summaryrefslogtreecommitdiff
path: root/lib/cryptohi
Commit message (Collapse)AuthorAgeFilesLines
* Bug 1767883 - Need to add policy control to keys lengths for signatures. ↵Robert Relyea2023-03-035-1/+143
| | | | | | | | | | | | | | | | | r=nss-reviewers There are three changes in the patch which are related to key length processing: Change RSA_MIN_MODULUS_BITS in blalpit.h from 128 to 1023. This necessitated changes to the following tests: testcrmf.c: up the generated key for the test from 512 to 1024. pk11_rsapkcs1_unittest.cc (in pk11_gtest): skip the min padding test if the MIN_RSA_MODULUS_BITS is more than 736 (The largest hash we support is 512, which fits in an RSA key less then 736. If we can't generate a key less than 736, we can't test minimum padding, but we can never get into that situation anyway now). tls_subcerts_unittest.cc: set our key size to at least RSA_MIN_MODULUS_BITS, and then make sure the policy had a higher minimum key length so we still trigger the 'weakKey' event. pk11kea.c: use 1024 bits for the transfer key now that smaller keysizes aren't supported by softoken. Expand the add a new flag to meaning of NSS_XXX_MIN_KEY_SIZE beyond it's use in SSL (add the ability to limit signing and verification to this as well). This allows us to set strict FIPS 140-3 policies, where we can only sign with 2048, but can still verify 1024. This part includes: New utility functions in seckey.c: SECKEY_PrivateKeyStrengthInBits(): The private key equivalent to SECKEY_PublicKeyStrengthInBits(). This function could be exported globally, but isn't in this patch. seckey_EnforceKeySize(). Takes a key type and a length and makes sure that length falls into the range set by policy. secsign.c and secvfy.c: add policy length check where we check the other policy flags. nss.h, nssoptions.c: add NSS_KEY_SIZE_POLICY_FLAGS and define flags for SSL, VERIFY, and SIGN. SSL is set by default (to maintain the current behavior). pk11parse.c: add keywords for the new NSS_KEY_SIZE_POLICY_FLAGS. ssl3con.c: use the flags to decide if the policy lengths are active for SSL. policy.txt: Test that the new policy flags are parsed correctly sslpolicy.txt: Add tests to make sure the policy flags are functioning. Update fips_algorithms.h to make sure the FIPS indicators are exactly compliant with FIPS 140-3 current guidance (RSA 2028 and above, any key size, Legacy verification allowed for 1024, 1280, 1536, and 1792 [1024-1792, step 256]). The previous attempt to push failed because the pk11_rsapkcs1_unittest.cc change was eaten in the merge. Differential Revision: https://phabricator.services.mozilla.com/D146341
* Backed out changeset 761e7d215e0a for causing gtest failuresNSS_3_89_BETA1John M. Schanck2023-03-025-143/+1
|
* Bug 1767883 Need to add policy control to keys lengths for signatures.Robert Relyea2022-12-195-1/+143
| | | | | | | | | | | | There are three changes in the patch which are related to key length processing: Change RSA_MIN_MODULUS_BITS in blalpit.h from 128 to 1023. This necessitated changes to the following tests: testcrmf.c: up the generated key for the test from 512 to 1024. pk11_rsapkcs1_unittest.cc (in pk11_gtest): skip the min padding test if the MIN_RSA_MODULUS_BITS is more than 736 (The largest hash we support is 512, which fits in an RSA key less then 736. If we can't generate a key less than 736, we can't test minimum padding, but we can never get into that situation anyway now). tls_subcerts_unittest.cc: set our key size to at least RSA_MIN_MODULUS_BITS, and then make sure the policy had a higher minimum key length so we still trigger the 'weakKey' event. pk11kea.c: use 1024 bits for the transfer key now that smaller keysizes aren't supported by softoken. Expand the add a new flag to meaning of NSS_XXX_MIN_KEY_SIZE beyond it's use in SSL (add the ability to limit signing and verification to this as well). This allows us to set strict FIPS 140-3 policies, where we can only sign with 2048, but can still verify 1024. This part includes: New utility functions in seckey.c: SECKEY_PrivateKeyStrengthInBits(): The private key equivalent to SECKEY_PublicKeyStrengthInBits(). This function could be