aboutsummaryrefslogtreecommitdiffstats
path: root/src/config/crypto.h
Commit message (Collapse)AuthorAgeFilesLines
* [crypto] Add definitions and tests for the NIST P-384 elliptic curveMichael Brown2025-01-301-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add definitions and tests for the NIST P-256 elliptic curveMichael Brown2025-01-281-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add ECDHE cipher suitesMichael Brown2024-01-311-0/+3
| | | | | | | Add ECDHE variants of the existing cipher suites, and lower the priority of the non-ECDHE variants. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Make key exchange algorithms selectable via build configurationMichael Brown2024-01-301-0/+6
| | | | | | | | | Allow the choice of key exchange algorithms to be controlled via build configuration options in config/crypto.h, as is already done for the choices of public-key algorithms, cipher algorithms, and digest algorithms. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add X25519 OID-identified algorithm and TLS named curveMichael Brown2024-01-301-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add GCM cipher suitesMichael Brown2022-11-101-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Disable MD5 as an OID-identifiable algorithm by defaultMichael Brown2020-06-161-1/+1
| | | | | | | | | | | | | | | | Disable the use of MD5 as an OID-identifiable algorithm. Note that the MD5 algorithm implementation will still be present in the build, since it is used implicitly by various cryptographic components such as HTTP digest authentication; this commit removes it only from the list of OID-identifiable algorithms. It would be appropriate to similarly disable the use of SHA-1 by default, but doing so would break the use of OCSP since several OCSP responders (including the current version of openca-ocspd) are not capable of interpreting the hashAlgorithm field and so will fail if the client uses any algorithm other than the configured default. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow algorithms to be included without being OID-identifiableMichael Brown2020-06-161-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are many ways in which the object for a cryptographic algorithm may be included, even if not explicitly enabled in config/crypto.h. For example: the MD5 algorithm is required by TLSv1.1 or earlier, by iSCSI CHAP authentication, by HTTP digest authentication, and by NTLM authentication. In the current implementation, inclusion of an algorithm for any reason will result in the algorithm's ASN.1 object identifier being included in the "asn1_algorithms" table, which consequently allows the algorithm to be used for any ASN1-identified purpose. For example: if the MD5 algorithm is included in order to support HTTP digest authentication, then iPXE would accept a (validly signed) TLS certificate using an MD5 digest. Split the ASN.1 object identifiers into separate files that are required only if explicitly enabled in config/crypto.h. This allows an algorithm to be omitted from the "asn1_algorithms" table even if the algorithm implementation is dragged in for some other purpose. The end result is that only the algorithms that are explicitly enabled in config/crypto.h can be used for ASN1-identified purposes such as signature verification. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Default to supporting only TLSv1.1 or aboveMichael Brown2020-06-161-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow a minimum TLS protocol version to be specifiedMichael Brown2020-06-121-0/+3
| | | | | | | | The supported ciphers and digest algorithms may already be specified via config/crypto.h. Extend this to allow a minimum TLS protocol version to be specified. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Allow OCSP checks to be disabledMichael Brown2018-03-181-0/+8
| | | | | | | | | Some CAs provide non-functional OCSP servers, and some clients are forced to operate on networks without access to the OCSP servers. Allow the user to explicitly disable the use of OCSP checks by undefining OCSP_CHECK in config/crypto.h. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow cross-certificate source to be configured at build timeMichael Brown2016-03-241-0/+8
| | | | | | | | | Provide a build option CROSSCERT in config/crypto.h to allow the default cross-signed certificate source to be configured at build time. The ${crosscert} setting may still be used to reconfigure the cross-signed certificate source at runtime. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Support SHA-{224,384,512} in X.509 certificatesMichael Brown2015-08-021-0/+33
| | | | | | | | | Add support for SHA-224, SHA-384, and SHA-512 as digest algorithms in X.509 certificates, and allow the choice of public-key, cipher, and digest algorithms to be configured at build time via config/crypto.h. Originally-implemented-by: Tufan Karadere <tufank@gmail.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Relicense files under GPL2_OR_LATER_OR_UBDLMichael Brown2015-03-021-1/+1
| | | | | | | Relicense files for which I am the sole author (as identified by util/relicense.pl). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow for named configurations at build timeMichael Brown2014-08-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow named configurations to be specified via the CONFIG=... build parameter. For headers in config/*.h which support named configurations, the following files will be included when building with CONFIG=<name>: - config/defaults/<platform>.h (e.g. config/defaults/pcbios.h) - config/<header>.h - config/<name>/<header>.h (only if the directory config/<name> exists) - config/local/<header>.h (autocreated if necessary) - config/local/<name>/<header>.h (autocreated if necessary) This mechanism allows for predefined named configurations to be checked in to the source tree, as a directory config/<name> containing all of the required header files. The mechanism also allows for users to define multiple local configurations, by creating header files in the directory config/local/<name>. Note that the config/*.h files which are used only to configure internal iPXE APIs (e.g. config/ioapi.h) cannot be modified via a named configuration. This avoids rebuilding the entire iPXE codebase whenever switching to a different named configuration. Inspired-by: Robin Smidsrød <robin@smidsrod.no> Tested-by: Robin Smidsrød <robin@smidsrod.no> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow signed timestamp error margin to be configured at build timeMichael Brown2014-03-301-0/+22
Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit (git 2.34.1) at 2025-02-23 12:25:53 +0000