summaryrefslogtreecommitdiff
path: root/src/fips.c
AgeCommit message (Collapse)AuthorFilesLines
2016-03-18ecc: ECDSA adjustments for FIPS 186-4Vitezslav Cizek1-1/+1
* cipher/ecc-curves.c: Unmark curve P-192 for FIPS. * cipher/ecc.c: Add ECDSA self test. * cipher/pubkey-util.c (_gcry_pk_util_init_encoding_ctx): Use SHA-2 in FIPS mode. * tests/fipsdrv.c: Add support for ECDSA signatures. -- Enable ECC in FIPS mode. According to NIST SP 800-131A, curve P-192 and SHA-1 are disallowed for key pair generation and signature generation after 2013. Thanks to Jan Matejek for the patch. Signed-off-by: Vitezslav Cizek <vcizek@suse.com> Minor source code re-formatting by -wk.
2015-11-17Fix typos found using codespellJustus Winter1-2/+2
* cipher/cipher-ocb.c: Fix typos. * cipher/des.c: Likewise. * cipher/dsa-common.c: Likewise. * cipher/ecc.c: Likewise. * cipher/pubkey.c: Likewise. * cipher/rsa-common.c: Likewise. * cipher/scrypt.c: Likewise. * random/random-csprng.c: Likewise. * random/random-fips.c: Likewise. * random/rndw32.c: Likewise. * src/cipher-proto.h: Likewise. * src/context.c: Likewise. * src/fips.c: Likewise. * src/gcrypt.h.in: Likewise. * src/global.c: Likewise. * src/sexp.c: Likewise. * tests/mpitests.c: Likewise. * tests/t-lock.c: Likewise. Signed-off-by: Justus Winter <justus@g10code.com>
2015-08-08Add framework to eventually support SHA3.Werner Koch1-0/+4
* src/gcrypt.h.in (GCRY_MD_SHA3_224, GCRY_MD_SHA3_256) (GCRY_MD_SHA3_384, GCRY_MD_SHA3_512): New. (GCRY_MAC_HMAC_SHA3_224, GCRY_MAC_HMAC_SHA3_256) (GCRY_MAC_HMAC_SHA3_384, GCRY_MAC_HMAC_SHA3_512): New. * cipher/keccak.c: New with stub functions. * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add keccak.c. * configure.ac (available_digests): Add sha3. (USE_SHA3): New. * src/fips.c (run_hmac_selftests): Add SHA3 to the required selftests. * cipher/md.c (digest_list) [USE_SHA3]: Add standard SHA3 algos. (md_open): Ditto for hmac processing. * cipher/mac-hmac.c (map_mac_algo_to_md): Add mapping. * cipher/hmac-tests.c (run_selftests): Prepare for tests. * cipher/pubkey-util.c (get_hash_algo): Add "sha3-xxx". -- Note that the algo GCRY_MD_SHA3_xxx are prelimanry. We should try to sync them with OpenPGP. Signed-off-by: Werner Koch <wk@gnupg.org>
2014-01-16Replace ath based mutexes by gpgrt based locks.Werner Koch1-11/+10
* configure.ac (NEED_GPG_ERROR_VERSION): Require 1.13. (gl_LOCK): Remove. * src/ath.c, src/ath.h: Remove. Remove from all files. Replace all mutexes by gpgrt based statically initialized locks. * src/global.c (global_init): Remove ath_init. (_gcry_vcontrol): Make ath install a dummy function. (print_config): Remove threads info line. * doc/gcrypt.texi: Simplify the multi-thread related documentation. -- The current code does only work on ELF systems with weak symbol support. In particular no locks were used under Windows. With the new gpgrt_lock functions from the soon to be released libgpg-error 1.13 we have a better portable scheme which also allows for static initialized mutexes. Signed-off-by: Werner Koch <wk@gnupg.org>
2014-01-13Use internal malloc function in fips.cWerner Koch1-1/+1
* src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/. -- This fixes a build problem with ENABLE_HMAC_BINARY_CHECK. Reported-by: Michal Vyskocil.
