e443a79334
- revert SSL_read() behavior change - patch from upstream (#1394677) - EC curve NIST P-224 is now allowed, still kept disabled in TLS due to less than optimal security
102 lines
3.9 KiB
Diff
102 lines
3.9 KiB
Diff
diff -up openssl-1.1.0/apps/speed.c.curves openssl-1.1.0/apps/speed.c
|
|
--- openssl-1.1.0/apps/speed.c.curves 2016-09-08 11:03:15.550585422 +0200
|
|
+++ openssl-1.1.0/apps/speed.c 2016-09-08 11:05:17.287315488 +0200
|
|
@@ -536,42 +536,18 @@ static OPT_PAIR rsa_choices[] = {
|
|
#define R_EC_X25519 16
|
|
#ifndef OPENSSL_NO_EC
|
|
static OPT_PAIR ecdsa_choices[] = {
|
|
- {"ecdsap160", R_EC_P160},
|
|
- {"ecdsap192", R_EC_P192},
|
|
{"ecdsap224", R_EC_P224},
|
|
{"ecdsap256", R_EC_P256},
|
|
{"ecdsap384", R_EC_P384},
|
|
{"ecdsap521", R_EC_P521},
|
|
- {"ecdsak163", R_EC_K163},
|
|
- {"ecdsak233", R_EC_K233},
|
|
- {"ecdsak283", R_EC_K283},
|
|
- {"ecdsak409", R_EC_K409},
|
|
- {"ecdsak571", R_EC_K571},
|
|
- {"ecdsab163", R_EC_B163},
|
|
- {"ecdsab233", R_EC_B233},
|
|
- {"ecdsab283", R_EC_B283},
|
|
- {"ecdsab409", R_EC_B409},
|
|
- {"ecdsab571", R_EC_B571},
|
|
{NULL}
|
|
};
|
|
|
|
static OPT_PAIR ecdh_choices[] = {
|
|
- {"ecdhp160", R_EC_P160},
|
|
- {"ecdhp192", R_EC_P192},
|
|
{"ecdhp224", R_EC_P224},
|
|
{"ecdhp256", R_EC_P256},
|
|
{"ecdhp384", R_EC_P384},
|
|
{"ecdhp521", R_EC_P521},
|
|
- {"ecdhk163", R_EC_K163},
|
|
- {"ecdhk233", R_EC_K233},
|
|
- {"ecdhk283", R_EC_K283},
|
|
- {"ecdhk409", R_EC_K409},
|
|
- {"ecdhk571", R_EC_K571},
|
|
- {"ecdhb163", R_EC_B163},
|
|
- {"ecdhb233", R_EC_B233},
|
|
- {"ecdhb283", R_EC_B283},
|
|
- {"ecdhb409", R_EC_B409},
|
|
- {"ecdhb571", R_EC_B571},
|
|
{"ecdhx25519", R_EC_X25519},
|
|
{NULL}
|
|
};
|
|
diff -up openssl-1.1.0c/crypto/ec/ecp_smpl.c.curves openssl-1.1.0c/crypto/ec/ecp_smpl.c
|
|
--- openssl-1.1.0c/crypto/ec/ecp_smpl.c.curves 2016-11-10 15:03:44.000000000 +0100
|
|
+++ openssl-1.1.0c/crypto/ec/ecp_smpl.c 2016-11-11 13:31:51.329603626 +0100
|
|
@@ -144,6 +144,11 @@ int ec_GFp_simple_group_set_curve(EC_GRO
|
|
return 0;
|
|
}
|
|
|
|
+ if (BN_num_bits(p) < 224) {
|
|
+ ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD);
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
if (ctx == NULL) {
|
|
ctx = new_ctx = BN_CTX_new();
|
|
if (ctx == NULL)
|
|
diff -up openssl-1.1.0/ssl/t1_lib.c.curves openssl-1.1.0/ssl/t1_lib.c
|
|
--- openssl-1.1.0/ssl/t1_lib.c.curves 2016-09-08 11:03:15.551585445 +0200
|
|
+++ openssl-1.1.0/ssl/t1_lib.c 2016-09-08 11:06:58.072575697 +0200
|
|
@@ -177,36 +177,12 @@ static const unsigned char eccurves_all[
|
|
0, 23, /* secp256r1 (23) */
|
|
0, 25, /* secp521r1 (25) */
|
|
0, 24, /* secp384r1 (24) */
|
|
- 0, 26, /* brainpoolP256r1 (26) */
|
|
- 0, 27, /* brainpoolP384r1 (27) */
|
|
- 0, 28, /* brainpool512r1 (28) */
|
|
|
|
/*
|
|
* Remaining curves disabled by default but still permitted if set
|
|
* via an explicit callback or parameters.
|
|
*/
|
|
0, 22, /* secp256k1 (22) */
|
|
- 0, 14, /* sect571r1 (14) */
|
|
- 0, 13, /* sect571k1 (13) */
|
|
- 0, 11, /* sect409k1 (11) */
|
|
- 0, 12, /* sect409r1 (12) */
|
|
- 0, 9, /* sect283k1 (9) */
|
|
- 0, 10, /* sect283r1 (10) */
|
|
- 0, 20, /* secp224k1 (20) */
|
|
- 0, 21, /* secp224r1 (21) */
|
|
- 0, 18, /* secp192k1 (18) */
|
|
- 0, 19, /* secp192r1 (19) */
|
|
- 0, 15, /* secp160k1 (15) */
|
|
- 0, 16, /* secp160r1 (16) */
|
|
- 0, 17, /* secp160r2 (17) */
|
|
- 0, 8, /* sect239k1 (8) */
|
|
- 0, 6, /* sect233k1 (6) */
|
|
- 0, 7, /* sect233r1 (7) */
|
|
- 0, 4, /* sect193r1 (4) */
|
|
- 0, 5, /* sect193r2 (5) */
|
|
- 0, 1, /* sect163k1 (1) */
|
|
- 0, 2, /* sect163r1 (2) */
|
|
- 0, 3, /* sect163r2 (3) */
|
|
};
|
|
|
|
static const unsigned char suiteb_curves[] = {
|