openssl/crypto, branch OpenSSL_1_0_2s

Prepare for 1.0.2s release

2019-05-28T12:56:29Z

Reviewed-by: Matt Caswell

Update copyright year

2019-05-28T12:41:38Z

Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9032)

Change default RSA, DSA and DH size to 2048 bit

2019-05-21T14:58:42Z

Fixes: #8737 Reviewed-by: Bernd Edlinger Reviewed-by: Richard Levitte GH: #8741 (cherry picked from commit 70b0b977f73cd70e17538af3095d18e0cf59132e)

RT 4242: reject invalid EC point coordinates

2019-04-25T12:09:22Z

This is a backport of commit 1e2012b7 to 1.0.2. This hardening change was made to 1.1.0 but was not backported to 1.0.2. Recent CVEs in user applications have shown this additional hardening in 1.0.2 would be beneficial. E.g. see the patch for CVE-2019-9498 https://w1.fi/security/2019-4/0011-EAP-pwd-server-Verify-received-scalar-and-element.patch and CVE-2019-9499 https://w1.fi/security/2019-4/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch The original commit had this description: We already test in EC_POINT_oct2point that points are on the curve. To be on the safe side, move this check to EC_POINT_set_affine_coordinates_* so as to also check point coordinates received through some other method. We do not check projective coordinates, though, as - it's unlikely that applications would be receiving this primarily internal representation from untrusted sources, and - it's possible that the projective setters are used in a setting where performance matters. Reviewed-by: Paul Dale Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/8750)

fixed public range check in ec_GF2m_simple_oct2point

2019-03-30T14:12:07Z

Reviewed-by: Matt Caswell Reviewed-by: Bernd Edlinger (Merged from https://github.com/openssl/openssl/pull/8607) (cherry picked from commit cad8347be23c5e0c0d9eea02d090d42daf2dd7a9)

Modify the RSA_private_decrypt functions to check the padding in

2019-03-22T13:48:37Z

constant time with a memory access pattern that does not depend on secret information. [extended tests] Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/8543) (cherry picked from commit 9c0cf214e7836eb5aaf1ea5d3cbf6720533f86b5)

Make err_clear_constant_time really constant time

2019-03-22T13:39:02Z

[extended tests] Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/8558)

Clear the point S before freeing in ec_mul_consttime

2019-03-18T21:50:08Z

The secret point R can be recovered from S using the equation R = S - P. The X and Z coordinates should be sufficient for that. Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/8505) (cherry picked from commit 502b871ad4eacc96a31f89d9a9470ca2858da998)

Clear the secret point in ecdh_compute_key

2019-03-17T09:02:07Z

Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/8502)

Fix memory overrun in rsa padding check functions

2019-03-07T22:36:55Z

Backported from d7f5e5ae6d5 Fixes #8364 and #8357 Reviewed-by: Kurt Roeckx (Merged from https://github.com/openssl/openssl/pull/8438)