bn_group_1536 = {
        bn_group_1536_value,
@@ -61,38 +61,38 @@ static BIGNUM bn_group_1536 = {
 };
 
 static BN_ULONG bn_group_2048_value[] = {
-       bn_pack4(0FA7,111F,9E4A,FF73),
-       bn_pack4(9B65,E372,FCD6,8EF2),
-       bn_pack4(35DE,236D,525F,5475),
-       bn_pack4(94B5,C803,D89F,7AE4),
-       bn_pack4(71AE,35F8,E9DB,FBB6),
-       bn_pack4(2A56,98F3,A8D0,C382),
-       bn_pack4(9CCC,041C,7BC3,08D8),
-       bn_pack4(AF87,4E73,03CE,5329),
-       bn_pack4(6160,2790,04E5,7AE6),
-       bn_pack4(032C,FBDB,F52F,B378),
-       bn_pack4(5EA7,7A27,75D2,ECFA),
-       bn_pack4(5445,23B5,24B0,D57D),
-       bn_pack4(5B9D,32E6,88F8,7748),
-       bn_pack4(F1D2,B907,8717,461A),
-       bn_pack4(76BD,207A,436C,6481),
-       bn_pack4(CA97,B43A,23FB,8016),
-       bn_pack4(1D28,1E44,6B14,773B),
-       bn_pack4(7359,D041,D5C3,3EA7),
-       bn_pack4(A80D,740A,DBF4,FF74),
-       bn_pack4(55F9,7993,EC97,5EEA),
-       bn_pack4(2918,A996,2F0B,93B8),
-       bn_pack4(661A,05FB,D5FA,AAE8),
-       bn_pack4(CF60,9517,9A16,3AB3),
-       bn_pack4(E808,3969,EDB7,67B0),
-       bn_pack4(CD7F,48A9,DA04,FD50),
-       bn_pack4(D523,12AB,4B03,310D),
-       bn_pack4(8193,E075,7767,A13D),
-       bn_pack4(A373,29CB,B4A0,99ED),
-       bn_pack4(FC31,9294,3DB5,6050),
-       bn_pack4(AF72,B665,1987,EE07),
-       bn_pack4(F166,DE5E,1389,582F),
-       bn_pack4(AC6B,DB41,324A,9A9B)
+       bn_pack4(0x0FA7,0x111F,0x9E4A,0xFF73),
+       bn_pack4(0x9B65,0xE372,0xFCD6,0x8EF2),
+       bn_pack4(0x35DE,0x236D,0x525F,0x5475),
+       bn_pack4(0x94B5,0xC803,0xD89F,0x7AE4),
+       bn_pack4(0x71AE,0x35F8,0xE9DB,0xFBB6),
+       bn_pack4(0x2A56,0x98F3,0xA8D0,0xC382),
+       bn_pack4(0x9CCC,0x041C,0x7BC3,0x08D8),
+       bn_pack4(0xAF87,0x4E73,0x03CE,0x5329),
+       bn_pack4(0x6160,0x2790,0x04E5,0x7AE6),
+       bn_pack4(0x032C,0xFBDB,0xF52F,0xB378),
+       bn_pack4(0x5EA7,0x7A27,0x75D2,0xECFA),
+       bn_pack4(0x5445,0x23B5,0x24B0,0xD57D),
+       bn_pack4(0x5B9D,0x32E6,0x88F8,0x7748),
+       bn_pack4(0xF1D2,0xB907,0x8717,0x461A),
+       bn_pack4(0x76BD,0x207A,0x436C,0x6481),
+       bn_pack4(0xCA97,0xB43A,0x23FB,0x8016),
+       bn_pack4(0x1D28,0x1E44,0x6B14,0x773B),
+       bn_pack4(0x7359,0xD041,0xD5C3,0x3EA7),
+       bn_pack4(0xA80D,0x740A,0xDBF4,0xFF74),
+       bn_pack4(0x55F9,0x7993,0xEC97,0x5EEA),
+       bn_pack4(0x2918,0xA996,0x2F0B,0x93B8),
+       bn_pack4(0x661A,0x05FB,0xD5FA,0xAAE8),
+       bn_pack4(0xCF60,0x9517,0x9A16,0x3AB3),
+       bn_pack4(0xE808,0x3969,0xEDB7,0x67B0),
+       bn_pack4(0xCD7F,0x48A9,0xDA04,0xFD50),
+       bn_pack4(0xD523,0x12AB,0x4B03,0x310D),
+       bn_pack4(0x8193,0xE075,0x7767,0xA13D),
+       bn_pack4(0xA373,0x29CB,0xB4A0,0x99ED),
+       bn_pack4(0xFC31,0x9294,0x3DB5,0x6050),
+       bn_pack4(0xAF72,0xB665,0x1987,0xEE07),
+       bn_pack4(0xF166,0xDE5E,0x1389,0x582F),
+       bn_pack4(0xAC6B,0xDB41,0x324A,0x9A9B)
 };
 static BIGNUM bn_group_2048 = {
        bn_group_2048_value,
@@ -103,54 +103,54 @@ static BIGNUM bn_group_2048 = {
 };
 
 static BN_ULONG bn_group_3072_value[] = {
-       bn_pack4(FFFF,FFFF,FFFF,FFFF),
-       bn_pack4(4B82,D120,A93A,D2CA),
-       bn_pack4(43DB,5BFC,E0FD,108E),
-       bn_pack4(08E2,4FA0,74E5,AB31),
-       bn_pack4(7709,88C0,BAD9,46E2),
-       bn_pack4(BBE1,1757,7A61,5D6C),
-       bn_pack4(521F,2B18,177B,200C),
-       bn_pack4(D876,0273,3EC8,6A64),
-       bn_pack4(F12F,FA06,D98A,0864),
-       bn_pack4(CEE3,D226,1AD2,EE6B),
-       bn_pack4(1E8C,94E0,4A25,619D),
-       bn_pack4(ABF5,AE8C,DB09,33D7),
-       bn_pack4(B397,0F85,A6E1,E4C7),
-       bn_pack4(8AEA,7157,5D06,0C7D),
-       bn_pack4(ECFB,8504,58DB,EF0A),
-       bn_pack4(A855,21AB,DF1C,BA64),
-       bn_pack4(AD33,170D,0450,7A33),
-       bn_pack4(1572,8E5A,8AAA,C42D),
-       bn_pack4(15D2,2618,98FA,0510),
-       bn_pack4(3995,497C,EA95,6AE5),
-       bn_pack4(DE2B,CBF6,9558,1718),
-       bn_pack4(B5C5,5DF0,6F4C,52C9),
-       bn_pack4(9B27,83A2,EC07,A28F),
-       bn_pack4(E39E,772C,180E,8603),
-       bn_pack4(3290,5E46,2E36,CE3B),
-       bn_pack4(F174,6C08,CA18,217C),
-       bn_pack4(670C,354E,4ABC,9804),
-       bn_pack4(9ED5,2907,7096,966D),
-       bn_pack4(1C62,F356,2085,52BB),
-       bn_pack4(8365,5D23,DCA3,AD96),
-       bn_pack4(6916,3FA8,FD24,CF5F),
-       bn_pack4(98DA,4836,1C55,D39A),
-       bn_pack4(C200,7CB8,A163,BF05),
-       bn_pack4(4928,6651,ECE4,5B3D),
-       bn_pack4(AE9F,2411,7C4B,1FE6),
-       bn_pack4(EE38,6BFB,5A89,9FA5),
-       bn_pack4(0BFF,5CB6,F406,B7ED),
-       bn_pack4(F44C,42E9,A637,ED6B),
-       bn_pack4(E485,B576,625E,7EC6),
-       bn_pack4(4FE1,356D,6D51,C245),
-       bn_pack4(302B,0A6D,F25F,1437),
-       bn_pack4(EF95,19B3,CD3A,431B),
-       bn_pack4(514A,0879,8E34,04DD),
-       bn_pack4(020B,BEA6,3B13,9B22),
-       bn_pack4(2902,4E08,8A67,CC74),
-       bn_pack4(C4C6,628B,80DC,1CD1),
-       bn_pack4(C90F,DAA2,2168,C234),
-       bn_pack4(FFFF,FFFF,FFFF,FFFF)
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF),
+       bn_pack4(0x4B82,0xD120,0xA93A,0xD2CA),
+       bn_pack4(0x43DB,0x5BFC,0xE0FD,0x108E),
+       bn_pack4(0x08E2,0x4FA0,0x74E5,0xAB31),
+       bn_pack4(0x7709,0x88C0,0xBAD9,0x46E2),
+       bn_pack4(0xBBE1,0x1757,0x7A61,0x5D6C),
+       bn_pack4(0x521F,0x2B18,0x177B,0x200C),
+       bn_pack4(0xD876,0x0273,0x3EC8,0x6A64),
+       bn_pack4(0xF12F,0xFA06,0xD98A,0x0864),
+       bn_pack4(0xCEE3,0xD226,0x1AD2,0xEE6B),
+       bn_pack4(0x1E8C,0x94E0,0x4A25,0x619D),
+       bn_pack4(0xABF5,0xAE8C,0xDB09,0x33D7),
+       bn_pack4(0xB397,0x0F85,0xA6E1,0xE4C7),
+       bn_pack4(0x8AEA,0x7157,0x5D06,0x0C7D),
+       bn_pack4(0xECFB,0x8504,0x58DB,0xEF0A),
+       bn_pack4(0xA855,0x21AB,0xDF1C,0xBA64),
+       bn_pack4(0xAD33,0x170D,0x0450,0x7A33),
+       bn_pack4(0x1572,0x8E5A,0x8AAA,0xC42D),
+       bn_pack4(0x15D2,0x2618,0x98FA,0x0510),
+       bn_pack4(0x3995,0x497C,0xEA95,0x6AE5),
+       bn_pack4(0xDE2B,0xCBF6,0x9558,0x1718),
+       bn_pack4(0xB5C5,0x5DF0,0x6F4C,0x52C9),
+       bn_pack4(0x9B27,0x83A2,0xEC07,0xA28F),
+       bn_pack4(0xE39E,0x772C,0x180E,0x8603),
+       bn_pack4(0x3290,0x5E46,0x2E36,0xCE3B),
+       bn_pack4(0xF174,0x6C08,0xCA18,0x217C),
+       bn_pack4(0x670C,0x354E,0x4ABC,0x9804),
+       bn_pack4(0x9ED5,0x2907,0x7096,0x966D),
+       bn_pack4(0x1C62,0xF356,0x2085,0x52BB),
+       bn_pack4(0x8365,0x5D23,0xDCA3,0xAD96),
+       bn_pack4(0x6916,0x3FA8,0xFD24,0xCF5F),
+       bn_pack4(0x98DA,0x4836,0x1C55,0xD39A),
+       bn_pack4(0xC200,0x7CB8,0xA163,0xBF05),
+       bn_pack4(0x4928,0x6651,0xECE4,0x5B3D),
+       bn_pack4(0xAE9F,0x2411,0x7C4B,0x1FE6),
+       bn_pack4(0xEE38,0x6BFB,0x5A89,0x9FA5),
+       bn_pack4(0x0BFF,0x5CB6,0xF406,0xB7ED),
+       bn_pack4(0xF44C,0x42E9,0xA637,0xED6B),
+       bn_pack4(0xE485,0xB576,0x625E,0x7EC6),
+       bn_pack4(0x4FE1,0x356D,0x6D51,0xC245),
+       bn_pack4(0x302B,0x0A6D,0xF25F,0x1437),
+       bn_pack4(0xEF95,0x19B3,0xCD3A,0x431B),
+       bn_pack4(0x514A,0x0879,0x8E34,0x04DD),
+       bn_pack4(0x020B,0xBEA6,0x3B13,0x9B22),
+       bn_pack4(0x2902,0x4E08,0x8A67,0xCC74),
+       bn_pack4(0xC4C6,0x628B,0x80DC,0x1CD1),
+       bn_pack4(0xC90F,0xDAA2,0x2168,0xC234),
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF)
 };
 static BIGNUM bn_group_3072 = {
        bn_group_3072_value,
@@ -161,70 +161,70 @@ static BIGNUM bn_group_3072 = {
 };
 