exported globally, but isn't in this patch. seckey_EnforceKeySize(). Takes a key type and a length and makes sure that length falls into the range set by policy. secsign.c and secvfy.c: add policy length check where we check the other policy flags. nss.h, nssoptions.c: add NSS_KEY_SIZE_POLICY_FLAGS and define flags for SSL, VERIFY, and SIGN. SSL is set by default (to maintain the current behavior). pk11parse.c: add keywords for the new NSS_KEY_SIZE_POLICY_FLAGS. ssl3con.c: use the flags to decide if the policy lengths are active for SSL. policy.txt: Test that the new policy flags are parsed correctly sslpolicy.txt: Add tests to make sure the policy flags are functioning. Update fips_algorithms.h to make sure the FIPS indicators are exactly compliant with FIPS 140-3 current guidance (RSA 2028 and above, any key size, Legacy verification allowed for 1024, 1280, 1536, and 1792 [1024-1792, step 256]). Differential Revision: https://phabricator.services.mozilla.com/D146341
* Bug 1798823 - Additional zero-length RSA modulus checks. r=nkulatovaNSS_3_87_BETA1John M. Schanck2022-12-151-3/+7
| | | | Differential Revision: https://phabricator.services.mozilla.com/D163622
* Bug 1792821 - Updating the clang-format version to 10. r=jschanckAnna Weine2022-10-074-69/+63
| | | | Differential Revision: https://phabricator.services.mozilla.com/D158323
* Bug 1771495 - unchecked return code in sec_DecodeSigAlg. ↵John M. Schanck2022-06-061-2/+2
| | | | | | r=nss-reviewers,djackson Differential Revision: https://phabricator.services.mozilla.com/D147529
* Bug 1737470 - Ensure DER encoded signatures are within size limits. ↵Dennis Jackson2021-11-221-71/+121
| | | | | | r=jschanck,mt,bbeurdouche,rrelyea Differential Revision: https://phabricator.services.mozilla.com/D129514
* Bug 1670835 Crypto Policy Support needs to be updated with disable/enable ↵Robert Relyea2020-10-143-48/+110
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | support Policy update Current state of the nss policy system: The initial policy patch focused on getting policy working well in handling ssl. The policy infrastructure used two existing NSS infrastructure: 1) Algorithm policies tied the OIDS and 2) the ssl policy constraints first created to handle export policy restrictions. To make loadable policies work, we added a couple of new things: 1) a policy parser to the secmod infrastructure which allows us to set algorithm policies based on a config file. This file had two sections: disallow= and allow=. Disallow turned off policy bits, and allow turned them on. Disallow was always parsed first, so you could very strictly control your policy map by saying disallow=all allow={exclusive list of allowed algorithms} 2) a new NSS_Option() value that allowed the policy parser to set integer values (like minimum tls version) based on the data in the policy parser. 3) SSL code which is run at ssl_init time that reads the algorithm policies and maps the results to SSL policies. The resulting loaded policy code, in general, sets the boundaries of what it possible, actually enable/disable of ssl cipher suites are still under program control, and the builtin NSS default values. The only consession to configuration is if a cipher is disallowed by policy, it is also disabled. Allowing a cipher suite by policy that wasn't already enabled, however, doesn't enable that policy by default. Inside the policy restrictions, applications can still make their own decisions on configuration and preference. At the time the policy system was designed, there were 3 additional features, which were designed, but not specified: disable, enable, and lock. disable and enable work just like disallow and allow, except the specify what the default settings are. This would allow the policy file to change the underlying default in the case where the application doesn't try to configure ssl on it's own. lock would make either the policy or configuration 'locked' meaning once the lock has been executed, no further changes to those configurations would be allowed. What is needed: We have a need for the following additional features: 1) we want to turn more of the sha-1 hash function off by default. We still need sha-1 digest because it's used in many non-secure cases, but we do want to disable more sha-1 signature usage. Currently only CERT-SIGNATURE and various hmac usages in SSL ciphers can be controlled by policy. We want to disallow a greater range of signature (that is signature use in general). 