Commit Graph

134 Commits (50cb33e688ab6bef3f73d35e3360421578db8a46)

Author SHA1 Message Date
Dmitry Belyavskiy a8a3a389ee Use KAT for ECDSA signature tests, s390 arch
2 years ago
Clemens Lang 96926ffe00 Revert "Disable EVP_PKEY_sign/EVP_PKEY_verify in FIPS mode"
2 years ago
Dmitry Belyavskiy 794d81540e CVE-2022-1292 openssl: c_rehash script allows command injection
2 years ago
Dmitry Belyavskiy a63915eb2b CVE-2022-1343 openssl: inacurate verification when using OCSP_NOCHECKS
2 years ago
Dmitry Belyavskiy ac312e8ff7 CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
2 years ago
Dmitry Belyavskiy b5de6bd830 In FIPS mode limit key sizes for signature verification
2 years ago
Dmitry Belyavskiy 7bc4f9f094 Ciphersuites with RSA KX should be filterd in FIPS mode
2 years ago
Dmitry Belyavskiy b393177f7d `openssl ecparam -list_curves` lists only FIPS-approved curves in FIPS mode
2 years ago
Clemens Lang 389313b118 FIPS: Disable SHA1 signs and EVP_PKEY_{sign,verify}
2 years ago
Dmitry Belyavskiy 87f109e9fb Use KAT for ECDSA signature tests
2 years ago
Dmitry Belyavskiy 69c1abb4df openssl req defaults on PKCS#8 encryption changed to AES-256-CBC
2 years ago
Dmitry Belyavskiy b4d281e4de -config argument of openssl app should work properly
2 years ago
Dmitry Belyavskiy 1b2d08b2c2 Adaptation of upstream patches disabling explicit EC parameters in FIPS mode
2 years ago
Clemens Lang 1447e64bc3 Include hash in FIPS module version
2 years ago
Dmitry Belyavskiy ad863e9fc8 OpenSSL FIPS module should not build in non-approved algorithms
2 years ago
Dmitry Belyavskiy 6ba0e5efa3 When FIPS provider is in use, we forbid only some padding modes - spec
2 years ago
Clemens Lang 9afaa3d1f4 Fix regression in evp_pkey_name2type caused by tr_TR locale fix
2 years ago
Dmitry Belyavskiy a711ac2e4f Fix openssl curl error with LANG=tr_TR.utf8
2 years ago
Dmitry Belyavskiy 7a1c7b28bc FIPS provider doesn't block RSA encryption for key transport
3 years ago
Clemens Lang 93ff3f8fe5 Fix occasional internal error in TLS when DHE is used
3 years ago
Clemens Lang 153f593fa6 Fix SHA1 certs in LEGACY without openssl lib ctxt
3 years ago
Clemens Lang 4eb630f7d5 Fix TLS connections with SHA1 signatures if rh-allow-sha1-signatures = yes
3 years ago
Dmitry Belyavskiy 03697fff80 CVE-2022-0778 fix
3 years ago
Clemens Lang bc7dfd9722 Fix RSA PSS padding with SHA-1 disabled
3 years ago
Clemens Lang 3c66c99bd5 Allow SHA1 in seclevel 2 if rh-allow-sha1-signatures = yes
3 years ago
Clemens Lang ede38fcb54 Prevent use of SHA1 with ECDSA
3 years ago
Dmitry Belyavskiy ea9f0a5726 OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters
3 years ago
Peter Robinson 849a9965ee Support KBKDF (NIST SP800-108) with an R value of 8bits Resolves: rhbz#2027261
3 years ago
Clemens Lang 53f53fedec Allow SHA1 usage in MGF1 for RSASSA-PSS signatures
3 years ago
Dmitry Belyavskiy b33dfd3fc3 Spec bump
3 years ago
Clemens Lang 5a9ab1160e Allow SHA1 usage in HMAC in TLS
3 years ago
Dmitry Belyavskiy 53b85f538c OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters
3 years ago
Clemens Lang 78fb78d307 Disable SHA1 signature creation and verification by default
3 years ago
Sahana Prasad 0a5c81da78 s_server: correctly handle 2^14 byte long records
3 years ago
Dmitry Belyavskiy 922b5301ea Adjust FIPS provider version
3 years ago
Dmitry Belyavskiy 8c3b745547 On the s390x, zeroize all the copies of TLS premaster secret
3 years ago
Dmitry Belyavskiy 92e721fa5d Rebuild
3 years ago
Dmitry Belyavskiy d237e7f301 Restoring fips=yes to SHA-1
3 years ago
Dmitry Belyavskiy 9df33eabbe KATS self-tests should run before HMAC verifcation
3 years ago
Sahana Prasad f5421022ee Adds enable-buildtest-c++ to the configure options.