 static BN_ULONG bn_group_4096_value[] = {
-       bn_pack4(FFFF,FFFF,FFFF,FFFF),
-       bn_pack4(4DF4,35C9,3406,3199),
-       bn_pack4(86FF,B7DC,90A6,C08F),
-       bn_pack4(93B4,EA98,8D8F,DDC1),
-       bn_pack4(D006,9127,D5B0,5AA9),
-       bn_pack4(B81B,DD76,2170,481C),
-       bn_pack4(1F61,2970,CEE2,D7AF),
-       bn_pack4(233B,A186,515B,E7ED),
-       bn_pack4(99B2,964F,A090,C3A2),
-       bn_pack4(287C,5947,4E6B,C05D),
-       bn_pack4(2E8E,FC14,1FBE,CAA6),
-       bn_pack4(DBBB,C2DB,04DE,8EF9),
-       bn_pack4(2583,E9CA,2AD4,4CE8),
-       bn_pack4(1A94,6834,B615,0BDA),
-       bn_pack4(99C3,2718,6AF4,E23C),
-       bn_pack4(8871,9A10,BDBA,5B26),
-       bn_pack4(1A72,3C12,A787,E6D7),
-       bn_pack4(4B82,D120,A921,0801),
-       bn_pack4(43DB,5BFC,E0FD,108E),
-       bn_pack4(08E2,4FA0,74E5,AB31),
-       bn_pack4(7709,88C0,BAD9,46E2),
-       bn_pack4(BBE1,1757,7A61,5D6C),
-       bn_pack4(521F,2B18,177B,200C),
-       bn_pack4(D876,0273,3EC8,6A64),
-       bn_pack4(F12F,FA06,D98A,0864),
-       bn_pack4(CEE3,D226,1AD2,EE6B),
-       bn_pack4(1E8C,94E0,4A25,619D),
-       bn_pack4(ABF5,AE8C,DB09,33D7),
-       bn_pack4(B397,0F85,A6E1,E4C7),
-       bn_pack4(8AEA,7157,5D06,0C7D),
-       bn_pack4(ECFB,8504,58DB,EF0A),
-       bn_pack4(A855,21AB,DF1C,BA64),
-       bn_pack4(AD33,170D,0450,7A33),
-       bn_pack4(1572,8E5A,8AAA,C42D),
-       bn_pack4(15D2,2618,98FA,0510),
-       bn_pack4(3995,497C,EA95,6AE5),
-       bn_pack4(DE2B,CBF6,9558,1718),
-       bn_pack4(B5C5,5DF0,6F4C,52C9),
-       bn_pack4(9B27,83A2,EC07,A28F),
-       bn_pack4(E39E,772C,180E,8603),
-       bn_pack4(3290,5E46,2E36,CE3B),
-       bn_pack4(F174,6C08,CA18,217C),
-       bn_pack4(670C,354E,4ABC,9804),
-       bn_pack4(9ED5,2907,7096,966D),
-       bn_pack4(1C62,F356,2085,52BB),
-       bn_pack4(8365,5D23,DCA3,AD96),
-       bn_pack4(6916,3FA8,FD24,CF5F),
-       bn_pack4(98DA,4836,1C55,D39A),
-       bn_pack4(C200,7CB8,A163,BF05),
-       bn_pack4(4928,6651,ECE4,5B3D),
-       bn_pack4(AE9F,2411,7C4B,1FE6),
-       bn_pack4(EE38,6BFB,5A89,9FA5),
-       bn_pack4(0BFF,5CB6,F406,B7ED),
-       bn_pack4(F44C,42E9,A637,ED6B),
-       bn_pack4(E485,B576,625E,7EC6),
-       bn_pack4(4FE1,356D,6D51,C245),
-       bn_pack4(302B,0A6D,F25F,1437),
-       bn_pack4(EF95,19B3,CD3A,431B),
-       bn_pack4(514A,0879,8E34,04DD),
-       bn_pack4(020B,BEA6,3B13,9B22),
-       bn_pack4(2902,4E08,8A67,CC74),
-       bn_pack4(C4C6,628B,80DC,1CD1),
-       bn_pack4(C90F,DAA2,2168,C234),
-       bn_pack4(FFFF,FFFF,FFFF,FFFF)
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF),
+       bn_pack4(0x4DF4,0x35C9,0x3406,0x3199),
+       bn_pack4(0x86FF,0xB7DC,0x90A6,0xC08F),
+       bn_pack4(0x93B4,0xEA98,0x8D8F,0xDDC1),
+       bn_pack4(0xD006,0x9127,0xD5B0,0x5AA9),
+       bn_pack4(0xB81B,0xDD76,0x2170,0x481C),
+       bn_pack4(0x1F61,0x2970,0xCEE2,0xD7AF),
+       bn_pack4(0x233B,0xA186,0x515B,0xE7ED),
+       bn_pack4(0x99B2,0x964F,0xA090,0xC3A2),
+       bn_pack4(0x287C,0x5947,0x4E6B,0xC05D),
+       bn_pack4(0x2E8E,0xFC14,0x1FBE,0xCAA6),
+       bn_pack4(0xDBBB,0xC2DB,0x04DE,0x8EF9),
+       bn_pack4(0x2583,0xE9CA,0x2AD4,0x4CE8),
+       bn_pack4(0x1A94,0x6834,0xB615,0x0BDA),
+       bn_pack4(0x99C3,0x2718,0x6AF4,0xE23C),
+       bn_pack4(0x8871,0x9A10,0xBDBA,0x5B26),
+       bn_pack4(0x1A72,0x3C12,0xA787,0xE6D7),
+       bn_pack4(0x4B82,0xD120,0xA921,0x0801),
+       bn_pack4(0x43DB,0x5BFC,0xE0FD,0x108E),
+       bn_pack4(0x08E2,0x4FA0,0x74E5,0xAB31),
+       bn_pack4(0x7709,0x88C0,0xBAD9,0x46E2),
+       bn_pack4(0xBBE1,0x1757,0x7A61,0x5D6C),
+       bn_pack4(0x521F,0x2B18,0x177B,0x200C),
+       bn_pack4(0xD876,0x0273,0x3EC8,0x6A64),
+       bn_pack4(0xF12F,0xFA06,0xD98A,0x0864),
+       bn_pack4(0xCEE3,0xD226,0x1AD2,0xEE6B),
+       bn_pack4(0x1E8C,0x94E0,0x4A25,0x619D),
+       bn_pack4(0xABF5,0xAE8C,0xDB09,0x33D7),
+       bn_pack4(0xB397,0x0F85,0xA6E1,0xE4C7),
+       bn_pack4(0x8AEA,0x7157,0x5D06,0x0C7D),
+       bn_pack4(0xECFB,0x8504,0x58DB,0xEF0A),
+       bn_pack4(0xA855,0x21AB,0xDF1C,0xBA64),
+       bn_pack4(0xAD33,0x170D,0x0450,0x7A33),
+       bn_pack4(0x1572,0x8E5A,0x8AAA,0xC42D),
+       bn_pack4(0x15D2,0x2618,0x98FA,0x0510),
+       bn_pack4(0x3995,0x497C,0xEA95,0x6AE5),
+       bn_pack4(0xDE2B,0xCBF6,0x9558,0x1718),
+       bn_pack4(0xB5C5,0x5DF0,0x6F4C,0x52C9),
+       bn_pack4(0x9B27,0x83A2,0xEC07,0xA28F),
+       bn_pack4(0xE39E,0x772C,0x180E,0x8603),
+       bn_pack4(0x3290,0x5E46,0x2E36,0xCE3B),
+       bn_pack4(0xF174,0x6C08,0xCA18,0x217C),
+       bn_pack4(0x670C,0x354E,0x4ABC,0x9804),
+       bn_pack4(0x9ED5,0x2907,0x7096,0x966D),
+       bn_pack4(0x1C62,0xF356,0x2085,0x52BB),
+       bn_pack4(0x8365,0x5D23,0xDCA3,0xAD96),
+       bn_pack4(0x6916,0x3FA8,0xFD24,0xCF5F),
+       bn_pack4(0x98DA,0x4836,0x1C55,0xD39A),
+       bn_pack4(0xC200,0x7CB8,0xA163,0xBF05),
+       bn_pack4(0x4928,0x6651,0xECE4,0x5B3D),
+       bn_pack4(0xAE9F,0x2411,0x7C4B,0x1FE6),
+       bn_pack4(0xEE38,0x6BFB,0x5A89,0x9FA5),
+       bn_pack4(0x0BFF,0x5CB6,0xF406,0xB7ED),
+       bn_pack4(0xF44C,0x42E9,0xA637,0xED6B),
+       bn_pack4(0xE485,0xB576,0x625E,0x7EC6),
+       bn_pack4(0x4FE1,0x356D,0x6D51,0xC245),
+       bn_pack4(0x302B,0x0A6D,0xF25F,0x1437),
+       bn_pack4(0xEF95,0x19B3,0xCD3A,0x431B),
+       bn_pack4(0x514A,0x0879,0x8E34,0x04DD),
+       bn_pack4(0x020B,0xBEA6,0x3B13,0x9B22),
+       bn_pack4(0x2902,0x4E08,0x8A67,0xCC74),
+       bn_pack4(0xC4C6,0x628B,0x80DC,0x1CD1),
+       bn_pack4(0xC90F,0xDAA2,0x2168,0xC234),
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF)
 };
 static BIGNUM bn_group_4096 = {
        bn_group_4096_value,
@@ -235,102 +235,102 @@ static BIGNUM bn_group_4096 = {
 };
 
