aboutsummaryrefslogtreecommitdiffstats
path: root/src/crypto
Commit message (Collapse)AuthorAgeFilesLines
...
* [libc] Replace linker_assert() with build_assert()Michael Brown2024-01-166-38/+38
| | | | | | | | | | | | | | | | | | | | | | | We currently implement build-time assertions via a mechanism that generates a call to an undefined external function that will cause the link to fail unless the compiler can prove that the asserted condition is true (and thereby eliminate the undefined function call). This assertion mechanism can be used for conditions that are not amenable to the use of static_assert(), since static_assert() will not allow for proofs via dead code elimination. Add __attribute__((error(...))) to the undefined external function, so that the error is raised at compile time rather than at link time. This allows us to provide a more meaningful error message (which will include the file name and line number, as with any other compile-time error), and avoids the need for the caller to specify a unique symbol name for the external function. Change the name from linker_assert() to build_assert(), since the assertion now takes place at compile time rather than at link time. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add support for PKCS#8 private key formatMichael Brown2023-06-022-1/+44
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow for entropy sources that fail during startup testsMichael Brown2023-02-201-122/+227
| | | | | | | | | Provide per-source state variables for the repetition count test and adaptive proportion test, to allow for the situation in which an entropy source can be enabled but then fails during the startup tests, thereby requiring an alternative entropy source to be used. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow entropy source to be selected at runtimeMichael Brown2023-02-172-229/+94
| | | | | | | | | | | | | | | | | | | | | | | | As noted in commit 3c83843 ("[rng] Check for several functioning RTC interrupts"), experimentation shows that Hyper-V cannot be trusted to reliably generate RTC interrupts. (As noted in commit f3ba0fb ("[hyperv] Provide timer based on the 10MHz time reference count MSR"), Hyper-V appears to suffer from a general problem in reliably generating any legacy interrupts.) An alternative entropy source is therefore required for an image that may be used in a Hyper-V Gen1 virtual machine. The x86 RDRAND instruction provides a suitable alternative entropy source, but may not be supported by all CPUs. We must therefore allow for multiple entropy sources to be compiled in, with the single active entropy source selected only at runtime. Restructure the internal entropy API to allow a working entropy source to be detected and chosen at runtime. Enable the RDRAND entropy source for all x86 builds, since it is likely to be substantially faster than any other source. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add GCM cipher suitesMichael Brown2022-11-104-8/+128
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Support in-place decryption for GCM ciphersMichael Brown2022-11-101-34/+32
| | | | | | | | | | | | The hash calculation is currently performed incorrectly when decrypting in place, since the ciphertext will have been overwritten with the plaintext before being used to update the hash value. Restructure the code to allow for in-place encryption and decryption. Choose to optimise for the decryption case, since we are likely to decrypt much more data than we encrypt. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Ensure relevant GCM cipher state is cleared by cipher_setiv()Michael Brown2022-11-091-7/+13
| | | | | | | Reset the accumulated authentication state when cipher_setiv() is called, to allow the cipher to be reused without resetting the key. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Allow handshake digest algorithm to be specified by cipher suiteMichael Brown2022-11-092-0/+9
| | | | | | | | | | | | | | | | | | | All existing cipher suites use SHA-256 as the TLSv1.2 and above handshake digest algorithm (even when using SHA-1 as the MAC digest algorithm). Some GCM cipher suites use SHA-384 as the handshake digest algorithm. Allow the cipher suite to specify the handshake (and PRF) digest algorithm to be used for TLSv1.2 and above. This requires some restructuring to allow for the fact that the ClientHello message must be included within the handshake digest, even though the relevant digest algorithm is not yet known at the point that the ClientHello is sent. Fortunately, the ClientHello may be reproduced verbatim at the point of receiving the ServerHello, so we rely on reconstructing (rather than storing) this message. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add MAC length as a cipher suite parameterMichael Brown2022-11-082-0/+8