2013-12-12Add a configuration file to disable hardware features.Werner Koch1-1/+1
* src/hwfeatures.c: Inclyde syslog.h and ctype.h. (HWF_DENY_FILE): New. (my_isascii): New. (parse_hwf_deny_file): New. (_gcry_detect_hw_features): Call it. * src/mpicalc.c (main): Correctly initialize Libgcrypt. Add options "--print-config" and "--disable-hwf". Signed-off-by: Werner Koch <wk@gnupg.org>
2013-12-12Remove macro hacks for internal vs. external functions. Part 2 and last.Werner Koch1-1/+1
* src/visibility.h: Remove remaining define/undef hacks for symbol visibility. Add macros to detect the use of the public functions. Change all affected functions by replacing them by the x-macros. * src/g10lib.h: Add internal prototypes. (xtrymalloc, xtrycalloc, xtrymalloc_secure, xtrycalloc_secure) (xtryrealloc, xtrystrdup, xmalloc, xcalloc, xmalloc_secure) (xcalloc_secure, xrealloc, xstrdup, xfree): New macros. -- The use of xmalloc/xtrymalloc/xfree is a more common pattern than the gcry_free etc. functions. Those functions behave like those defined by C and thus for better readability we use these macros and not the underscore prefixed functions. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-09-23pk: Add algo id GCRY_PK_ECC and deprecate ECDSA and ECDH.Werner Koch1-1/+1
* src/gcrypt.h.in (GCRY_PK_ECC): New. * cipher/pubkey.c (map_algo): New. (spec_from_algo, gcry_pk_get_param, _gcry_pk_selftest): Use it. * cipher/ecc.c (selftests_ecdsa): Report using GCRY_PK_ECC. (run_selftests): Simplify. (ecdh_names, ecdsa_names): Merge into a new ecc_names. (_gcry_pubkey_spec_ecdh, _gcry_pubkey_spec_ecdsa): Merge into new _gcry_pubkey_spec_ecc. -- The algo ids are actually a relict from Libgcrypt's former life as GnuPG's crypto code. They don't make much sense anymore and are often not needed. This patch requires some changes to the GnuPG 2.1 code (which has still not been released). For example the secret key transfer between gpg and gpg-agent (gpg --export and gpg --import). Fortunately this will also require to add usage flags to the secret key storage of gpg-agent which is is something we should have done a long time ago. Signed-off-by: Werner Koch <wk@gnupg.org>
2012-04-04Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command.Tomas Mraz1-0/+8
* doc/gcrypt.texi: Add documentation of the new command. * src/fips.c (_gcry_enforced_fips_mode): Report the enforced fips mode only when fips mode is enabled. (_gcry_set_enforced_fips_mode): New function. * src/g10lib.h: Add the _gcry_set_enforced_fips_mode prototype. * src/gcrypt.h.in: Add the GCRYCTL_SET_ENFORCED_FIPS_FLAG. * src/global.c (_gcry_vcontrol): Handle the new command.
2011-12-01Completed switch to a simpler thread model.Werner Koch1-1/+1
This is only a first step. We will need to either implement pthread_atfork or - better - make use use POSIX RT semaphores.
2011-02-04Nuked almost all trailing whitespace.Werner Koch1-33/+33
Check and install the standard git pre-commit hook.
2010-04-12Applied spelling fixes and more verbose test diagnositcs by Brad Hards.Werner Koch1-2/+2
2009-07-02Get more in sync to the Fedora version.Werner Koch1-0/+1
2009-01-22PreparingWerner Koch1-1/+1
2008-11-05Add a method to disable the weak key detection.Werner Koch1-2/+2
Add a method to return the current input block. Use this in the FIPS driver.
2008-10-24Do no restrtc usage of MD5 in fips mode.Werner Koch1-1/+54
2008-10-02Add CAVS test.Werner Koch1-0/+1
Various minor fixes. Sigbus fixes for AES.
2008-09-18Implemented an Enforced FIPS mode.Werner Koch1-6/+33
Documentation updates.
2008-09-16Allow transition to Error states from thye Init state.Werner Koch1-1/+3
2008-09-15Changed error text.Werner Koch1-1/+1
2008-09-15Log a failed intgetrity check with filename.Werner Koch1-0/+6
2008-09-15Use syslog to log important messages.Werner Koch1-0/+47
Add an external RNG test hook.
2008-09-12Only run required tests during power-up self-test.Werner Koch1-15/+16
Enter error state after a failed key generation tests.
2008-09-11Changed the HMAC binary check file format.Werner Koch1-15/+46
2008-09-11Implemented more self-tests.Werner Koch1-2/+4
2008-09-05Let the test suite run the selftests even in non-fips mode.Werner Koch1-5/+11
2008-08-29Overhauled the keygrip computation.Werner Koch1-3/+4
2008-08-27Allow getting out of the FIPS error state by running a self-test.Werner Koch1-1/+21
2008-08-26Implemented transient-key flag as requested by the GNUNet folks.Werner Koch1-3/+7
Documentation cleanups. Removed FIPS logging unless in double verbose state.
2008-08-22Completed the RNG implementaion switching.Werner Koch1-15/+75
Added framework for running RNG tests. Added an experimental option --enable-hmac-binary-check to configure. --This line, and those below, will be ignored-- M src/fips.c M src/cipher-proto.h M src/global.c M src/hmac256.c M src/ChangeLog M src/hmac256.h M src/Makefile.am M tests/Makefile.am M configure.ac M doc/gcrypt.texi M random/random-fips.c M random/random.c M random/rand-internal.h M random/random.h M random/ChangeLog M ChangeLog M README
2008-08-21Finished the X9.31 RNG implementations.Werner Koch1-0/+5
2008-08-20Replace assert calls by a new gcry_assert at most places.Werner Koch1-5/+4
2008-08-19Another forgotten file.Werner Koch1-0/+586
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-14 11:33:02 +0000