 static BN_ULONG bn_group_6144_value[] = {
-       bn_pack4(FFFF,FFFF,FFFF,FFFF),
-       bn_pack4(E694,F91E,6DCC,4024),
-       bn_pack4(12BF,2D5B,0B74,74D6),
-       bn_pack4(043E,8F66,3F48,60EE),
-       bn_pack4(387F,E8D7,6E3C,0468),
-       bn_pack4(DA56,C9EC,2EF2,9632),
-       bn_pack4(EB19,CCB1,A313,D55C),
-       bn_pack4(F550,AA3D,8A1F,BFF0),
-       bn_pack4(06A1,D58B,B7C5,DA76),
-       bn_pack4(A797,15EE,F29B,E328),
-       bn_pack4(14CC,5ED2,0F80,37E0),
-       bn_pack4(CC8F,6D7E,BF48,E1D8),
-       bn_pack4(4BD4,07B2,2B41,54AA),
-       bn_pack4(0F1D,45B7,FF58,5AC5),
-       bn_pack4(23A9,7A7E,36CC,88BE),
-       bn_pack4(59E7,C97F,BEC7,E8F3),
-       bn_pack4(B5A8,4031,900B,1C9E),
-       bn_pack4(D55E,702F,4698,0C82),
-       bn_pack4(F482,D7CE,6E74,FEF6),
-       bn_pack4(F032,EA15,D172,1D03),
-       bn_pack4(5983,CA01,C64B,92EC),
-       bn_pack4(6FB8,F401,378C,D2BF),
-       bn_pack4(3320,5151,2BD7,AF42),
-       bn_pack4(DB7F,1447,E6CC,254B),
-       bn_pack4(44CE,6CBA,CED4,BB1B),
-       bn_pack4(DA3E,DBEB,CF9B,14ED),
-       bn_pack4(1797,27B0,865A,8918),
-       bn_pack4(B06A,53ED,9027,D831),
-       bn_pack4(E5DB,382F,4130,01AE),
-       bn_pack4(F8FF,9406,AD9E,530E),
-       bn_pack4(C975,1E76,3DBA,37BD),
-       bn_pack4(C1D4,DCB2,6026,46DE),
-       bn_pack4(36C3,FAB4,D27C,7026),
-       bn_pack4(4DF4,35C9,3402,8492),
-       bn_pack4(86FF,B7DC,90A6,C08F),
-       bn_pack4(93B4,EA98,8D8F,DDC1),
-       bn_pack4(D006,9127,D5B0,5AA9),
-       bn_pack4(B81B,DD76,2170,481C),
-       bn_pack4(1F61,2970,CEE2,D7AF),
-       bn_pack4(233B,A186,515B,E7ED),
-       bn_pack4(99B2,964F,A090,C3A2),
-       bn_pack4(287C,5947,4E6B,C05D),
-       bn_pack4(2E8E,FC14,1FBE,CAA6),
-       bn_pack4(DBBB,C2DB,04DE,8EF9),
-       bn_pack4(2583,E9CA,2AD4,4CE8),
-       bn_pack4(1A94,6834,B615,0BDA),
-       bn_pack4(99C3,2718,6AF4,E23C),
-       bn_pack4(8871,9A10,BDBA,5B26),
-       bn_pack4(1A72,3C12,A787,E6D7),
-       bn_pack4(4B82,D120,A921,0801),
-       bn_pack4(43DB,5BFC,E0FD,108E),
-       bn_pack4(08E2,4FA0,74E5,AB31),
-       bn_pack4(7709,88C0,BAD9,46E2),
-       bn_pack4(BBE1,1757,7A61,5D6C),
-       bn_pack4(521F,2B18,177B,200C),
-       bn_pack4(D876,0273,3EC8,6A64),
-       bn_pack4(F12F,FA06,D98A,0864),
-       bn_pack4(CEE3,D226,1AD2,EE6B),
-       bn_pack4(1E8C,94E0,4A25,619D),
-       bn_pack4(ABF5,AE8C,DB09,33D7),
-       bn_pack4(B397,0F85,A6E1,E4C7),
-       bn_pack4(8AEA,7157,5D06,0C7D),
-       bn_pack4(ECFB,8504,58DB,EF0A),
-       bn_pack4(A855,21AB,DF1C,BA64),
-       bn_pack4(AD33,170D,0450,7A33),
-       bn_pack4(1572,8E5A,8AAA,C42D),
-       bn_pack4(15D2,2618,98FA,0510),
-       bn_pack4(3995,497C,EA95,6AE5),
-       bn_pack4(DE2B,CBF6,9558,1718),
-       bn_pack4(B5C5,5DF0,6F4C,52C9),
-       bn_pack4(9B27,83A2,EC07,A28F),
-       bn_pack4(E39E,772C,180E,8603),
-       bn_pack4(3290,5E46,2E36,CE3B),
-       bn_pack4(F174,6C08,CA18,217C),
-       bn_pack4(670C,354E,4ABC,9804),
-       bn_pack4(9ED5,2907,7096,966D),
-       bn_pack4(1C62,F356,2085,52BB),
-       bn_pack4(8365,5D23,DCA3,AD96),
-       bn_pack4(6916,3FA8,FD24,CF5F),
-       bn_pack4(98DA,4836,1C55,D39A),
-       bn_pack4(C200,7CB8,A163,BF05),
-       bn_pack4(4928,6651,ECE4,5B3D),
-       bn_pack4(AE9F,2411,7C4B,1FE6),
-       bn_pack4(EE38,6BFB,5A89,9FA5),
-       bn_pack4(0BFF,5CB6,F406,B7ED),
-       bn_pack4(F44C,42E9,A637,ED6B),
-       bn_pack4(E485,B576,625E,7EC6),
-       bn_pack4(4FE1,356D,6D51,C245),
-       bn_pack4(302B,0A6D,F25F,1437),
-       bn_pack4(EF95,19B3,CD3A,431B),
-       bn_pack4(514A,0879,8E34,04DD),
-       bn_pack4(020B,BEA6,3B13,9B22),
-       bn_pack4(2902,4E08,8A67,CC74),
-       bn_pack4(C4C6,628B,80DC,1CD1),
-       bn_pack4(C90F,DAA2,2168,C234),
-       bn_pack4(FFFF,FFFF,FFFF,FFFF)
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF),
+       bn_pack4(0xE694,0xF91E,0x6DCC,0x4024),
+       bn_pack4(0x12BF,0x2D5B,0x0B74,0x74D6),
+       bn_pack4(0x043E,0x8F66,0x3F48,0x60EE),
+       bn_pack4(0x387F,0xE8D7,0x6E3C,0x0468),
+       bn_pack4(0xDA56,0xC9EC,0x2EF2,0x9632),
+       bn_pack4(0xEB19,0xCCB1,0xA313,0xD55C),
+       bn_pack4(0xF550,0xAA3D,0x8A1F,0xBFF0),
+       bn_pack4(0x06A1,0xD58B,0xB7C5,0xDA76),
+       bn_pack4(0xA797,0x15EE,0xF29B,0xE328),
+       bn_pack4(0x14CC,0x5ED2,0x0F80,0x37E0),
+       bn_pack4(0xCC8F,0x6D7E,0xBF48,0xE1D8),
+       bn_pack4(0x4BD4,0x07B2,0x2B41,0x54AA),
+       bn_pack4(0x0F1D,0x45B7,0xFF58,0x5AC5),
+       bn_pack4(0x23A9,0x7A7E,0x36CC,0x88BE),
+       bn_pack4(0x59E7,0xC97F,0xBEC7,0xE8F3),
+       bn_pack4(0xB5A8,0x4031,0x900B,0x1C9E),
+       bn_pack4(0xD55E,0x702F,0x4698,0x0C82),
+       bn_pack4(0xF482,0xD7CE,0x6E74,0xFEF6),
+       bn_pack4(0xF032,0xEA15,0xD172,0x1D03),
+       bn_pack4(0x5983,0xCA01,0xC64B,0x92EC),
+       bn_pack4(0x6FB8,0xF401,0x378C,0xD2BF),
+       bn_pack4(0x3320,0x5151,0x2BD7,0xAF42),
+       bn_pack4(0xDB7F,0x1447,0xE6CC,0x254B),
+       bn_pack4(0x44CE,0x6CBA,0xCED4,0xBB1B),
+       bn_pack4(0xDA3E,0xDBEB,0xCF9B,0x14ED),
+       bn_pack4(0x1797,0x27B0,0x865A,0x8918),
+       bn_pack4(0xB06A,0x53ED,0x9027,0xD831),
+       bn_pack4(0xE5DB,0x382F,0x4130,0x01AE),
+       bn_pack4(0xF8FF,0x9406,0xAD9E,0x530E),
+       bn_pack4(0xC975,0x1E76,0x3DBA,0x37BD),
+       bn_pack4(0xC1D4,0xDCB2,0x6026,0x46DE),
+       bn_pack4(0x36C3,0xFAB4,0xD27C,0x7026),
+       bn_pack4(0x4DF4,0x35C9,0x3402,0x8492),
+       bn_pack4(0x86FF,0xB7DC,0x90A6,0xC08F),
+       bn_pack4(0x93B4,0xEA98,0x8D8F,0xDDC1),
+       bn_pack4(0xD006,0x9127,0xD5B0,0x5AA9),
+       bn_pack4(0xB81B,0xDD76,0x2170,0x481C),
+       bn_pack4(0x1F61,0x2970,0xCEE2,0xD7AF),
+       bn_pack4(0x233B,0xA186,0x515B,0xE7ED),
+       bn_pack4(0x99B2,0x964F,0xA090,0xC3A2),
+       bn_pack4(0x287C,0x5947,0x4E6B,0xC05D),
+       bn_pack4(0x2E8E,0xFC14,0x1FBE,0xCAA6),
+       bn_pack4(0xDBBB,0xC2DB,0x04DE,0x8EF9),
+       bn_pack4(0x2583,0xE9CA,0x2AD4,0x4CE8),
+       bn_pack4(0x1A94,0x6834,0xB615,0x0BDA),
+       bn_pack4(0x99C3,0x2718,0x6AF4,0xE23C),
+       bn_pack4(0x8871,0x9A10,0xBDBA,0x5B26),
+       bn_pack4(0x1A72,0x3C12,0xA787,0xE6D7),
+       bn_pack4(0x4B82,0xD120,0xA921,0x0801),
+       bn_pack4(0x43DB,0x5BFC,0xE0FD,0x108E),
+       bn_pack4(0x08E2,0x4FA0,0x74E5,0xAB31),
+       bn_pack4(0x7709,0x88C0,0xBAD9,0x46E2),
+       bn_pack4(0xBBE1,0x1757,0x7A61,0x5D6C),
+       bn_pack4(0x521F,0x2B18,0x177B,0x200C),
+       bn_pack4(0xD876,0x0273,0x3EC8,0x6A64),
+       bn_pack4(0xF12F,0xFA06,0xD98A,0x0864),
+       bn_pack4(0xCEE3,0xD226,0x1AD2,0xEE6B),
+       bn_pack4(0x1E8C,0x94E0,0x4A25,0x619D),
+       bn_pack4(0xABF5,0xAE8C,0xDB09,0x33D7),
+       bn_pack4(0xB397,0x0F85,0xA6E1,0xE4C7),
+       bn_pack4(0x8AEA,0x7157,0x5D06,0x0C7D),
+       bn_pack4(0xECFB,0x8504,0x58DB,0xEF0A),
+       bn_pack4(0xA855,0x21AB,0xDF1C,0xBA64),
+       bn_pack4(0xAD33,0x170D,0x0450,0x7A33),
+       bn_pack4(0x1572,0x8E5A,0x8AAA,0xC42D),
+       bn_pack4(0x15D2,0x2618,0x98FA,0x0510),
+       bn_pack4(0x3995,0x497C,0xEA95,0x6AE5),
+       bn_pack4(0xDE2B,0xCBF6,0x9558,0x1718),
+       bn_pack4(0xB5C5,0x5DF0,0x6F4C,0x52C9),
+       bn_pack4(0x9B27,0x83A2,0xEC07,0xA28F),
+       bn_pack4(0xE39E,0x772C,0x180E,0x8603),
+       bn_pack4(0x3290,0x5E46,0x2E36,0xCE3B),
+       bn_pack4(0xF174,0x6C08,0xCA18,0x217C),
+       bn_pack4(0x670C,0x354E,0x4ABC,0x9804),
+       bn_pack4(0x9ED5,0x2907,0x7096,0x966D),
+       bn_pack4(0x1C62,0xF356,0x2085,0x52BB),
+       bn_pack4(0x8365,0x5D23,0xDCA3,0xAD96),
+       bn_pack4(0x6916,0x3FA8,0xFD24,0xCF5F),
+       bn_pack4(0x98DA,0x4836,0x1C55,0xD39A),
+       bn_pack4(0xC200,0x7CB8,0xA163,0xBF05),
+       bn_pack4(0x4928,0x6651,0xECE4,0x5B3D),
+       bn_pack4(0xAE9F,0x2411,0x7C4B,0x1FE6),
+       bn_pack4(0xEE38,0x6BFB,0x5A89,0x9FA5),
+       bn_pack4(0x0BFF,0x5CB6,0xF406,0xB7ED),
+       bn_pack4(0xF44C,0x42E9,0xA637,0xED6B),
+       bn_pack4(0xE485,0xB576,0x625E,0x7EC6),
+       bn_pack4(0x4FE1,0x356D,0x6D51,0xC245),
+       bn_pack4(0x302B,0x0A6D,0xF25F,0x1437),
+       bn_pack4(0xEF95,0x19B3,0xCD3A,0x431B),
+       bn_pack4(0x514A,0x0879,0x8E34,0x04DD),
+       bn_pack4(0x020B,0xBEA6,0x3B13,0x9B22),
+       bn_pack4(0x2902,0x4E08,0x8A67,0xCC74),
+       bn_pack4(0xC4C6,0x628B,0x80DC,0x1CD1),
+       bn_pack4(0xC90F,0xDAA2,0x2168,0xC234),
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF)
 };
 static BIGNUM bn_group_6144 = {
        bn_group_6144_value,
@@ -341,134 +341,134 @@ static BIGNUM bn_group_6144 = {
 };
 