2) we want to disable more ciphers by default, but need a way to have certain policies (like LEGACY) turn them back on, so that our shipped system is more secure by default. What this patch provides: 1) A new policy flag NSS_USE_ALG_IN_ANY_SIGNATURE was added. The cryptohi code which exports the NSS sign/verify high level code now checks the hash and signing algorithm against this new policy flag and fails if the policy isn't available. New key words were added to the policy parser for 'all-signature', which implies all signature flags at once, and 'signature', which maps to NSS_USE_ANY_SIGNATURE. NOTE: disable=all/signature and disable=all/all-signature are effective equivalent because cert-signatures eventually call the low level signature functions, but disable=all allow=rsa-pss/all-signature and disable=all allow=rsa-pss/signature are different in that the latter allows all rsa-pss signature and the latter allows rsa-pss signatures, but no on certificates (or on smime in the future) Also new keywords were added for rsa-pkcs, rsa-pss, and ecdsa for signature algorithms (along with dsa). 2) This patch implements disable and enable. These functions only work on SSL configuration. In the future SMIME/CMS configuration could also be added. Because the policy system is parsed and handled by NSS, and SSL configuration is handled in SSL, we use the same Apply code we used to apply ssl policy to set the inital configuration. The configured enable/disable state is configured in the ALGORTHIM policy system, where one bit says the enable/disable value is active and another bit which gives it's state. 3) two locks have been implented, policy-lock and ssl-lock. These are specified in the parser as flags (flags=policy-lock,ssl-lock). The policy locks all the policy changes: ssl_policy, algorithm policy, and options. It is implemented by two new exported functions: NSS_IsPolicyLocked() and NSS_LockPolicy(). The first allows applications to test if the policy is locked without having to try changing the policy. The various policy set functions check the NSS_IsPolicyLocked() function and returns SEC_ERROR_POLICY_LOCK if it's true. The ssl-lock changes the state of the policy to locked, and the state cannot be changed back without shutting down NSS. The second is implemented by setting a new Option called NSS_DEFAULT_LOCKS and the NSS_DEFAULT_SSL_LOCK flag. The idea is we can add an SMIME lock in the future. SSL checks the NSS_DEFAULT_SSL_LOCK flag before trying to set the cipher suite value, and blocks the change if it's set. 4) sslpolicy tests were updated to test the enable, disable, flags=policy-lock, flags=ssl-lock and the new signature primitives. 5) policy tests were updated to be able to run standalone (like all the other all.sh tests), as well as new tests to detect when no signing algorithms have been enabled. What is not in the patch 1) S/MIME signature policy has been defined for a while, but never hooked up. 2) S/MIME export policy needs to be connected back to the algorithm policy system just like the ssl cipher suites already are. 3) S/MIME default configuration needs to be connected back to the policy system. 4) ECC Curve policy needs to be hooked up with the signature policy (probably should create a generic 'key meets policy' function and have every call it).
* Bug 1649487 - Fix bad assert in VFY_EndWithSignature. r=jcjAlexander Scheel2020-07-021-1/+1
| | | | Differential Revision: https://phabricator.services.mozilla.com/D82054
* Bug 1629553 Merge simple config.mk files r=rrelyeaJan-Marek Glogowski2020-05-053-17/+1
| | | | | | | | | | | There is really no good reason to explicitly change the TARGET variable. And the empty SHARED_LIBRARY variable should also be in the manifest.mn to begin with. All the other empty variables start empty or undefined, so there is also no need to explicitly set them empty. Differential Revision: https://phabricator.services.mozilla.com/D70691