| | | | | | | | | | | | | | | TLS stream and block ciphers use a MAC with a length equal to the output length of the digest algorithm in use. For AEAD ciphers there is no MAC, with the equivalent functionality provided by the cipher algorithm's authentication tag. Allow for the existence of AEAD cipher suites by making the MAC length a parameter of the cipher suite. Assume that the MAC key length is equal to the MAC length, since this is true for all currently supported cipher suites. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add concept of cipher alignment sizeMichael Brown2022-11-073-0/+3
| | | | | | | | | | | | | | | | | | | The GCM cipher mode of operation (in common with other counter-based modes of operation) has a notion of blocksize that does not neatly fall into our current abstraction: it does operate in 16-byte blocks but allows for an arbitrary overall data length (i.e. the final block may be incomplete). Model this by adding a concept of alignment size. Each call to encrypt() or decrypt() must begin at a multiple of the alignment size from the start of the data stream. This allows us to model GCM by using a block size of 1 byte and an alignment size of 16 bytes. As a side benefit, this same concept allows us to neatly model the fact that raw AES can encrypt only a single 16-byte block, by specifying an alignment size of zero on this cipher. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Formalise notions of fixed and record initialisation vectorsMichael Brown2022-11-072-0/+16
| | | | | | | | | | | | | | | | | | | | | TLS block ciphers always use CBC (as per RFC 5246 section 6.2.3.2) with a record initialisation vector length that is equal to the cipher block size, and no fixed initialisation vector. The initialisation vector for AEAD ciphers such as GCM is less straightforward, and requires both a fixed and per-record component. Extend the definition of a cipher suite to include fixed and record initialisation vector lengths, and generate the fixed portion (if any) as part of key expansion. Do not add explicit calls to cipher_setiv() in tls_assemble_block() and tls_split_block(), since the constraints imposed by RFC 5246 are specifically chosen to allow implementations to avoid doing so. (Instead, add a sanity check that the record initialisation vector length is equal to the cipher block size.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add block cipher Galois/Counter mode of operationMichael Brown2022-10-252-0/+536
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add concept of authentication tag to cipher algorithmsMichael Brown2022-10-253-0/+10
| | | | | | | | Some ciphers (such as GCM) support the concept of a tag that can be used to authenticate the encrypted data. Add a cipher method for generating an authentication tag. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow initialisation vector length to vary from cipher blocksizeMichael Brown2022-10-251-1/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Expose null crypto algorithm methods for reuseMichael Brown2022-10-253-51/+31
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add support for DHE variants of the existing cipher suitesMichael Brown2022-10-112-4/+52
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add key exchange mechanism to definition of cipher suiteMichael Brown2022-10-112-0/+4
| | | | | | | Allow for the key exchange mechanism to vary depending upon the selected cipher suite. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add Ephemeral Diffie-Hellman key exchange algorithmMichael Brown2022-10-111-0/+133
| | | | | | | | Add an implementation of the Ephemeral Diffie-Hellman key exchange algorithm as defined in RFC2631, with test vectors taken from the NIST Cryptographic Toolkit. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Simplify internal HMAC APIMichael Brown2022-10-104-93/+54
| | | | | | | | | | | | Simplify the internal HMAC API so that the key is provided only at the point of calling hmac_init(), and the (potentially reduced) key is stored as part of the context for later use by hmac_final(). This simplifies the calling code, and avoids the need for callers such as TLS to allocate a potentially variable length block in order to retain a copy of the unmodified key. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x509] Use case-insensitive comparison for certificate namesMichael Brown2021-05-181-1/+2
| | | | | | | | DNS names are case-insensitive, and RFC 5280 (unlike RFC 3280) mandates support for case-insensitive name comparison in X.509 certificates. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x509] Clarify debug message for an untrusted X.509 issuerJosh McSavaney2020-12-281-1/+1
| | | | | | | | | | We surface this debugging information in cases where a cert actually lacks an issuer, but also in cases where it *has* an issuer, but we cannot trust it (e.g. due to issues in establishing a trust chain). Signed-off-by: Josh McSavaney <me@mcsau.cc> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow private key to be specified as a TLS connection parameterMichael Brown2020-12-152-11/+28