 static BN_ULONG bn_group_8192_value[] = {
-       bn_pack4(FFFF,FFFF,FFFF,FFFF),
-       bn_pack4(60C9,80DD,98ED,D3DF),
-       bn_pack4(C81F,56E8,80B9,6E71),
-       bn_pack4(9E30,50E2,7656,94DF),
-       bn_pack4(9558,E447,5677,E9AA),
-       bn_pack4(C919,0DA6,FC02,6E47),
-       bn_pack4(889A,002E,D5EE,382B),
-       bn_pack4(4009,438B,481C,6CD7),
-       bn_pack4(3590,46F4,EB87,9F92),
-       bn_pack4(FAF3,6BC3,1ECF,A268),
-       bn_pack4(B1D5,10BD,7EE7,4D73),
-       bn_pack4(F9AB,4819,5DED,7EA1),
-       bn_pack4(64F3,1CC5,0846,851D),
-       bn_pack4(4597,E899,A025,5DC1),
-       bn_pack4(DF31,0EE0,74AB,6A36),
-       bn_pack4(6D2A,13F8,3F44,F82D),
-       bn_pack4(062B,3CF5,B3A2,78A6),
-       bn_pack4(7968,3303,ED5B,DD3A),
-       bn_pack4(FA9D,4B7F,A2C0,87E8),
-       bn_pack4(4BCB,C886,2F83,85DD),
-       bn_pack4(3473,FC64,6CEA,306B),
-       bn_pack4(13EB,57A8,1A23,F0C7),
-       bn_pack4(2222,2E04,A403,7C07),
-       bn_pack4(E3FD,B8BE,FC84,8AD9),
-       bn_pack4(238F,16CB,E39D,652D),
-       bn_pack4(3423,B474,2BF1,C978),
-       bn_pack4(3AAB,639C,5AE4,F568),
-       bn_pack4(2576,F693,6BA4,2466),
-       bn_pack4(741F,A7BF,8AFC,47ED),
-       bn_pack4(3BC8,32B6,8D9D,D300),
-       bn_pack4(D8BE,C4D0,73B9,31BA),
-       bn_pack4(3877,7CB6,A932,DF8C),
-       bn_pack4(74A3,926F,12FE,E5E4),
-       bn_pack4(E694,F91E,6DBE,1159),
-       bn_pack4(12BF,2D5B,0B74,74D6),
-       bn_pack4(043E,8F66,3F48,60EE),
-       bn_pack4(387F,E8D7,6E3C,0468),
-       bn_pack4(DA56,C9EC,2EF2,9632),
-       bn_pack4(EB19,CCB1,A313,D55C),
-       bn_pack4(F550,AA3D,8A1F,BFF0),
-       bn_pack4(06A1,D58B,B7C5,DA76),
-       bn_pack4(A797,15EE,F29B,E328),
-       bn_pack4(14CC,5ED2,0F80,37E0),
-       bn_pack4(CC8F,6D7E,BF48,E1D8),
-       bn_pack4(4BD4,07B2,2B41,54AA),
-       bn_pack4(0F1D,45B7,FF58,5AC5),
-       bn_pack4(23A9,7A7E,36CC,88BE),
-       bn_pack4(59E7,C97F,BEC7,E8F3),
-       bn_pack4(B5A8,4031,900B,1C9E),
-       bn_pack4(D55E,702F,4698,0C82),
-       bn_pack4(F482,D7CE,6E74,FEF6),
-       bn_pack4(F032,EA15,D172,1D03),
-       bn_pack4(5983,CA01,C64B,92EC),
-       bn_pack4(6FB8,F401,378C,D2BF),
-       bn_pack4(3320,5151,2BD7,AF42),
-       bn_pack4(DB7F,1447,E6CC,254B),
-       bn_pack4(44CE,6CBA,CED4,BB1B),
-       bn_pack4(DA3E,DBEB,CF9B,14ED),
-       bn_pack4(1797,27B0,865A,8918),
-       bn_pack4(B06A,53ED,9027,D831),
-       bn_pack4(E5DB,382F,4130,01AE),
-       bn_pack4(F8FF,9406,AD9E,530E),
-       bn_pack4(C975,1E76,3DBA,37BD),
-       bn_pack4(C1D4,DCB2,6026,46DE),
-       bn_pack4(36C3,FAB4,D27C,7026),
-       bn_pack4(4DF4,35C9,3402,8492),
-       bn_pack4(86FF,B7DC,90A6,C08F),
-       bn_pack4(93B4,EA98,8D8F,DDC1),
-       bn_pack4(D006,9127,D5B0,5AA9),
-       bn_pack4(B81B,DD76,2170,481C),
-       bn_pack4(1F61,2970,CEE2,D7AF),
-       bn_pack4(233B,A186,515B,E7ED),
-       bn_pack4(99B2,964F,A090,C3A2),
-       bn_pack4(287C,5947,4E6B,C05D),
-       bn_pack4(2E8E,FC14,1FBE,CAA6),
-       bn_pack4(DBBB,C2DB,04DE,8EF9),
-       bn_pack4(2583,E9CA,2AD4,4CE8),
-       bn_pack4(1A94,6834,B615,0BDA),
-       bn_pack4(99C3,2718,6AF4,E23C),
-       bn_pack4(8871,9A10,BDBA,5B26),
-       bn_pack4(1A72,3C12,A787,E6D7),
-       bn_pack4(4B82,D120,A921,0801),
-       bn_pack4(43DB,5BFC,E0FD,108E),
-       bn_pack4(08E2,4FA0,74E5,AB31),
-       bn_pack4(7709,88C0,BAD9,46E2),
-       bn_pack4(BBE1,1757,7A61,5D6C),
-       bn_pack4(521F,2B18,177B,200C),
-       bn_pack4(D876,0273,3EC8,6A64),
-       bn_pack4(F12F,FA06,D98A,0864),
-       bn_pack4(CEE3,D226,1AD2,EE6B),
-       bn_pack4(1E8C,94E0,4A25,619D),
-       bn_pack4(ABF5,AE8C,DB09,33D7),
-       bn_pack4(B397,0F85,A6E1,E4C7),
-       bn_pack4(8AEA,7157,5D06,0C7D),
-       bn_pack4(ECFB,8504,58DB,EF0A),
-       bn_pack4(A855,21AB,DF1C,BA64),
-       bn_pack4(AD33,170D,0450,7A33),
-       bn_pack4(1572,8E5A,8AAA,C42D),
-       bn_pack4(15D2,2618,98FA,0510),
-       bn_pack4(3995,497C,EA95,6AE5),
-       bn_pack4(DE2B,CBF6,9558,1718),
-       bn_pack4(B5C5,5DF0,6F4C,52C9),
-       bn_pack4(9B27,83A2,EC07,A28F),
-       bn_pack4(E39E,772C,180E,8603),
-       bn_pack4(3290,5E46,2E36,CE3B),
-       bn_pack4(F174,6C08,CA18,217C),
-       bn_pack4(670C,354E,4ABC,9804),
-       bn_pack4(9ED5,2907,7096,966D),
-       bn_pack4(1C62,F356,2085,52BB),
-       bn_pack4(8365,5D23,DCA3,AD96),
-       bn_pack4(6916,3FA8,FD24,CF5F),
-       bn_pack4(98DA,4836,1C55,D39A),
-       bn_pack4(C200,7CB8,A163,BF05),
-       bn_pack4(4928,6651,ECE4,5B3D),
-       bn_pack4(AE9F,2411,7C4B,1FE6),
-       bn_pack4(EE38,6BFB,5A89,9FA5),
-       bn_pack4(0BFF,5CB6,F406,B7ED),
-       bn_pack4(F44C,42E9,A637,ED6B),
-       bn_pack4(E485,B576,625E,7EC6),
-       bn_pack4(4FE1,356D,6D51,C245),
-       bn_pack4(302B,0A6D,F25F,1437),
-       bn_pack4(EF95,19B3,CD3A,431B),
-       bn_pack4(514A,0879,8E34,04DD),
-       bn_pack4(020B,BEA6,3B13,9B22),
-       bn_pack4(2902,4E08,8A67,CC74),
-       bn_pack4(C4C6,628B,80DC,1CD1),
-       bn_pack4(C90F,DAA2,2168,C234),
-       bn_pack4(FFFF,FFFF,FFFF,FFFF)
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF),
+       bn_pack4(0x60C9,0x80DD,0x98ED,0xD3DF),
+       bn_pack4(0xC81F,0x56E8,0x80B9,0x6E71),
+       bn_pack4(0x9E30,0x50E2,0x7656,0x94DF),
+       bn_pack4(0x9558,0xE447,0x5677,0xE9AA),
+       bn_pack4(0xC919,0x0DA6,0xFC02,0x6E47),
+       bn_pack4(0x889A,0x002E,0xD5EE,0x382B),
+       bn_pack4(0x4009,0x438B,0x481C,0x6CD7),
+       bn_pack4(0x3590,0x46F4,0xEB87,0x9F92),
+       bn_pack4(0xFAF3,0x6BC3,0x1ECF,0xA268),
+       bn_pack4(0xB1D5,0x10BD,0x7EE7,0x4D73),
+       bn_pack4(0xF9AB,0x4819,0x5DED,0x7EA1),
+       bn_pack4(0x64F3,0x1CC5,0x0846,0x851D),
+       bn_pack4(0x4597,0xE899,0xA025,0x5DC1),
+       bn_pack4(0xDF31,0x0EE0,0x74AB,0x6A36),
+       bn_pack4(0x6D2A,0x13F8,0x3F44,0xF82D),
+       bn_pack4(0x062B,0x3CF5,0xB3A2,0x78A6),
+       bn_pack4(0x7968,0x3303,0xED5B,0xDD3A),
+       bn_pack4(0xFA9D,0x4B7F,0xA2C0,0x87E8),
+       bn_pack4(0x4BCB,0xC886,0x2F83,0x85DD),
+       bn_pack4(0x3473,0xFC64,0x6CEA,0x306B),
+       bn_pack4(0x13EB,0x57A8,0x1A23,0xF0C7),
+       bn_pack4(0x2222,0x2E04,0xA403,0x7C07),
+       bn_pack4(0xE3FD,0xB8BE,0xFC84,0x8AD9),
+       bn_pack4(0x238F,0x16CB,0xE39D,0x652D),
+       bn_pack4(0x3423,0xB474,0x2BF1,0xC978),
+       bn_pack4(0x3AAB,0x639C,0x5AE4,0xF568),
+       bn_pack4(0x2576,0xF693,0x6BA4,0x2466),
+       bn_pack4(0x741F,0xA7BF,0x8AFC,0x47ED),
+       bn_pack4(0x3BC8,0x32B6,0x8D9D,0xD300),
+       bn_pack4(0xD8BE,0xC4D0,0x73B9,0x31BA),
+       bn_pack4(0x3877,0x7CB6,0xA932,0xDF8C),
+       bn_pack4(0x74A3,0x926F,0x12FE,0xE5E4),
+       bn_pack4(0xE694,0xF91E,0x6DBE,0x1159),
+       bn_pack4(0x12BF,0x2D5B,0x0B74,0x74D6),
+       bn_pack4(0x043E,0x8F66,0x3F48,0x60EE),
+       bn_pack4(0x387F,0xE8D7,0x6E3C,0x0468),
+       bn_pack4(0xDA56,0xC9EC,0x2EF2,0x9632),
+       bn_pack4(0xEB19,0xCCB1,0xA313,0xD55C),
+       bn_pack4(0xF550,0xAA3D,0x8A1F,0xBFF0),
+       bn_pack4(0x06A1,0xD58B,0xB7C5,0xDA76),
+       bn_pack4(0xA797,0x15EE,0xF29B,0xE328),
+       bn_pack4(0x14CC,0x5ED2,0x0F80,0x37E0),
+       bn_pack4(0xCC8F,0x6D7E,0xBF48,0xE1D8),
+       bn_pack4(0x4BD4,0x07B2,0x2B41,0x54AA),
+       bn_pack4(0x0F1D,0x45B7,0xFF58,0x5AC5),
+       bn_pack4(0x23A9,0x7A7E,0x36CC,0x88BE),
+       bn_pack4(0x59E7,0xC97F,0xBEC7,0xE8F3),
+       bn_pack4(0xB5A8,0x4031,0x900B,0x1C9E),
+       bn_pack4(0xD55E,0x702F,0x4698,0x0C82),
+       bn_pack4(0xF482,0xD7CE,0x6E74,0xFEF6),
+       bn_pack4(0xF032,0xEA15,0xD172,0x1D03),
+       bn_pack4(0x5983,0xCA01,0xC64B,0x92EC),
+       bn_pack4(0x6FB8,0xF401,0x378C,0xD2BF),
+       bn_pack4(0x3320,0x5151,0x2BD7,0xAF42),
+       bn_pack4(0xDB7F,0x1447,0xE6CC,0x254B),
+       bn_pack4(0x44CE,0x6CBA,0xCED4,0xBB1B),
+       bn_pack4(0xDA3E,0xDBEB,0xCF9B,0x14ED),
+       bn_pack4(0x1797,0x27B0,0x865A,0x8918),
+       bn_pack4(0xB06A,0x53ED,0x9027,0xD831),
+       bn_pack4(0xE5DB,0x382F,0x4130,0x01AE),
+       bn_pack4(0xF8FF,0x9406,0xAD9E,0x530E),
+       bn_pack4(0xC975,0x1E76,0x3DBA,0x37BD),
+       bn_pack4(0xC1D4,0xDCB2,0x6026,0x46DE),
+       bn_pack4(0x36C3,0xFAB4,0xD27C,0x7026),
+       bn_pack4(0x4DF4,0x35C9,0x3402,0x8492),
+       bn_pack4(0x86FF,0xB7DC,0x90A6,0xC08F),
+       bn_pack4(0x93B4,0xEA98,0x8D8F,0xDDC1),
+       bn_pack4(0xD006,0x9127,0xD5B0,0x5AA9),
+       bn_pack4(0xB81B,0xDD76,0x2170,0x481C),
+       bn_pack4(0x1F61,0x2970,0xCEE2,0xD7AF),
+       bn_pack4(0x233B,0xA186,0x515B,0xE7ED),
+       bn_pack4(0x99B2,0x964F,0xA090,0xC3A2),
+       bn_pack4(0x287C,0x5947,0x4E6B,0xC05D),
+       bn_pack4(0x2E8E,0xFC14,0x1FBE,0xCAA6),
+       bn_pack4(0xDBBB,0xC2DB,0x04DE,0x8EF9),
+       bn_pack4(0x2583,0xE9CA,0x2AD4,0x4CE8),
+       bn_pack4(0x1A94,0x6834,0xB615,0x0BDA),
+       bn_pack4(0x99C3,0x2718,0x6AF4,0xE23C),
+       bn_pack4(0x8871,0x9A10,0xBDBA,0x5B26),
+       bn_pack4(0x1A72,0x3C12,0xA787,0xE6D7),
+       bn_pack4(0x4B82,0xD120,0xA921,0x0801),
+       bn_pack4(0x43DB,0x5BFC,0xE0FD,0x108E),
+       bn_pack4(0x08E2,0x4FA0,0x74E5,0xAB31),
+       bn_pack4(0x7709,0x88C0,0xBAD9,0x46E2),
+       bn_pack4(0xBBE1,0x1757,0x7A61,0x5D6C),
+       bn_pack4(0x521F,0x2B18,0x177B,0x200C),
+       bn_pack4(0xD876,0x0273,0x3EC8,0x6A64),
+       bn_pack4(0xF12F,0xFA06,0xD98A,0x0864),
+       bn_pack4(0xCEE3,0xD226,0x1AD2,0xEE6B),
+       bn_pack4(0x1E8C,0x94E0,0x4A25,0x619D),
+       bn_pack4(0xABF5,0xAE8C,0xDB09,0x33D7),
+       bn_pack4(0xB397,0x0F85,0xA6E1,0xE4C7),
+       bn_pack4(0x8AEA,0x7157,0x5D06,0x0C7D),
+       bn_pack4(0xECFB,0x8504,0x58DB,0xEF0A),
+       bn_pack4(0xA855,0x21AB,0xDF1C,0xBA64),
+       bn_pack4(0xAD33,0x170D,0x0450,0x7A33),
+       bn_pack4(0x1572,0x8E5A,0x8AAA,0xC42D),
+       bn_pack4(0x15D2,0x2618,0x98FA,0x0510),
+       bn_pack4(0x3995,0x497C,0xEA95,0x6AE5),
+       bn_pack4(0xDE2B,0xCBF6,0x9558,0x1718),
+       bn_pack4(0xB5C5,0x5DF0,0x6F4C,0x52C9),
+       bn_pack4(0x9B27,0x83A2,0xEC07,0xA28F),
+       bn_pack4(0xE39E,0x772C,0x180E,0x8603),
+       bn_pack4(0x3290,0x5E46,0x2E36,0xCE3B),
+       bn_pack4(0xF174,0x6C08,0xCA18,0x217C),
+       bn_pack4(0x670C,0x354E,0x4ABC,0x9804),
+       bn_pack4(0x9ED5,0x2907,0x7096,0x966D),
+       bn_pack4(0x1C62,0xF356,0x2085,0x52BB),
+       bn_pack4(0x8365,0x5D23,0xDCA3,0xAD96),
+       bn_pack4(0x6916,0x3FA8,0xFD24,0xCF5F),
+       bn_pack4(0x98DA,0x4836,0x1C55,0xD39A),
+       bn_pack4(0xC200,0x7CB8,0xA163,0xBF05),
+       bn_pack4(0x4928,0x6651,0xECE4,0x5B3D),
+       bn_pack4(0xAE9F,0x2411,0x7C4B,0x1FE6),
+       bn_pack4(0xEE38,0x6BFB,0x5A89,0x9FA5),
+       bn_pack4(0x0BFF,0x5CB6,0xF406,0xB7ED),
+       bn_pack4(0xF44C,0x42E9,0xA637,0xED6B),
+       bn_pack4(0xE485,0xB576,0x625E,0x7EC6),
+       bn_pack4(0x4FE1,0x356D,0x6D51,0xC245),
+       bn_pack4(0x302B,0x0A6D,0xF25F,0x1437),
+       bn_pack4(0xEF95,0x19B3,0xCD3A,0x431B),
+       bn_pack4(0x514A,0x0879,0x8E34,0x04DD),
+       bn_pack4(0x020B,0xBEA6,0x3B13,0x9B22),
+       bn_pack4(0x2902,0x4E08,0x8A67,0xCC74),
+       bn_pack4(0xC4C6,0x628B,0x80DC,0x1CD1),
+       bn_pack4(0xC90F,0xDAA2,0x2168,0xC234),
+       bn_pack4(0xFFFF,0xFFFF,0xFFFF,0xFFFF)
 };
 static BIGNUM bn_group_8192 = {
        bn_group_8192_value,
index 92cea98..7c1dcc5 100644 (file)
 #include <openssl/evp.h>
 
