kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
3f944674b2
boringssl/crypto/err/ec.errordata

35 lines
897 B
Plaintext
Raw Normal View History

Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,126,BIGNUM_OUT_OF_RANGE
EC,100,BUFFER_TOO_SMALL
EC,101,COORDINATES_OUT_OF_RANGE
EC,102,D2I_ECPKPARAMETERS_FAILURE
Rewrite ECPrivateKey serialization. Functions which lose object reuse and need auditing: - d2i_ECParameters - d2i_ECPrivateKey This adds a handful of bytestring-based APIs to handle EC key serialization. Deprecate all the old serialization APIs. Notes: - An EC_KEY has additional state that controls its encoding, enc_flags and conv_form. conv_form is left alone, but enc_flags in the new API is an explicit parameter. - d2i_ECPrivateKey interpreted its T** argument unlike nearly every other d2i function. This is an explicit EC_GROUP parameter in the new function. - The new specified curve code is much stricter and should parse enough to uniquely identify the curve. - I've not bothered with a new version of i2d_ECParameters. It just writes an OID. This may change later when decoupling from the giant OID table. - Likewise, I've not bothered with new APIs for the public key since the EC_POINT APIs should suffice. - Previously, d2i_ECPrivateKey would not call EC_KEY_check_key and it was possible for the imported public and private key to mismatch. It now calls it. BUG=499653 Change-Id: I30b4dd2841ae76c56ab0e1808360b2628dee0615 Reviewed-on: https://boringssl-review.googlesource.com/6859 Reviewed-by: Adam Langley <agl@google.com>
2016-01-03 08:57:37 +00:00
EC,128,DECODE_ERROR
Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,103,EC_GROUP_NEW_BY_NAME_FAILURE
Rewrite ECPrivateKey serialization. Functions which lose object reuse and need auditing: - d2i_ECParameters - d2i_ECPrivateKey This adds a handful of bytestring-based APIs to handle EC key serialization. Deprecate all the old serialization APIs. Notes: - An EC_KEY has additional state that controls its encoding, enc_flags and conv_form. conv_form is left alone, but enc_flags in the new API is an explicit parameter. - d2i_ECPrivateKey interpreted its T** argument unlike nearly every other d2i function. This is an explicit EC_GROUP parameter in the new function. - The new specified curve code is much stricter and should parse enough to uniquely identify the curve. - I've not bothered with a new version of i2d_ECParameters. It just writes an OID. This may change later when decoupling from the giant OID table. - Likewise, I've not bothered with new APIs for the public key since the EC_POINT APIs should suffice. - Previously, d2i_ECPrivateKey would not call EC_KEY_check_key and it was possible for the imported public and private key to mismatch. It now calls it. BUG=499653 Change-Id: I30b4dd2841ae76c56ab0e1808360b2628dee0615 Reviewed-on: https://boringssl-review.googlesource.com/6859 Reviewed-by: Adam Langley <agl@google.com>
2016-01-03 08:57:37 +00:00
EC,129,ENCODE_ERROR
Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,104,GROUP2PKPARAMETERS_FAILURE
Rewrite ECPrivateKey serialization. Functions which lose object reuse and need auditing: - d2i_ECParameters - d2i_ECPrivateKey This adds a handful of bytestring-based APIs to handle EC key serialization. Deprecate all the old serialization APIs. Notes: - An EC_KEY has additional state that controls its encoding, enc_flags and conv_form. conv_form is left alone, but enc_flags in the new API is an explicit parameter. - d2i_ECPrivateKey interpreted its T** argument unlike nearly every other d2i function. This is an explicit EC_GROUP parameter in the new function. - The new specified curve code is much stricter and should parse enough to uniquely identify the curve. - I've not bothered with a new version of i2d_ECParameters. It just writes an OID. This may change later when decoupling from the giant OID table. - Likewise, I've not bothered with new APIs for the public key since the EC_POINT APIs should suffice. - Previously, d2i_ECPrivateKey would not call EC_KEY_check_key and it was possible for the imported public and private key to mismatch. It now calls it. BUG=499653 Change-Id: I30b4dd2841ae76c56ab0e1808360b2628dee0615 Reviewed-on: https://boringssl-review.googlesource.com/6859 Reviewed-by: Adam Langley <agl@google.com>
2016-01-03 08:57:37 +00:00
EC,130,GROUP_MISMATCH
Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,105,I2D_ECPKPARAMETERS_FAILURE
EC,106,INCOMPATIBLE_OBJECTS