* Bug 290526 Drop recursive private_exports r=rrelyeaJan-Marek Glogowski2020-05-051-1/+0
| | | | | | | Copying private headers is now simply included in the exports target, as these headers use an extra directory anyway. Differential Revision: https://phabricator.services.mozilla.com/D69021
* Bug 1617387 fix compiler warning r=jcjJean-Luc Bonnafoux2020-02-241-1/+1
| | | | Differential Revision: https://phabricator.services.mozilla.com/D63771
* Bug 1515342 - More thorough input checking, r=jcjMartin Thomson2019-06-141-0/+5
| | | | | | All part of applying better discipline throughout. Differential Revision: https://phabricator.services.mozilla.com/D33736
* Bug 1473806 3.38 certutil -R cannot use EC orphan keyRobert Relyea2019-06-041-5/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | gtests/pk11_gtest/pk11_import_unittest.cc Pick up the gtest changes from patch https://phabricator.services.mozilla.com/D33262#change-GhQvkCURcwqg Update the gtest to accept dsa and dh keys as well. lib/cryptohi/seckey.c When converting private keys to public keys, if we can't find a cert, look for a public key. If none found use the CKM_NSS_PUB_FROM_PRIV derive mechanism to create one. lib/pk11wrap/pk11priv.h lib/pk11wrap/pk11skey.c Implement an internal function that can be used to derive a public key from a private key. Give appropriate warnings about what has to happen to make this public. lib/softoken/lowkey.c Add code to the low level derive public from private to actually calculate public componants that aren't stored in the private key. lib/softoken/pkcs11i.h lib/softoken/pkcs11.c Add helper function to populate a PKCS #11 object from a NSSLOWKEYPublicKey. lib/util/pkcs11n.h lib/softoken/pkcs11c.c Implement CKM_NSS_PUB_FROM_PRIV. Differential Revision: https://phabricator.services.mozilla.com/D33682
* bustage fixKai Engert2019-02-081-0/+1
|
* Bug 1526336, Implement new HASH_GetHashOidTagByHashType, r=rrelyeaKai Engert2019-02-082-1/+35
|
* Bug 1444444, apply crypto-policy on RSA-PSS hash algorithms, r=mtDaiki Ueno2018-11-224-81/+101
| | | | | | | | | | Reviewers: mt Reviewed By: mt Bug #: 1444444 Differential Revision: https://phabricator.services.mozilla.com/D12441
* Bug 1480647 - Warn about deprecation of key.h and keyt.h. Include keyhi.h ↵Cosmin Truta2018-09-143-3/+9
| | | | instead of key.h, and keythi.h instead of keyt.h. r=rrelyea
* Bug 1296986, Disable parameter unsafeAllowMissingParameters in ↵Kai Engert2018-07-261-1/+1
| | | | _SGN_VerifyPKCS1DigestInfo, based on a patch contributed by David Benjamin (davidben@google.com), r=fkiefer
* Bug 1423557, cryptohi: make RSA-PSS parameter check stricter, r=mtDaiki Ueno2018-01-021-8/+30
| | | | | | | | | | | | Summary: This adds a check on unsupported hash/mask algorithms and invalid trailer field, when converting SECKEYRSAPSSParams to CK_RSA_PKCS_PSS_PARAMS for both signing and verification. It also add missing support for SHA224 as underlying hash algorithm. Reviewers: mt Reviewed By: mt Bug #: 1423557 Differential Revision: https://phabricator.services.mozilla.com/D322
* Merge NSS trunk to NSS_TLS13_DRAFT19_BRANCHMartin Thomson2017-11-232-7/+28
|\
| * Bug 1415171, Fix handling of default RSA-PSS parameters, r=mtDaiki Ueno2017-11-082-7/+28
| | | | | | | | | | | | | | | | | | | | Reviewers: mt, rrelyea Reviewed By: mt Bug #: 1415171 Differential Revision: https://phabricator.services.mozilla.com/D202
* | Merge NSS trunk to NSS_TLS13_DRAFT19_BRANCHMartin Thomson2017-11-065-46/+618
|\ \ | |/
| * Bug 1400844, Implement handling of RSA-PSS signatures on certificates, r=mtDaiki Ueno2017-10-245-46/+618
| | | | | | | | This series adds high level API to sign and verify RSA-PSS signatures on certificates and utilizes them in tools.
* | Bug 1397990 - Run clang-format 4.0, r=meMartin Thomson2017-09-081-4/+2
|/ | | | | | | | These files were being reformatted by clang-format 4.0. If you make this change, then both 3.9 (in CI) and 4.0 are happy with the result. I don't plan to do this often, but it is a huge help. Note that the PK11 ECDSA tests are an odd duck, I have more on that coming.