 #if (BN_BYTES == 8)
-#define bn_pack4(a1,a2,a3,a4) 0x##a1##a2##a3##a4##ul
-#endif
-#if (BN_BYTES == 4)
-#define bn_pack4(a1,a2,a3,a4)  0x##a3##a4##ul, 0x##a1##a2##ul
-#endif
-#if (BN_BYTES == 2)
-#define bn_pack4(a1,a2,a3,a4) 0x##a4##u,0x##a3##u,0x##a2##u,0x##a1##u
+# if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
+#  define bn_pack4(a1,a2,a3,a4) ((a1##UI64<<48)|(a2##UI64<<32)|(a3##UI64<<16)|a4##UI64)
+# elif defined(__arch64__)
+#  define bn_pack4(a1,a2,a3,a4) ((a1##UL<<48)|(a2##UL<<32)|(a3##UL<<16)|a4##UL)
+# else
+#  define bn_pack4(a1,a2,a3,a4) ((a1##ULL<<48)|(a2##ULL<<32)|(a3##ULL<<16)|a4##ULL)
+# endif
+#elif (BN_BYTES == 4)
+# define bn_pack4(a1,a2,a3,a4)  ((a3##UL<<16)|a4##UL), ((a1##UL<<16)|a2##UL)
+#else
+# error "unsupported BN_BYTES"
 #endif
 
 
index 07a412f..bd2f000 100644 (file)
 #define SSL_CTX_set_next_protos_advertised_cb  SSL_CTX_set_next_protos_adv_cb
 #undef SSL_CTX_set_next_proto_select_cb
 #define SSL_CTX_set_next_proto_select_cb       SSL_CTX_set_next_proto_sel_cb
+#undef ssl3_cbc_record_digest_supported
+#define ssl3_cbc_record_digest_supported        ssl3_cbc_record_digest_support
+#undef ssl_check_clienthello_tlsext_late
+#define ssl_check_clienthello_tlsext_late       ssl_check_clihello_tlsext_late
+#undef ssl_check_clienthello_tlsext_early
+#define ssl_check_clienthello_tlsext_early      ssl_check_clihello_tlsext_early
 
 /* Hack some long ENGINE names */
 #undef ENGINE_get_default_BN_mod_exp_crt
index 27ca515..c6602da 100644 (file)
@@ -218,7 +218,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
 
        s=dir;
        p=s;
-       for (;;p++)
+       do
                {
                if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0'))
                        {
@@ -264,9 +264,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
                                return 0;
                                }
                        }
-               if (*p == '\0')
-                       break;
-               }
+               } while (*p++ != '\0');
        return 1;
        }
 
index 12d71f5..920066a 100644 (file)
@@ -694,6 +694,7 @@ static int check_cert(X509_STORE_CTX *ctx)
        X509_CRL *crl = NULL, *dcrl = NULL;
        X509 *x;
        int ok, cnum;
+       unsigned int last_reasons;
        cnum = ctx->error_depth;
        x = sk_X509_value(ctx->chain, cnum);
        ctx->current_cert = x;
@@ -702,6 +703,7 @@ static int check_cert(X509_STORE_CTX *ctx)
        ctx->current_reasons = 0;
        while (ctx->current_reasons != CRLDP_ALL_REASONS)
                {
+               last_reasons = ctx->current_reasons;
                /* Try to retrieve relevant CRL */
                if (ctx->get_crl)
                        ok = ctx->get_crl(ctx, &crl, x);
@@ -745,6 +747,15 @@ static int check_cert(X509_STORE_CTX *ctx)
                X509_CRL_free(dcrl);
                crl = NULL;
                dcrl = NULL;
+               /* If reasons not updated we wont get anywhere by
+                * another iteration, so exit loop.
+                */
+               if (last_reasons == ctx->current_reasons)
+                       {
+                       ctx->error = X509_V_ERR_UNABLE_TO_GET_CRL;
+                       ok = ctx->verify_cb(0, ctx);
+                       goto err;
+                       }
                }
        err:
        X509_CRL_free(crl);
@@ -1451,10 +1462,9 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
         * a certificate was revoked. This has since been changed since 
         * critical extension can change the meaning of CRL entries.
         */
-       if (crl->flags & EXFLAG_CRITICAL)
+       if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
+               && (crl->flags & EXFLAG_CRITICAL))
                {
-               if (ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
-                       return 1;
                ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION;
                ok = ctx->verify_cb(0, ctx);
                if(!ok)
index b94aeeb..e06602d 100644 (file)
@@ -97,6 +97,7 @@ int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
 
 int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
        {
+       x->cert_info->enc.modified = 1;
        return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
                x->cert_info->signature,
                x->sig_alg, x->signature, x->cert_info, ctx);
@@ -123,6 +124,7 @@ int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
 
 int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx)
        {
+       x->crl->enc.modified = 1;
        return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CRL_INFO),
                x->crl->sig_alg, x->sig_alg, x->signature, x->crl, ctx);
        }
index c18b0e2..b270b44 100644 (file)
@@ -67,6 +67,7 @@ for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
        &inc    ("esi");                # number of cores
 
        &mov    ("eax",1);
+       &xor    ("ecx","ecx");
        &cpuid  ();
        &bt     ("edx",28);
        &jnc    (&label("generic"));
@@ -91,6 +92,7 @@ for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
 
 &set_label("nocacheinfo");
        &mov    ("eax",1);
+       &xor    ("ecx","ecx");
        &cpuid  ();
        &and    ("edx",0xbfefffff);     # force reserved bits #20, #30 to 0
        &cmp    ("ebp",0);
index ace34b6..25c5381 100644 (file)
@@ -119,7 +119,7 @@ variable points to a section containing further ENGINE configuration
 information.
 
 The section pointed to by B<engines> is a table of engine names (though see
-B<engine_id> below) and further sections containing configuration informations
+B<engine_id> below) and further sections containing configuration information
 specific to each ENGINE.
 
 Each ENGINE specific section is used to set default algorithms, load
index a40c873..1ad76a5 100644 (file)
@@ -62,6 +62,11 @@ don't output the encoded version of the CRL.
 output a hash of the issuer name. This can be use to lookup CRLs in
 a directory by issuer name.
 
+=item B<-hash_old>
+
+outputs the "hash" of the CRL issuer name using the older algorithm
+as used by OpenSSL versions before 1.0.0.
+
 =item B<-issuer>
 
 output the issuer name.
index ba6dc46..5c7b45d 100644 (file)
@@ -41,7 +41,7 @@ PKCS#8 private key format use the B<pkcs8> command.
 
 This specifies the input format. The B<DER> option with a private key uses
 an ASN.1 DER encoded SEC1 private key. When used with a public key it
-uses the SubjectPublicKeyInfo structur as specified in RFC 3280.
+uses the SubjectPublicKeyInfo structure as specified in RFC 3280.
 The B<PEM> form is the default format: it consists of the B<DER> format base64
 encoded with additional header and footer lines. In the case of a private key
 PKCS#8 format is also accepted.
index f69a5c5..8e0d917 100644 (file)
@@ -67,7 +67,7 @@ by default.
 The filename to write certificates and private keys to, standard output by
 default.  They are all written in PEM format.
 
-=item B<-pass arg>, B<-passin arg>
+=item B<-passin arg>
 
 the PKCS#12 file (i.e. input file) password source. For more information about
 the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section in
@@ -75,10 +75,15 @@ L<openssl(1)|openssl(1)>.
 
 =item B<-passout arg>
 
-pass phrase source to encrypt any outputed private keys with. For more
+pass phrase source to encrypt any outputted private keys with. For more
 information about the format of B<arg> see the B<PASS PHRASE ARGUMENTS> section
 in L<openssl(1)|openssl(1)>.
 
+=item B<-password arg>
+
+With -export, -password is equivalent to -passout.
+Otherwise, -password is equivalent to -passin.
+
 =item B<-noout>
 
 this option inhibits output of the keys and certificates to the output file
index ff48bbd..0730d11 100644 (file)
@@ -303,7 +303,7 @@ Reverses effect of B<-asn1-kludge>
 
 =item B<-newhdr>
 
-Adds the word B<NEW> to the PEM file header and footer lines on the outputed
+Adds the word B<NEW> to the PEM file header and footer lines on the outputted
 request. Some software (Netscape certificate server) and some CAs need this.
 
 =item B<-batch>
index 69b2bef..d7d784d 100644 (file)
@@ -24,6 +24,8 @@ B<openssl> B<rsa>
 [B<-check>]
 [B<-pubin>]
 [B<-pubout>]
+[B<-RSAPublicKey_in>]
+[B<-RSAPublicKey_out>]
 [B<-engine id>]
 
 =head1 DESCRIPTION
@@ -118,6 +120,10 @@ by default a private key is output: with this option a public
 key will be output instead. This option is automatically set if
 the input is a public key.
 
+=item B<-RSAPublicKey_in>, B<-RSAPublicKey_out>
+
+like B<-pubin> and B<-pubout> except B<RSAPublicKey> format is used instead.
+
 =item B<-engine id>
 
 specifying an engine (by its unique B<id> string) will cause B<rsa>
@@ -139,6 +145,11 @@ The PEM public key format uses the header and footer lines:
  -----BEGIN PUBLIC KEY-----
  -----END PUBLIC KEY-----
 
+The PEM B<RSAPublicKey> format uses the header and footer lines:
+
+ -----BEGIN RSA PUBLIC KEY-----
+ -----END RSA PUBLIC KEY-----
+
 The B<NET> form is a format compatible with older Netscape servers
 and Microsoft IIS .key files, this uses unsalted RC4 for its encryption.
 It is not very secure and so should only be used when necessary.
@@ -173,6 +184,10 @@ To just output the public part of a private key:
 
  openssl rsa -in key.pem -pubout -out pubkey.pem
 
+Output the public part of a private key in B<RSAPublicKey> format:
+
+ openssl rsa -in key.pem -RSAPublicKey_out -out pubkey.pem
+
 =head1 BUGS
 
 The command line password arguments don't currently work with
index 4ebf7b5..3215b2e 100644 (file)
@@ -10,6 +10,7 @@ s_client - SSL/TLS client program
 B<openssl> B<s_client>
 [B<-connect host:port>]
 [B<-verify depth>]
+[B<-verify_return_error>]
 [B<-cert filename>]
 [B<-certform DER|PEM>]
 [B<-key filename>]
@@ -90,6 +91,11 @@ Currently the verify operation continues after errors so all the problems
 with a certificate chain can be seen. As a side effect the connection
 will never fail due to a server certificate verify failure.
 
+=item B<-verify_return_error>
+
+Return verification errors instead of continuing. This will typically
+abort the handshake with a fatal error.
+
 =item B<-CApath directory>
 
 The directory to use for server certificate verification. This directory
@@ -286,6 +292,13 @@ Since the SSLv23 client hello cannot include compression methods or extensions
 these will only be supported if its use is disabled, for example by using the
 B<-no_sslv2> option.
 
+The B<s_client> utility is a test tool and is designed to continue the
+handshake after any certificate verification errors. As a result it will
+accept any certificate chain (trusted or not) sent by the peer. None test
+applications should B<not> do this as it makes them vulnerable to a MITM
+attack. This behaviour can be changed by with the B<-verify_return_error>
+option: any verify errors are then returned aborting the handshake.
+
 =head1 BUGS
 
 Because this program has a lot of options and also because some of
@@ -293,9 +306,6 @@ the techniques used are rather old, the C source of s_client is rather
 hard to read and not a model of how things should be done. A typical
 SSL client program would be much simpler.
 
-The B<-verify> option should really exit if the server verification
-fails.
-
 The B<-prexit> option is a bit of a hack. We should really report
 information whenever a session is renegotiated.
 
index 3e503e1..6758ba3 100644 (file)
@@ -111,7 +111,7 @@ by using an appropriate certificate.
 
 =item B<-dcertform format>, B<-dkeyform format>, B<-dpass arg>
 
-addtional certificate and private key format and passphrase respectively.
+additional certificate and private key format and passphrase respectively.
 
 =item B<-nocert>
 
index 7fb6caa..d6aa47d 100644 (file)
@@ -352,7 +352,7 @@ switch always overrides the settings in the config file.
 
 This is the main section and it specifies the name of another section
 that contains all the options for the B<-reply> command. This default
-section can be overriden with the B<-section> command line switch. (Optional)
+section can be overridden with the B<-section> command line switch. (Optional)
 
 =item B<oid_file>
 
@@ -453,7 +453,7 @@ included. Default is no. (Optional)
 =head1 ENVIRONMENT VARIABLES
 
 B<OPENSSL_CONF> contains the path of the configuration file and can be
-overriden by the B<-config> command line option.
+overridden by the B<-config> command line option.
 
 =head1 EXAMPLES
 
index b05957b..56db985 100644 (file)
@@ -124,7 +124,7 @@ The name of an EGD socket to get random data from. (Optional)
 =item [request]...
 
 List of files containing B<RFC 3161> DER-encoded time stamp requests. If no
-requests are specifed only one request will be sent to the server and it will be
+requests are specified only one request will be sent to the server and it will be
 read from the standard input. (Optional)
 
 =back
index 5f51fdb..da06e44 100644 (file)
@@ -48,7 +48,7 @@ necessary parameters are set, by re-creating the blinding parameters.
 
 BN_BLINDING_convert_ex() multiplies B<n> with the blinding factor B<A>.
 If B<r> is not NULL a copy the inverse blinding factor B<Ai> will be
-returned in B<r> (this is useful if a B<RSA> object is shared amoung
+returned in B<r> (this is useful if a B<RSA> object is shared among
 several threads). BN_BLINDING_invert_ex() multiplies B<n> with the
 inverse blinding factor B<Ai>. If B<r> is not NULL it will be used as
 the inverse blinding.
index 3444304..828ecf5 100644 (file)
@@ -52,8 +52,11 @@ ERR_get_error_line_data(), ERR_peek_error_line_data() and
 ERR_get_last_error_line_data() store additional data and flags
 associated with the error code in *B<data>
 and *B<flags>, unless these are B<NULL>. *B<data> contains a string
-if *B<flags>&B<ERR_TXT_STRING>. If it has been allocated by OPENSSL_malloc(),
-*B<flags>&B<ERR_TXT_MALLOCED> is true.
+if *B<flags>&B<ERR_TXT_STRING> is true. 
+
+An application B<MUST NOT> free the *B<data> pointer (or any other pointers
+returned by these functions) with OPENSSL_free() as freeing is handled
+automatically by the error library.
 