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x509] Make root of trust a reference-counted structureMichael Brown2020-12-092-11/+46
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [x509] Record root of trust used when validating a certificateMichael Brown2020-12-082-7/+22
| | | | | | | | | | | | | Record the root of trust used at the point that a certificate is validated, redefine validation as checking a certificate against a specific root of trust, and pass an explicit root of trust when creating a TLS connection. This allows a custom TLS connection to be used with a custom root of trust, without causing any validated certificates to be treated as valid for normal purposes. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Remove dummy OCSP certificate rootMichael Brown2020-12-081-14/+2
| | | | | | | | | | | | | | | | | OCSP currently calls x509_validate() with an empty root certificate list, on the basis that the OCSP signer certificate (if existent) must be signed directly by the issuer certificate. Using an empty root certificate list is not required to achieve this goal, since x509_validate() already accepts an explicit issuer certificate parameter. The explicit empty root certificate list merely prevents the signer certificate from being evaluated as a potential trusted root certificate. Remove the dummy OCSP root certificate list and use the default root certificate list when calling x509_validate(). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [asn1] Rename ASN1_OID_CURSOR to ASN1_CURSORMichael Brown2020-12-0819-27/+27
| | | | | | | | There is nothing OID-specific about the ASN1_OID_CURSOR macro. Rename to allow it to be used for constructing ASN.1 cursors with arbitrary contents. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [deflate] Fix typo in comment describing length codesDaniel Johnson2020-07-211-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Accept SHA1 certID responses even if SHA1 is not enabledMichael Brown2020-06-251-15/+25
| | | | | | | | | | | | | | | | | | | Various implementation quirks in OCSP servers make it impractical to use anything other than SHA1 to construct the issuerNameHash and issuerKeyHash identifiers in the request certID. For example: both the OpenCA OCSP responder used by ipxe.org and the Boulder OCSP responder used by LetsEncrypt will fail if SHA256 is used in the request certID. As of commit 6ffe28a ("[ocsp] Accept response certID with missing hashAlgorithm parameters") we rely on asn1_digest_algorithm() to parse the algorithm identifier in the response certID. This will fail if SHA1 is disabled via config/crypto.h. Fix by using a direct ASN.1 object comparison on the OID within the algorithm identifier. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow algorithms to be included without being OID-identifiableMichael Brown2020-06-1620-110/+371
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are many ways in which the object for a cryptographic algorithm may be included, even if not explicitly enabled in config/crypto.h. For example: the MD5 algorithm is required by TLSv1.1 or earlier, by iSCSI CHAP authentication, by HTTP digest authentication, and by NTLM authentication. In the current implementation, inclusion of an algorithm for any reason will result in the algorithm's ASN.1 object identifier being included in the "asn1_algorithms" table, which consequently allows the algorithm to be used for any ASN1-identified purpose. For example: if the MD5 algorithm is included in order to support HTTP digest authentication, then iPXE would accept a (validly signed) TLS certificate using an MD5 digest. Split the ASN.1 object identifiers into separate files that are required only if explicitly enabled in config/crypto.h. This allows an algorithm to be omitted from the "asn1_algorithms" table even if the algorithm implementation is dragged in for some other purpose. The end result is that only the algorithms that are explicitly enabled in config/crypto.h can be used for ASN1-identified purposes such as signature verification. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Profile the various stages of modular multiplicationMichael Brown2019-08-171-0/+29
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Drag in configured digestInfo prefixes for any use of RSAMichael Brown2019-08-171-0/+6
| | | | | | | | | | Ensure that the configured RSA digestInfo prefixes are included in any build that includes rsa.o (rather than relying on x509.o or tls.o also being present in the final binary). This allows the RSA self-tests to be run in isolation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Accept response certID with missing hashAlgorithm parametersMichael Brown2019-03-101-12/+30