Always use Fermat's Little Theorem in ecdsa_sign_setup. The case where ec_group_get_mont_data is NULL is only for arbitrary groups which we now require to be prime order. BN_mod_exp_mont is fine with a NULL BN_MONT_CTX. It will just compute it. Saves a bit of special-casing. Also don't mark p-2 as BN_FLG_CONSTTIME as the exponent is public anyway. Change-Id: Ie868576d52fc9ae5f5c9f2a4039a729151bf84c7 Reviewed-on: https://boringssl-review.googlesource.com/8307 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 19:58:36 +01:00
EC,131,INVALID_COFACTOR
Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,107,INVALID_COMPRESSED_POINT
EC,108,INVALID_COMPRESSION_BIT
EC,109,INVALID_ENCODING
EC,110,INVALID_FIELD
EC,111,INVALID_FORM
EC,112,INVALID_GROUP_ORDER
EC,113,INVALID_PRIVATE_KEY
Make ECDSA signing 10% faster and plug some timing leaks. None of the asymmetric crypto we inherented from OpenSSL is constant-time because of BIGNUM. BIGNUM chops leading zeros off the front of everything, so we end up leaking information about the first word, in theory. BIGNUM functions additionally tend to take the full range of inputs and then call into BN_nnmod at various points. All our secret values should be acted on in constant-time, but k in ECDSA is a particularly sensitive value. So, ecdsa_sign_setup, in an attempt to mitigate the BIGNUM leaks, would add a couple copies of the order. This does not work at all. k is used to compute two values: k^-1 and kG. The first operation when computing k^-1 is to call BN_nnmod if k is out of range. The entry point to our tuned constant-time curve implementations is to call BN_nnmod if the scalar has too many bits, which this causes. The result is both corrections are immediately undone but cause us to do more variable-time work in the meantime. Replace all these computations around k with the word-based functions added in the various preceding CLs. In doing so, replace the BN_mod_mul calls (which internally call BN_nnmod) with Montgomery reduction. We can avoid taking k^-1 out of Montgomery form, which combines nicely with Brian Smith's trick in 3426d1011946b26ff1bb2fd98a081ba4753c9cc8. Along the way, we avoid some unnecessary mallocs. BIGNUM still affects the private key itself, as well as the EC_POINTs. But this should hopefully be much better now. Also it's 10% faster: Before: Did 15000 ECDSA P-224 signing operations in 1069117us (14030.3 ops/sec) Did 18000 ECDSA P-256 signing operations in 1053908us (17079.3 ops/sec) Did 1078 ECDSA P-384 signing operations in 1087853us (990.9 ops/sec) Did 473 ECDSA P-521 signing operations in 1069835us (442.1 ops/sec) After: Did 16000 ECDSA P-224 signing operations in 1064799us (15026.3 ops/sec) Did 19000 ECDSA P-256 signing operations in 1007839us (18852.2 ops/sec) Did 1078 ECDSA P-384 signing operations in 1079413us (998.7 ops/sec) Did 484 ECDSA P-521 signing operations in 1083616us (446.7 ops/sec) Change-Id: I2a25e90fc99dac13c0616d0ea45e125a4bd8cca1 Reviewed-on: https://boringssl-review.googlesource.com/23075 Reviewed-by: Adam Langley <agl@google.com>
2017-11-13 03:58:00 +00:00
EC,133,INVALID_SCALAR
Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,114,MISSING_PARAMETERS
EC,115,MISSING_PRIVATE_KEY
EC,116,NON_NAMED_CURVE
EC,117,NOT_INITIALIZED
EC,118,PKPARAMETERS2GROUP_FAILURE
EC,119,POINT_AT_INFINITY
EC,120,POINT_IS_NOT_ON_CURVE
Fix check_fips for public keys and synchronize the EC and RSA versions. Change-Id: Ibebf787445578608845df8861d67cd1e65ed0b35 Reviewed-on: https://boringssl-review.googlesource.com/15004 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-13 18:14:12 +01:00
EC,132,PUBLIC_KEY_VALIDATION_FAILED
Get rid of err function codes. Running make_errors.go every time a function is renamed is incredibly tedious. Plus we keep getting them wrong. Instead, sample __func__ (__FUNCTION__ in MSVC) in the OPENSSL_PUT_ERROR macro and store it alongside file and line number. This doesn't change the format of ERR_print_errors, however ERR_error_string_n now uses the placeholder "OPENSSL_internal" rather than an actual function name since that only takes the uint32_t packed error code as input. This updates err scripts to not emit the function string table. The OPENSSL_PUT_ERROR invocations, for now, still include the extra parameter. That will be removed in a follow-up. BUG=468039 Change-Id: Iaa2ef56991fb58892fa8a1283b3b8b995fbb308d Reviewed-on: https://boringssl-review.googlesource.com/5275 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 04:36:21 +01:00
EC,121,SLOT_FULL
EC,122,UNDEFINED_GENERATOR
EC,123,UNKNOWN_GROUP
EC,124,UNKNOWN_ORDER
EC,127,WRONG_CURVE_PARAMETERS
EC,125,WRONG_ORDER
Reference in New Issue Copy Permalink