 =head1 RETURN VALUES
 
index d375c46..0ea7d55 100644 (file)
@@ -17,7 +17,7 @@ EVP_BytesToKey - password based encryption routine
 
 EVP_BytesToKey() derives a key and IV from various parameters. B<type> is
 the cipher to derive the key and IV for. B<md> is the message digest to use.
-The B<salt> paramter is used as a salt in the derivation: it should point to
+The B<salt> parameter is used as a salt in the derivation: it should point to
 an 8 byte buffer or NULL if no salt is used. B<data> is a buffer containing
 B<datal> bytes which is used to derive the keying data. B<count> is the
 iteration count to use. The derived key and IV will be written to B<key>
index 8271d3d..1c4bf18 100644 (file)
@@ -152,7 +152,7 @@ does not remain in memory.
 
 EVP_EncryptInit(), EVP_DecryptInit() and EVP_CipherInit() behave in a
 similar way to EVP_EncryptInit_ex(), EVP_DecryptInit_ex and
-EVP_CipherInit_ex() except the B<ctx> paramter does not need to be
+EVP_CipherInit_ex() except the B<ctx> parameter does not need to be
 initialized and they always use the default cipher implementation.
 
 EVP_EncryptFinal(), EVP_DecryptFinal() and EVP_CipherFinal() behave in a
index a883f6c..60e8332 100644 (file)
@@ -278,6 +278,8 @@ happen if extended CRL checking is enabled.
 an application specific error. This will never be returned unless explicitly
 set by an application.
 
+=back
+
 =head1 NOTES
 
 The above functions should be used instead of directly referencing the fields
index b68eece..46cac2b 100644 (file)
@@ -113,7 +113,7 @@ a special status code is set to the verification callback. This permits it
 to examine the valid policy tree and perform additional checks or simply
 log it for debugging purposes.
 
-By default some addtional features such as indirect CRLs and CRLs signed by
+By default some additional features such as indirect CRLs and CRLs signed by
 different keys are disabled. If B<X509_V_FLAG_EXTENDED_CRL_SUPPORT> is set
 they are enabled.
 
index 20edff9..59a5916 100644 (file)
@@ -95,7 +95,7 @@ is ignored.
 
 ECDSA_verify() verifies that the signature in B<sig> of size
 B<siglen> is a valid ECDSA signature of the hash value
-value B<dgst> of size B<dgstlen> using the public key B<eckey>.
+B<dgst> of size B<dgstlen> using the public key B<eckey>.
 The parameter B<type> is ignored.
 
 ECDSA_do_sign() is wrapper function for ECDSA_do_sign_ex with B<kinv>
@@ -131,16 +131,12 @@ specific)
 
  int        ret;
  ECDSA_SIG *sig;
- EC_KEY    *eckey = EC_KEY_new();
+ EC_KEY    *eckey;
+ eckey = EC_KEY_new_by_curve_name(NID_secp192k1);
  if (eckey == NULL)
        {
        /* error */
        }
- key->group = EC_GROUP_new_by_nid(NID_secp192k1);
- if (key->group == NULL)
-       {
-       /* error */
-       }
  if (!EC_KEY_generate_key(eckey))
        {
        /* error */
index d5b1896..54414a3 100644 (file)
@@ -201,7 +201,7 @@ handle PKCS#8 format encrypted and unencrypted keys too.
 PEM_write_bio_PKCS8PrivateKey() and PEM_write_PKCS8PrivateKey()
 write a private key in an EVP_PKEY structure in PKCS#8
 EncryptedPrivateKeyInfo format using PKCS#5 v2.0 password based encryption
-algorithms. The B<cipher> argument specifies the encryption algoritm to
+algorithms. The B<cipher> argument specifies the encryption algorithm to
 use: unlike all other PEM routines the encryption is applied at the
 PKCS#8 level and not in the PEM headers. If B<cipher> is NULL then no
 encryption is used and a PKCS#8 PrivateKeyInfo structure is used instead.
index 632b556..5e66133 100644 (file)
@@ -66,16 +66,16 @@ values:
 
 =over 4
 
-=item 1
-
-The operation succeeded.
-
 =item 0
 
 A failure while manipulating the STACK_OF(X509_NAME) object occurred or
 the X509_NAME could not be extracted from B<cacert>. Check the error stack
 to find out the reason.
 
+=item 1
+
+The operation succeeded.
+
 =back
 
 =head1 EXAMPLES
index cc588f3..fded060 100644 (file)
@@ -88,9 +88,10 @@ As of OpenSSL 0.9.8q and 1.0.0c, this option has no effect.
 
 ...
 
-=item SSL_OP_MSIE_SSLV2_RSA_PADDING
+=item SSL_OP_SAFARI_ECDHE_ECDSA_BUG
 
-As of OpenSSL 0.9.7h and 0.9.8a, this option has no effect.
+Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.
+OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
 
 =item SSL_OP_SSLEAY_080_CLIENT_DH_BUG
 
index 8156683..6fd6c03 100644 (file)
@@ -169,8 +169,8 @@ that will always continue the TLS/SSL handshake regardless of verification
 failure, if wished. The callback realizes a verification depth limit with
 more informational output.
 
-All verification errors are printed, informations about the certificate chain
-are printed on request.
+All verification errors are printed; information about the certificate chain
+is printed on request.
 The example is realized for a server that does allow but not require client
 certificates.
 
index b80e25b..7e60df5 100644 (file)
@@ -81,6 +81,8 @@ SSL_CTX_use_psk_identity_hint() and SSL_use_psk_identity_hint() return
 
 Return values from the server callback are interpreted as follows:
 
+=over 4
+
 =item > 0
 
 PSK identity was found and the server callback has provided the PSK
@@ -99,4 +101,6 @@ completely.
 PSK identity was not found. An "unknown_psk_identity" alert message
 will be sent and the connection setup fails.
 
+=back
+
 =cut
index cc724c0..b1c34d1 100644 (file)
@@ -44,17 +44,17 @@ The following return values can occur:
 
 =over 4
 
-=item 1
-
-The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
-established.
-
 =item 0
 
 The TLS/SSL handshake was not successful but was shut down controlled and
 by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
 return value B<ret> to find out the reason.
 
+=item 1
+
+The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+established.
+
 =item E<lt>0
 
 The TLS/SSL handshake was not successful because a fatal error occurred either
index cc56ebb..946ca89 100644 (file)
@@ -41,17 +41,17 @@ The following return values can occur:
 
 =over 4
 
-=item 1
-
-The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
-established.
-
 =item 0
 
 The TLS/SSL handshake was not successful but was shut down controlled and
 by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
 return value B<ret> to find out the reason.
 
+=item 1
+
+The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+established.
+
 =item E<lt>0
 
 The TLS/SSL handshake was not successful, because a fatal error occurred either
index 2435764..7f8cf24 100644 (file)
@@ -45,17 +45,17 @@ The following return values can occur:
 
 =over 4
 
-=item 1
-
-The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
-established.
-
 =item 0
 
 The TLS/SSL handshake was not successful but was shut down controlled and
 by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
 return value B<ret> to find out the reason.
 
+=item 1
+
+The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
+established.
+
 =item E<lt>0
 
 The TLS/SSL handshake was not successful because a fatal error occurred either
index 011a022..fe01308 100644 (file)
@@ -24,7 +24,7 @@ The shutdown state of an ssl connection is a bitmask of:
 
 =over 4
 
-=item 0
+=item Z<>0
 
 No shutdown setting, yet.
 
index 89911ac..42a89b7 100644 (file)
@@ -92,11 +92,6 @@ The following return values can occur:
 
 =over 4
 
-=item 1
-
-The shutdown was successfully completed. The "close notify" alert was sent
-and the peer's "close notify" alert was received.
-
 =item 0
 
 The shutdown is not yet finished. Call SSL_shutdown() for a second time,
@@ -104,6 +99,11 @@ if a bidirectional shutdown shall be performed.
 The output of L<SSL_get_error(3)|SSL_get_error(3)> may be misleading, as an
 erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred.
 
+=item 1
+
+The shutdown was successfully completed. The "close notify" alert was sent
+and the peer's "close notify" alert was received.
+
 =item -1
 
 The shutdown was not successful because a fatal error occurred either
index 79c1392..6a0aad1 100644 (file)
@@ -368,6 +368,13 @@ static unsigned int _strlen31(const char *str)
 #    define DEFAULT_HOME  "C:"
 #  endif
 
+/* Avoid Windows 8 SDK GetVersion deprecated problems */
+#if defined(_MSC_VER) && _MSC_VER>=1800
+#  define check_winnt() (1)
+#else
+#  define check_winnt() (GetVersion() < 0x80000000)
+#endif 
+
 #else /* The non-microsoft world */
 
 #  ifdef OPENSSL_SYS_VMS
index 2157852..8da2407 100644 (file)
@@ -87,10 +87,6 @@ extern gost_subst_block Gost28147_CryptoProParamSetB;
 extern gost_subst_block Gost28147_CryptoProParamSetC;
 extern gost_subst_block Gost28147_CryptoProParamSetD;
 extern const byte CryptoProKeyMeshingKey[]; 
-#if __LONG_MAX__ > 2147483647L 
 typedef unsigned int word32; 
-#else 
-typedef unsigned long word32; 
-#endif 
 
 #endif
index 8c278aa..91b2ce8 100644 (file)
@@ -180,8 +180,6 @@ int start_hash(gost_hash_ctx *ctx)
  */
 int hash_block(gost_hash_ctx *ctx,const byte *block, size_t length)
        {
-       const byte *curptr=block;
-       const byte *barrier=block+(length-32);/* Last byte we can safely hash*/
        if (ctx->left)
                {
                /*There are some bytes from previous step*/
@@ -196,24 +194,25 @@ int hash_block(gost_hash_ctx *ctx,const byte *block, size_t length)
                        {
                        return 1;
                        }       
-               curptr=block+add_bytes;
+               block+=add_bytes;
+               length-=add_bytes;
                hash_step(ctx->cipher_ctx,ctx->H,ctx->remainder);
                add_blocks(32,ctx->S,ctx->remainder);
                ctx->len+=32;
                ctx->left=0;
                }
-       while (curptr<=barrier)
+       while (length>=32)
                {       
-               hash_step(ctx->cipher_ctx,ctx->H,curptr);
+               hash_step(ctx->cipher_ctx,ctx->H,block);
                        
-               add_blocks(32,ctx->S,curptr);
+               add_blocks(32,ctx->S,block);
                ctx->len+=32;
-               curptr+=32;
+               block+=32;
+               length-=32;
                }       
-       if (curptr!=block+length)
+       if (length)
                {
-               ctx->left=block+length-curptr;
-               memcpy(ctx->remainder,curptr,ctx->left);
+               memcpy(ctx->remainder,block,ctx->left=length);
                }       
        return 1;       
        }
index de8bab8..2e8cf68 100644 (file)
@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 static void
 dtls1_hm_fragment_free(hm_fragment *frag)
        {
+
+       if (frag->msg_header.is_ccs)
+               {
+               EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx);
+               EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash);
+               }
        if (frag->fragment) OPENSSL_free(frag->fragment);
        if (frag->reassembly) OPENSSL_free(frag->reassembly);
        OPENSSL_free(frag);
@@ -313,9 +319,10 @@ int dtls1_do_write(SSL *s, int type)
                                s->init_off -= DTLS1_HM_HEADER_LENGTH;
                                s->init_num += DTLS1_HM_HEADER_LENGTH;
 
-                               /* write atleast DTLS1_HM_HEADER_LENGTH bytes */
-                               if ( len <= DTLS1_HM_HEADER_LENGTH)  
-                                       len += DTLS1_HM_HEADER_LENGTH;
+                               if ( s->init_num > curr_mtu)
+                                       len = curr_mtu;
+                               else
+                                       len = s->init_num;
                                }
 
                        dtls1_fix_message_header(s, frag_off, 
@@ -1452,26 +1459,36 @@ dtls1_process_heartbeat(SSL *s)
        unsigned int payload;
        unsigned int padding = 16; /* Use minimum padding */
 
-       /* Read type and payload length first */
-       hbtype = *p++;
-       n2s(p, payload);
-       pl = p;
-
        if (s->msg_callback)
                s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                        &s->s3->rrec.data[0], s->s3->rrec.length,
                        s, s->msg_callback_arg);
 
+       /* Read type and payload length first */
+       if (1 + 2 + 16 > s->s3->rrec.length)
+               return 0; /* silently discard */
+       hbtype = *p++;
+       n2s(p, payload);
+       if (1 + 2 + payload + 16 > s->s3->rrec.length)
+               return 0; /* silently discard per RFC 6520 sec. 4 */
+       pl = p;
+
        if (hbtype == TLS1_HB_REQUEST)
                {
                unsigned char *buffer, *bp;
+               unsigned int write_length = 1 /* heartbeat type */ +
+                                           2 /* heartbeat length */ +
+                                           payload + padding;
                int r;
 
+               if (write_length > SSL3_RT_MAX_PLAIN_LENGTH)
+                       return 0;
+
                /* Allocate memory for the response, size is 1 byte
                 * message type, plus 2 bytes payload length, plus
                 * payload, plus padding
                 */
-               buffer = OPENSSL_malloc(1 + 2 + payload + padding);
+               buffer = OPENSSL_malloc(write_length);
                bp = buffer;
 