* Bug 1345106, Don't use SHA1 by default for signatures in the NSS library and ↵Kai Engert2017-03-091-7/+8
| | | | in certutil, crlutil and cmsutil, r=rrelyea
* Bug 1345083, Move PK11_HasAttributeSet to public header, r=franziskus, r=rrelyeaKai Engert2017-03-081-1/+1
|
* Bug 1340103, Introduction of SECKEYECPublicKey.encoding in NSS 3.28 broke ↵Kai Engert2017-02-173-55/+27
| | | | ABI, r=rrelyea/mt
* Bug 1295121 - Add the ability to load PKCS#8 ECDSA private keys r=franziskusTim Taubert2017-02-021-0/+16
| | | | Differential Revision: https://nss-review.dev.mozaws.net/D185
* Bug 944179 - Use QuickDER to decode DER-encoded DSA and ECDSA signatures r=mtTim Taubert2017-01-121-5/+6
| | | | Differential Revision: https://nss-review.dev.mozaws.net/D142
* bug 1316604 - Add variables for <(nss_dist_dir)/{public,private}. r=franziskusTed Mielczarek2016-11-101-2/+2
| | | | | Mozilla's build system currently puts NSS public headers directly in $(DIST)/include/nss, so we need a way to override the export directory.
* Bug 1277228 - scan-build on ckfw, crmf, cryptohi, nss, and dev, r=ttaubertFranziskus Kiefer2016-10-261-3/+0
| | | | Differential Revision: https://nss-dev.phacility.com/D119
* Bug 1311615 - Building with gyp should copy headers, libs, executables to ↵Tim Taubert2016-10-211-2/+2
| | | | | | the right directory r=franziskus Differential Revision: https://nss-dev.phacility.com/D104
* bug 1237872 - Add gyp build system for NSS. r=fkieferTed Mielczarek2016-09-232-0/+64
|
* Bug 957105 - Curve25519 TLS, r=mtFranziskus Kiefer2016-09-201-7/+6
|
* Bug 957105 - Curve25519, r=mt,rrelyeaFranziskus Kiefer2016-09-194-9/+70
|
* Bug 1295115 - follow up to clang-format for CI, r= kaieFranziskus Kiefer2016-08-142-10/+6
|
* Bug 1290847 - Support configuring PSS certificates r=mtTim Taubert2016-08-101-0/+1
|
* Bug671097 - don't call SECKEY_UpdateCertPQG in CERT_ExtractPublicKey, ↵NSS_3_24_BETA7Franziskus Kiefer2016-02-291-10/+0
| | | | r=rrelyea,kaie
* Backed out changeset 939c111a293d, due to test bustage on some devicesFranziskus Kiefer2016-04-211-0/+10
|
* Bug671097 - don't call SECKEY_UpdateCertPQG in CERT_ExtractPublicKey, r=rrelyeaFranziskus Kiefer2016-02-291-10/+0
|
* Bug 1251185, NSS clang-format: else line-break fixes, r=ttaubertNSS_3_23_BETA7Franziskus Kiefer2016-02-253-46/+23
|
* Bug 1235586, clang-format on lib/cryptohi with manual corrections, r=kaieNSS_3_22_BETA1Franziskus Kiefer2016-01-1811-1999/+2074
|
* Bug 1211403 - Calculate DSA and DH key sizes based on prime, not public key, ↵Martin Thomson2015-12-031-2/+2
| | | | r=wtc
* Bug 1118245. Apply uniform style across NSS [remove trailing commas in ↵Franziskus Kiefer2015-11-104-29/+29
| | | | initializers]. r=ekr
* Bug 1216501 - [CID 1327954][CID 1327953][CID 1327952][CID 1327951] Using ↵Franziskus Kiefer2015-10-211-0/+1
| | | | uninitialized value secitem.type when calling SECITEM_CopyItem_Util - copying secitem.type only if present, r=mt
* bug 1009429Robert Relyea2015-10-012-0/+27
| | | | | 0005-Check-for-acceptable-certificate-parameters-when-ver.patch (also 0004) Also update tests to use > 512 bit keys.
* Bug 1185033: Remove unnecessary (char *) casts for the first argument toWan-Teh Chang2015-08-151-4/+4
| | | | PORT_Memset. r=dkeeler
* Bug 1138554 - Raising minimum key size on DH and RSA to 1023, r=wtcMartin Thomson2015-04-072-40/+60
|
* Bug 1064636, follow up commit to fix Windows build bustageKai Engert2014-09-231-1/+1
|
View Lorry Controller Status