| | | | | | | | | | | | | | | | | | One of the design goals of ASN.1 DER is to provide a canonical serialization of a data structure, thereby allowing for equality of values to be tested by simply comparing the serialized bytes. Some OCSP servers will modify the request certID to omit the optional (and null) "parameters" portion of the hashAlgorithm. This is arguably legal but breaks the ability to perform a straightforward bitwise comparison on the entire certID field between request and response. Fix by comparing the OID-identified hashAlgorithm separately from the remaining certID fields. Originally-fixed-by: Thilo Fromm <Thilo@kinvolk.io> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [init] Show startup and shutdown function names in debug messagesMichael Brown2019-01-252-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Use fixed-point calculations for min-entropy quantitiesMichael Brown2018-03-201-2/+3
| | | | | | | | | | | | | | We currently perform various min-entropy calculations using build-time floating-point arithmetic. No floating-point code ends up in the final binary, since the results are eventually converted to integers and asserted to be compile-time constants. Though this mechanism is undoubtedly cute, it inhibits us from using "-mno-sse" to prevent the use of SSE registers by the compiler. Fix by using fixed-point arithmetic instead. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ocsp] Centralise test for whether or not an OCSP check is requiredMichael Brown2018-03-181-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [ntlm] Add support for NTLM authentication mechanismMichael Brown2017-11-121-0/+334
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add MD4 message digest algorithmMichael Brown2017-11-121-0/+280
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Eliminate repetitions in MD5 round constant tableMichael Brown2017-11-121-7/+10
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Fix endianness typo in commentMichael Brown2017-11-111-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Expose asn1_grow()Michael Brown2017-06-201-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Expose RSA_CTX_SIZE constantMichael Brown2017-06-201-1/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Mark permanent certificates as permanentMichael Brown2016-08-311-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add certstat() to display basic certificate informationMichael Brown2016-08-311-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow certificates to be marked as having been added explicitlyMichael Brown2016-08-311-4/+19
| | | | | | | | Allow certificates to be marked as having been added explicitly at run time. Such certificates will not be discarded via the certificate store cache discarder. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Expose certstore_del() to explicitly remove stored certificatesMichael Brown2016-08-311-4/+15
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Generalise X.509 "valid" field to a "flags" fieldMichael Brown2016-08-252-5/+5
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add image_x509() to extract X.509 certificates from imageMichael Brown2016-08-251-0/+42
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Enable both DER and PEM formats by defaultMichael Brown2016-07-291-0/+42
| | | | | | | | | | Enable both IMAGE_DER and IMAGE_PEM by default, and drag in the relevant objects only when image_asn1() is present in the binary. This allows "imgverify" to transparently use either DER or PEM signature files. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Allow for parsing of partial ASN.1 cursorsMichael Brown2016-07-281-6/+7
| | | | | | | | | Allow code to create a partial ASN.1 cursor containing only the type and length bytes, so that asn1_start() may be used to determine the length of a large ASN.1 blob without first allocating memory to hold the entire blob. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [arm] Avoid instruction references to symbols defined via ".equ"Michael Brown2016-05-081-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | When building for 64-bit ARM, some symbol references may be resolved via an "adrp" instruction (to obtain the start of the 4kB page containing the symbol) and a separate 12-bit offset. For example (taken from the GNU assembler documentation): adrp x0, foo ldr x0, [x0, #:lo12:foo] We occasionally refer to symbols defined via mechanisms that are not directly visible to gcc. For example: extern char some_magic_symbol[]; __asm__ ( ".equ some_magic_symbol, some_magic_expression" ); The subsequent use of the ":lo12:" prefix on such magically-defined symbols triggers an assertion failure in the assembler. This problem seems to affect only "private_key_len" in the current codebase. Fix by storing this value as static data; this avoids the need to provide the value as a literal within the instruction stream, and so avoids the problematic use of the ":lo12:" prefix. Signed-off-by: Michael Brown <mcb30@ipxe.org>
generated by cgit (git 2.34.1) at 2025-02-23 12:49:04 +0000