                /* Enter response type, length and copy payload */
@@ -1482,11 +1499,11 @@ dtls1_process_heartbeat(SSL *s)
                /* Random padding */
                RAND_pseudo_bytes(bp, padding);
 
-               r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
+               r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, write_length);
 
                if (r >= 0 && s->msg_callback)
                        s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
-                               buffer, 3 + payload + padding,
+                               buffer, write_length,
                                s, s->msg_callback_arg);
 
                OPENSSL_free(buffer);
index a6ed09c..48e5e06 100644 (file)
@@ -538,13 +538,6 @@ int dtls1_connect(SSL *s)
                                SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
                        if (ret <= 0) goto end;
 
-#ifndef OPENSSL_NO_SCTP
-                       /* Change to new shared key of SCTP-Auth,
-                        * will be ignored if no SCTP used.
-                        */
-                       BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
-#endif
-
                        s->state=SSL3_ST_CW_FINISHED_A;
                        s->init_num=0;
 
@@ -571,6 +564,16 @@ int dtls1_connect(SSL *s)
                                goto end;
                                }
                        
+#ifndef OPENSSL_NO_SCTP
+                               if (s->hit)
+                                       {
+                                       /* Change to new shared key of SCTP-Auth,
+                                        * will be ignored if no SCTP used.
+                                        */
+                                       BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                                       }
+#endif
+
                        dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
                        break;
 
@@ -613,6 +616,13 @@ int dtls1_connect(SSL *s)
                                }
                        else
                                {
+#ifndef OPENSSL_NO_SCTP
+                               /* Change to new shared key of SCTP-Auth,
+                                * will be ignored if no SCTP used.
+                                */
+                               BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+#endif
+
 #ifndef OPENSSL_NO_TLSEXT
                                /* Allow NewSessionTicket if ticket expected */
                                if (s->tlsext_ticket_expected)
@@ -773,7 +783,7 @@ int dtls1_client_hello(SSL *s)
        unsigned char *buf;
        unsigned char *p,*d;
        unsigned int i,j;
-       unsigned long Time,l;
+       unsigned long l;
        SSL_COMP *comp;
 
        buf=(unsigned char *)s->init_buf->data;
@@ -798,13 +808,11 @@ int dtls1_client_hello(SSL *s)
 
                /* if client_random is initialized, reuse it, we are
                 * required to use same upon reply to HelloVerify */
-               for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++) ;
+               for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++)
+                       ;
                if (i==sizeof(s->s3->client_random))
-                       {
-                       Time=(unsigned long)time(NULL); /* Time */
-                       l2n(Time,p);
-                       RAND_pseudo_bytes(p,sizeof(s->s3->client_random)-4);
-                       }
+                       ssl_fill_hello_random(s, 0, p,
+                                             sizeof(s->s3->client_random));
 
                /* Do the message type and length last */
                d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
index f61f718..106939f 100644 (file)
@@ -196,6 +196,7 @@ void dtls1_free(SSL *s)
        pqueue_free(s->d1->buffered_app_data.q);
 
        OPENSSL_free(s->d1);
+       s->d1 = NULL;
        }
 
 void dtls1_clear(SSL *s)
index 0bf87be..8186462 100644 (file)
@@ -847,6 +847,12 @@ start:
                        }
                }
 
+       if (s->d1->listen && rr->type != SSL3_RT_HANDSHAKE)
+               {
+               rr->length = 0;
+               goto start;
+               }
+
        /* we now have a packet which can be read and processed */
 
        if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
@@ -1051,6 +1057,7 @@ start:
                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
                        !s->s3->renegotiate)
                        {
+                       s->d1->handshake_read_seq++;
                        s->new_session = 1;
                        ssl3_renegotiate(s);
                        if (ssl3_renegotiate_check(s))
index 29421da..9975e20 100644 (file)
@@ -276,10 +276,11 @@ int dtls1_accept(SSL *s)
                case SSL3_ST_SW_HELLO_REQ_B:
 
                        s->shutdown=0;
+                       dtls1_clear_record_buffer(s);
                        dtls1_start_timer(s);
                        ret=dtls1_send_hello_request(s);
                        if (ret <= 0) goto end;
-                       s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C;
+                       s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;
                        s->state=SSL3_ST_SW_FLUSH;
                        s->init_num=0;
 
@@ -721,10 +722,13 @@ int dtls1_accept(SSL *s)
                        if (ret <= 0) goto end;
 
 #ifndef OPENSSL_NO_SCTP
-                       /* Change to new shared key of SCTP-Auth,
-                        * will be ignored if no SCTP used.
-                        */
-                       BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                       if (!s->hit)
+                               {
+                               /* Change to new shared key of SCTP-Auth,
+                                * will be ignored if no SCTP used.
+                                */
+                               BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                               }
 #endif
 
                        s->state=SSL3_ST_SW_FINISHED_A;
@@ -749,7 +753,16 @@ int dtls1_accept(SSL *s)
                        if (ret <= 0) goto end;
                        s->state=SSL3_ST_SW_FLUSH;
                        if (s->hit)
+                               {
                                s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
+
+#ifndef OPENSSL_NO_SCTP
+                               /* Change to new shared key of SCTP-Auth,
+                                * will be ignored if no SCTP used.
+                                */
+                               BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+#endif
+                               }
                        else
                                {
                                s->s3->tmp.next_state=SSL_ST_OK;
@@ -912,15 +925,13 @@ int dtls1_send_server_hello(SSL *s)
        unsigned char *p,*d;
        int i;
        unsigned int sl;
-       unsigned long l,Time;
+       unsigned long l;
 
        if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
                {
                buf=(unsigned char *)s->init_buf->data;
                p=s->s3->server_random;
-               Time=(unsigned long)time(NULL);                 /* Time */
-               l2n(Time,p);
-               RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4);
+               ssl_fill_hello_random(s, 1, p, SSL3_RANDOM_SIZE);
                /* Do the message type and length last */
                d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
 
index 8242fd5..e4df843 100644 (file)
 #include <stdio.h>
 #include <ctype.h>
 #include <krb5.h>
+#ifdef OPENSSL_SYS_WIN32
+/* These can sometimes get redefined indirectly by krb5 header files
+ * after they get undefed in ossl_typ.h
+ */
+#undef X509_NAME
+#undef X509_EXTENSIONS
+#undef OCSP_REQUEST
+#undef OCSP_RESPONSE
+#endif
 
 #ifdef  __cplusplus
 extern "C" {
index 47673e7..2b93c63 100644 (file)
@@ -269,12 +269,35 @@ static int ssl23_no_ssl2_ciphers(SSL *s)
        return 1;
        }
 
+/* Fill a ClientRandom or ServerRandom field of length len. Returns <= 0
+ * on failure, 1 on success. */
+int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, int len)
+       {
+       int send_time = 0;
+
+       if (len < 4)
+               return 0;
+       if (server)
+               send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;
+       else
+               send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;
+       if (send_time)
+               {
+               unsigned long Time = (unsigned long)time(NULL);
+               unsigned char *p = result;
+               l2n(Time, p);
+               return RAND_pseudo_bytes(p, len-4);
+               }
+       else
+               return RAND_pseudo_bytes(result, len);
+       }
+
 static int ssl23_client_hello(SSL *s)
        {
        unsigned char *buf;
        unsigned char *p,*d;
        int i,ch_len;
-       unsigned long Time,l;
+       unsigned long l;
        int ssl2_compat;
        int version = 0, version_major, version_minor;
 #ifndef OPENSSL_NO_COMP
@@ -355,9 +378,7 @@ static int ssl23_client_hello(SSL *s)
 #endif
 
                p=s->s3->client_random;
-               Time=(unsigned long)time(NULL);         /* Time */
-               l2n(Time,p);
-               if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+               if (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)
                        return -1;
 
                if (version == TLS1_2_VERSION)
index ead01c8..53b9390 100644 (file)
@@ -161,6 +161,8 @@ int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
 
                i=s->method->ssl3_enc->final_finish_mac(s,
                        sender,slen,s->s3->tmp.finish_md);
+               if (i == 0)
+                       return 0;
                s->s3->tmp.finish_md_len = i;
                memcpy(p, s->s3->tmp.finish_md, i);
                p+=i;
@@ -208,7 +210,11 @@ static void ssl3_take_mac(SSL *s)
        {
        const char *sender;
        int slen;
-
+       /* If no new cipher setup return immediately: other functions will
+        * set the appropriate error.
+        */
+       if (s->s3->tmp.new_cipher == NULL)
+               return;
        if (s->state & SSL_ST_CONNECT)
                {
                sender=s->method->ssl3_enc->server_finished_label;
index 02edf3f..443a31e 100644 (file)
@@ -148,7 +148,7 @@ int tls1_cbc_remove_padding(const SSL* s,
        unsigned padding_length, good, to_check, i;
        const unsigned overhead = 1 /* padding length byte */ + mac_size;
        /* Check if version requires explicit IV */
-       if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION)
+       if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)
                {
                /* These lengths are all public so we can test them in
                 * non-constant time.
index 344e2eb..a6b3c01 100644 (file)
@@ -655,7 +655,7 @@ int ssl3_client_hello(SSL *s)
        unsigned char *buf;
        unsigned char *p,*d;
        int i;
-       unsigned long Time,l;
+       unsigned long l;
 #ifndef OPENSSL_NO_COMP
        int j;
        SSL_COMP *comp;
@@ -680,9 +680,8 @@ int ssl3_client_hello(SSL *s)
                /* else use the pre-loaded session */
 
                p=s->s3->client_random;
-               Time=(unsigned long)time(NULL);                 /* Time */
-               l2n(Time,p);
-               if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+
+               if (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)
                        goto err;
 
                /* Do the message type and length last */
index e7c5dcb..c4ef273 100644 (file)
@@ -1683,7 +1683,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_3DES,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
@@ -1699,7 +1699,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AES128,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
@@ -1715,7 +1715,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_AES256,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
@@ -3037,6 +3037,11 @@ void ssl3_clear(SSL *s)
                s->s3->tmp.ecdh = NULL;
                }
 #endif
+#ifndef OPENSSL_NO_TLSEXT
+#ifndef OPENSSL_NO_EC
+       s->s3->is_probably_safari = 0;
+#endif /* !OPENSSL_NO_EC */
+#endif /* !OPENSSL_NO_TLSEXT */
 
        rp = s->s3->rbuf.buf;
        wp = s->s3->wbuf.buf;
@@ -4016,6 +4021,13 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                ii=sk_SSL_CIPHER_find(allow,c);
                if (ii >= 0)
                        {
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT)
+                       if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari)
+                               {
+                               if (!ret) ret=sk_SSL_CIPHER_value(allow,ii);
+                               continue;
+                               }
+#endif
                        ret=sk_SSL_CIPHER_value(allow,ii);
                        break;
                        }
@@ -4274,7 +4286,7 @@ need to go to SSL_ST_ACCEPT.
 long ssl_get_algorithm2(SSL *s)
        {
        long alg2 = s->s3->tmp.new_cipher->algorithm2;
-       if (TLS1_get_version(s) >= TLS1_2_VERSION &&
+       if (s->method->version == TLS1_2_VERSION &&
            alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
                return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
        return alg2;
index 804291e..96ba632 100644 (file)
@@ -335,7 +335,7 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
                        if (version != s->version)
                                {
                                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
-                                if ((s->version & 0xFF00) == (version & 0xFF00))
+                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
                                        /* Send back error using their minor version number :-) */
                                        s->version = (unsigned short)version;
                                al=SSL_AD_PROTOCOL_VERSION;
@@ -1459,8 +1459,14 @@ int ssl3_do_change_cipher_spec(SSL *s)
                slen=s->method->ssl3_enc->client_finished_label_len;
                }
 
-       s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
+       i = s->method->ssl3_enc->final_finish_mac(s,
                sender,slen,s->s3->tmp.peer_finish_md);
+       if (i == 0)
+               {
+               SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
+               return 0;
+               }
+       s->s3->tmp.peer_finish_md_len = i;
 
        return(1);
        }
index bfb8480..9ac19c0 100644 (file)
@@ -958,7 +958,8 @@ int ssl3_get_client_hello(SSL *s)
            (s->version != DTLS1_VERSION && s->client_version < s->version))
                {
                SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
-               if ((s->client_version>>8) == SSL3_VERSION_MAJOR)
+               if ((s->client_version>>8) == SSL3_VERSION_MAJOR && 
+                       !s->enc_write_ctx && !s->write_hash)
                        {
                        /* similar to ssl3_get_record, send alert using remote version number */
                        s->version = s->client_version;
@@ -1193,12 +1194,9 @@ int ssl3_get_client_hello(SSL *s)
         * server_random before calling tls_session_secret_cb in order to allow
         * SessionTicket processing to use it in key derivation. */
        {
-               unsigned long Time;
                unsigned char *pos;
-               Time=(unsigned long)time(NULL);                 /* Time */
                pos=s->s3->server_random;
-               l2n(Time,pos);
-               if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)
+               if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE) <= 0)
                        {
                        al=SSL_AD_INTERNAL_ERROR;
                        goto f_err;
@@ -1435,19 +1433,13 @@ int ssl3_send_server_hello(SSL *s)
        unsigned char *p,*d;
        int i,sl;
        unsigned long l;
-#ifdef OPENSSL_NO_TLSEXT
-       unsigned long Time;
-#endif
 
        if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
                {
                buf=(unsigned char *)s->init_buf->data;
 #ifdef OPENSSL_NO_TLSEXT
                p=s->s3->server_random;
-               /* Generate server_random if it was not needed previously */
-               Time=(unsigned long)time(NULL);                 /* Time */
-               l2n(Time,p);
-               if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+               if (ssl_fill_hello_random(s, 1, p, SSL3_RANDOM_SIZE) <= 0)
                        return -1;
 #endif
                /* Do the message type and length last */
@@ -1838,7 +1830,7 @@ int ssl3_send_server_key_exchange(SSL *s)
                        SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
                        goto f_err;
                        }
-               for (i=0; r[i] != NULL && i<4; i++)
+               for (i=0; i < 4 && r[i] != NULL; i++)
                        {
                        nr[i]=BN_num_bytes(r[i]);
 #ifndef OPENSSL_NO_SRP
@@ -1874,7 +1866,7 @@ int ssl3_send_server_key_exchange(SSL *s)
                d=(unsigned char *)s->init_buf->data;
                p= &(d[4]);
 