3 years ago
Sahana Prasad 78a467efcc Rebase to upstream version 3.0.1
3 years ago
Dmitry Belyavskiy e63c4b68b2 Update spec file, remove fipsmodule.cnf
3 years ago
Dmitry Belyavskiy 225b6d37b9 openssl speed should run in FIPS mode
3 years ago
Dmitry Belyavskiy 4c1c00d6af Updated spec, some cleanup done
3 years ago
Dmitry Belyavskiy 9422ae52de Always activate default provider via config
3 years ago
Dmitry Belyavskiy 210c37e906 Disable fipsinstall application
3 years ago
Dmitry Belyavskiy 3ff0db7558 Embed correct HMAC into fips provider
3 years ago
Dmitry Belyavskiy 694c426faf Fix memory leak in s_client
3 years ago
Dmitry Belyavskiy b76c2316a3 KTLS and FIPS may interfere, so tests need to be tuned
3 years ago
Dmitry Belyavskiy 3edf474b5d Avoid double-free on error seeding the RNG.
3 years ago
Sahana Prasad 34d46544a5 Rebase to upstream version 3.0.0
3 years ago
Sahana Prasad 07de966235 - Removes the dual-abi build as it not required anymore. The mass rebuild
3 years ago
Dmitry Belyavskiy ddd1eb3708 Correctly processing CMS reading from /dev/stdin
3 years ago
Sahana Prasad 49de59749c Add instruction for loading legacy provider in openssl.cnf
3 years ago
Sahana Prasad 03899fca38 Adds support for IDEA encryption.
3 years ago
Sahana Prasad 0c6f4a599c - Fixes core dump in openssl req -modulus
3 years ago
Mohan Boddu 2862adca42 Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
3 years ago
Dmitry Belyavskiy ecb6630fd3 When signature_algorithm extension is omitted, use more relevant alerts
3 years ago
Sahana Prasad fe7445d93d Rebase to upstream version beta2
3 years ago
Sahana Prasad 0b6afca185 - Prevents creation of duplicate cert entries in PKCS #12 files
3 years ago
Sahana Prasad e3d0ba4f1e NVR Bump to Update to OpenSSL 3.0 Beta1 version
3 years ago
Sahana Prasad 529b968a17 Update patch dual-abi.patch to add the #define macros in implementation
3 years ago
Sahana Prasad a3158ae4f7 Removes unused patch dual-abi.patch
3 years ago
Sahana Prasad d4e97b3110 Update to Beta1 version
3 years ago
Sahana Prasad 90bf702df6 - Fixes override of openssl_conf in openssl.cnf
3 years ago
Sahana Prasad 4f728a9f3f Fixes override of openssl_conf in openssl.cnf
3 years ago
Sahana Prasad 826e7990ea Adds FIPS mode compatibility patch
3 years ago
Sahana Prasad 240131b9eb - Fixes system hang issue when booted in FIPS mode
3 years ago
Mohan Boddu 220d8a96f5 Spec bump and changelog for Speeding up building openssl
3 years ago
Dmitry Belyavskiy b0a763c723 Speeding up building openssl
3 years ago
Sahana Prasad e863fff325 Fix reading SPKAC data from stdin
3 years ago
Sahana Prasad 5fa0564b3a Enable FIPS via config options
3 years ago
Sahana Prasad ef962954ab Update to alpha 16 version
3 years ago
Sahana Prasad eeabdb936d Merge gitlab.com:redhat/centos-stream/rpms/openssl into c9s
3 years ago
Sahana Prasad 007b0e01a9 Update to alpha 15 version
3 years ago
Mohan Boddu 620c697740 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
3 years ago
Sahana Prasad ec7ef62793 Rebase to OpenSSL version 3.0.0
3 years ago
DistroBaker 098f88f008 Merged update from upstream sources
4 years ago
DistroBaker efa5f39ef0 Merged update from upstream sources
4 years ago
DistroBaker f731f488ac Merged update from upstream sources
4 years ago
DistroBaker 6cc21a3e02 Merged update from upstream sources
4 years ago
DistroBaker e33651f416 Merged update from upstream sources
4 years ago
DistroBaker a99ab8f40a Merged update from upstream sources
4 years ago
Petr Šabata 16459847f1 RHEL 9.0.0 Alpha bootstrap
4 years ago