-               for (i=0; r[i] != NULL && i<4; i++)
+               for (i=0; i < 4 && r[i] != NULL; i++)
                        {
 #ifndef OPENSSL_NO_SRP
                        if ((i == 2) && (type & SSL_kSRP))
index 593579e..7219a0e 100644 (file)
@@ -555,11 +555,14 @@ struct ssl_session_st
 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG                0x00000008L
 #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG             0x00000010L
 #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER              0x00000020L
-#define SSL_OP_MSIE_SSLV2_RSA_PADDING                  0x00000040L /* no effect since 0.9.7h and 0.9.8b */
+#define SSL_OP_SAFARI_ECDHE_ECDSA_BUG                  0x00000040L
 #define SSL_OP_SSLEAY_080_CLIENT_DH_BUG                        0x00000080L
 #define SSL_OP_TLS_D5_BUG                              0x00000100L
 #define SSL_OP_TLS_BLOCK_PADDING_BUG                   0x00000200L
 
+/* Hasn't done anything since OpenSSL 0.9.7h, retained for compatibility */
+#define SSL_OP_MSIE_SSLV2_RSA_PADDING                  0x0
+
 /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
  * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)
  * the workaround is not needed.  Unfortunately some broken SSL/TLS
@@ -641,6 +644,12 @@ struct ssl_session_st
  * TLS only.)  "Released" buffers are put onto a free-list in the context
  * or just freed (depending on the context's setting for freelist_max_len). */
 #define SSL_MODE_RELEASE_BUFFERS 0x00000010L
+/* Send the current time in the Random fields of the ClientHello and
+ * ServerHello records for compatibility with hypothetical implementations
+ * that require it.
+ */
+#define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
+#define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
 
 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
  * they cannot be used to clear bits. */
@@ -906,7 +915,7 @@ struct ssl_ctx_st
         */
        unsigned int max_send_fragment;
 
-#ifndef OPENSSL_ENGINE
+#ifndef OPENSSL_NO_ENGINE
        /* Engine to pass requests for client certs to
         */
        ENGINE *client_cert_engine;
index 247e88c..cb8b249 100644 (file)
@@ -539,6 +539,15 @@ typedef struct ssl3_state_st
        /* Set if we saw the Next Protocol Negotiation extension from our peer. */
        int next_proto_neg_seen;
 #endif
+
+#ifndef OPENSSL_NO_TLSEXT
+#ifndef OPENSSL_NO_EC
+       /* This is set to true if we believe that this is a version of Safari
+        * running on OS X 10.6 or newer. We wish to know this because Safari
+        * on 10.8 .. 10.8.3 has broken ECDHE-ECDSA support. */
+       char is_probably_safari;
+#endif /* !OPENSSL_NO_EC */
+#endif /* !OPENSSL_NO_TLSEXT */
        } SSL3_STATE;
 
 #endif
index 14d143d..6dbc3c1 100644 (file)
@@ -1797,7 +1797,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
 
        ret->extra_certs=NULL;
-       ret->comp_methods=SSL_COMP_get_compression_methods();
+       /* No compression for DTLS */
+       if (meth->version != DTLS1_VERSION)
+               ret->comp_methods=SSL_COMP_get_compression_methods();
 
        ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
 
@@ -2792,9 +2794,7 @@ void ssl_clear_cipher_ctx(SSL *s)
 /* Fix this function so that it takes an optional type parameter */
 X509 *SSL_get_certificate(const SSL *s)
        {
-       if (s->server)
-               return(ssl_get_server_send_cert(s));
-       else if (s->cert != NULL)
+       if (s->cert != NULL)
                return(s->cert->key->x509);
        else
                return(NULL);
index 1b98947..e485907 100644 (file)
@@ -621,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data;
 extern SSL3_ENC_METHOD SSLv3_enc_data;
 extern SSL3_ENC_METHOD DTLSv1_enc_data;
 
+#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION)
+
 #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \
                                s_get_meth) \
 const SSL_METHOD *func_name(void)  \
@@ -847,6 +849,7 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher);
 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
 int ssl_verify_alarm_type(long type);
 void ssl_load_ciphers(void);
+int ssl_fill_hello_random(SSL *s, int server, unsigned char *field, int len);
 
 int ssl2_enc_init(SSL *s, int client);
 int ssl2_generate_key_material(SSL *s);
index 809ad2e..0c4cdde 100644 (file)
@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which)
                        s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
                        else
                        s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
-               if (s->enc_write_ctx != NULL)
+               if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))
                        reuse_dd = 1;
-               else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+               else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL)
                        goto err;
-               else
-                       /* make sure it's intialized in case we exit later with an error */
-                       EVP_CIPHER_CTX_init(s->enc_write_ctx);
                dd= s->enc_write_ctx;
-               mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
+               if (SSL_IS_DTLS(s))
+                       {
+                       mac_ctx = EVP_MD_CTX_create();
+                       if (!mac_ctx)
+                               goto err;
+                       s->write_hash = mac_ctx;
+                       }
+               else
+                       mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
 #ifndef OPENSSL_NO_COMP
                if (s->compress != NULL)
                        {
@@ -915,18 +920,19 @@ int tls1_final_finish_mac(SSL *s,
                if (mask & ssl_get_algorithm2(s))
                        {
                        int hashsize = EVP_MD_size(md);
-                       if (hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))
+                       EVP_MD_CTX *hdgst = s->s3->handshake_dgst[idx];
+                       if (!hdgst || hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))
                                {
                                /* internal error: 'buf' is too small for this cipersuite! */
                                err = 1;
                                }
                        else
                                {
-                               EVP_MD_CTX_copy_ex(&ctx,s->s3->handshake_dgst[idx]);
-                               EVP_DigestFinal_ex(&ctx,q,&i);
-                               if (i != (unsigned int)hashsize) /* can't really happen */
+                               if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) ||
+                                       !EVP_DigestFinal_ex(&ctx,q,&i) ||
+                                       (i != (unsigned int)hashsize))
                                        err = 1;
-                               q+=i;
+                               q+=hashsize;
                                }
                        }
                }
@@ -980,7 +986,8 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
                }
                else
                {
-                       EVP_MD_CTX_copy(&hmac,hash);
+                       if (!EVP_MD_CTX_copy(&hmac,hash))
+                               return -1;
                        mac_ctx = &hmac;
                }
 
index e08088c..bddffd9 100644 (file)
@@ -342,19 +342,11 @@ static unsigned char tls12_sigalgs[] = {
 #ifndef OPENSSL_NO_SHA
        tlsext_sigalg(TLSEXT_hash_sha1)
 #endif
-#ifndef OPENSSL_NO_MD5
-       tlsext_sigalg_rsa(TLSEXT_hash_md5)
-#endif
 };
 
 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
        {
        size_t slen = sizeof(tls12_sigalgs);
-#ifdef OPENSSL_FIPS
-       /* If FIPS mode don't include MD5 which is last */
-       if (FIPS_mode())
-               slen -= 2;
-#endif
        if (p)
                memcpy(p, tls12_sigalgs, slen);
        return (int)slen;
@@ -670,6 +662,36 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
                 }
 #endif
 
+#ifdef TLSEXT_TYPE_padding
+       /* Add padding to workaround bugs in F5 terminators.
+        * See https://tools.ietf.org/html/draft-agl-tls-padding-03
+        *
+        * NB: because this code works out the length of all existing
+        * extensions it MUST always appear last.
+        */
+       {
+       int hlen = ret - (unsigned char *)s->init_buf->data;
+       /* The code in s23_clnt.c to build ClientHello messages includes the
+        * 5-byte record header in the buffer, while the code in s3_clnt.c does
+        * not. */
+       if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
+               hlen -= 5;
+       if (hlen > 0xff && hlen < 0x200)
+               {
+               hlen = 0x200 - hlen;
+               if (hlen >= 4)
+                       hlen -= 4;
+               else
+                       hlen = 0;
+
+               s2n(TLSEXT_TYPE_padding, ret);
+               s2n(hlen, ret);
+               memset(ret, 0, hlen);
+               ret += hlen;
+               }
+       }
+#endif
+
        if ((extdatalen = ret-p-2)== 0) 
                return p;
 
@@ -866,6 +888,89 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
        return ret;
        }
 
+#ifndef OPENSSL_NO_EC
+/* ssl_check_for_safari attempts to fingerprint Safari using OS X
+ * SecureTransport using the TLS extension block in |d|, of length |n|.
+ * Safari, since 10.6, sends exactly these extensions, in this order:
+ *   SNI,
+ *   elliptic_curves
+ *   ec_point_formats
+ *
+ * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
+ * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
+ * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
+ * 10.8..10.8.3 (which don't work).
+ */
+static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
+       unsigned short type, size;
+       static const unsigned char kSafariExtensionsBlock[] = {
+               0x00, 0x0a,  /* elliptic_curves extension */
+               0x00, 0x08,  /* 8 bytes */
+               0x00, 0x06,  /* 6 bytes of curve ids */
+               0x00, 0x17,  /* P-256 */
+               0x00, 0x18,  /* P-384 */
+               0x00, 0x19,  /* P-521 */
+
+               0x00, 0x0b,  /* ec_point_formats */
+               0x00, 0x02,  /* 2 bytes */
+               0x01,        /* 1 point format */
+               0x00,        /* uncompressed */
+       };
+
+       /* The following is only present in TLS 1.2 */
+       static const unsigned char kSafariTLS12ExtensionsBlock[] = {
+               0x00, 0x0d,  /* signature_algorithms */
+               0x00, 0x0c,  /* 12 bytes */
+               0x00, 0x0a,  /* 10 bytes */
+               0x05, 0x01,  /* SHA-384/RSA */
+               0x04, 0x01,  /* SHA-256/RSA */
+               0x02, 0x01,  /* SHA-1/RSA */
+               0x04, 0x03,  /* SHA-256/ECDSA */
+               0x02, 0x03,  /* SHA-1/ECDSA */
+       };
+
+       if (data >= (d+n-2))
+               return;
+       data += 2;
+
+       if (data > (d+n-4))
+               return;
+       n2s(data,type);
+       n2s(data,size);
+
+       if (type != TLSEXT_TYPE_server_name)
+               return;
+
+       if (data+size > d+n)
+               return;
+       data += size;
+
+       if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
+               {
+               const size_t len1 = sizeof(kSafariExtensionsBlock);
+               const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
+
+               if (data + len1 + len2 != d+n)
+                       return;
+               if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
+                       return;
+               if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
+                       return;
+               }
+       else
+               {
+               const size_t len = sizeof(kSafariExtensionsBlock);
+
+               if (data + len != d+n)
+                       return;
+               if (memcmp(data, kSafariExtensionsBlock, len) != 0)
+                       return;
+               }
+
+       s->s3->is_probably_safari = 1;
+}
+#endif /* !OPENSSL_NO_EC */
+
 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
        {
        unsigned short type;
@@ -886,6 +991,11 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                               SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 #endif
 
+#ifndef OPENSSL_NO_EC
+       if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
+               ssl_check_for_safari(s, data, d, n);
+#endif /* !OPENSSL_NO_EC */
+
        if (data >= (d+n-2))
                goto ri_check;
        n2s(data,len);
@@ -1181,7 +1291,7 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                }
                        }
                else if (type == TLSEXT_TYPE_status_request &&
-                        s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
+                        s->version != DTLS1_VERSION)
                        {
                
                        if (size < 5) 
@@ -2364,14 +2474,6 @@ const EVP_MD *tls12_get_hash(unsigned char hash_alg)
        {
        switch(hash_alg)
                {
-#ifndef OPENSSL_NO_MD5
-               case TLSEXT_hash_md5:
-#ifdef OPENSSL_FIPS
-               if (FIPS_mode())
-                       return NULL;
-#endif
-               return EVP_md5();
-#endif
 #ifndef OPENSSL_NO_SHA
                case TLSEXT_hash_sha1:
                return EVP_sha1();
@@ -2486,16 +2588,20 @@ tls1_process_heartbeat(SSL *s)
        unsigned int payload;
        unsigned int padding = 16; /* Use minimum padding */
 
-       /* Read type and payload length first */
-       hbtype = *p++;
-       n2s(p, payload);
-       pl = p;
-
        if (s->msg_callback)
                s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                        &s->s3->rrec.data[0], s->s3->rrec.length,
                        s, s->msg_callback_arg);
 
+       /* Read type and payload length first */
+       if (1 + 2 + 16 > s->s3->rrec.length)
+               return 0; /* silently discard */
+       hbtype = *p++;
+       n2s(p, payload);
+       if (1 + 2 + payload + 16 > s->s3->rrec.length)
+               return 0; /* silently discard per RFC 6520 sec. 4 */
+       pl = p;
+
        if (hbtype == TLS1_HB_REQUEST)
                {
                unsigned char *buffer, *bp;
index c39c267..c992091 100644 (file)
@@ -230,6 +230,12 @@ extern "C" {
 /* ExtensionType value from RFC5620 */
 #define TLSEXT_TYPE_heartbeat  15
 
+/* ExtensionType value for TLS padding extension.
+ * http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
+ * http://tools.ietf.org/html/draft-agl-tls-padding-03
+ */
+#define TLSEXT_TYPE_padding    21
+
 /* ExtensionType value from RFC4507 */
 #define TLSEXT_TYPE_session_ticket             35