summaryrefslogtreecommitdiffstats
path: root/src/crypto
Commit message (Collapse)AuthorAgeFilesLines
...
* [crypto] Generalise X.509 OID-identified algorithm to asn1.cMichael Brown2012-03-223-95/+129
| | | | | | | | The concept of an OID-identified algorithm as defined in X.509 is used in some other standards (e.g. PKCS#7). Generalise this functionality and provide it as part of the ASN.1 core. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Validate path length constraint in certificate chainMichael Brown2012-03-211-0/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use standard bit-rotation functionsMichael Brown2012-03-213-33/+3Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Allow a client certificate to be specified at build timeMichael Brown2012-03-201-0/+80
| | | | | | | | | | | | | | | | | | | Allow a client certificate and corresponding private key to be specified at build time using the syntax make CERT=/path/to/certificate KEY=/path/to/key The build process uses openssl to convert the files into DER format, and includes them within the client certificate store in clientcert.c. The build process will prompt for the private key password if applicable. Note that the private key is stored unencrypted, and so the resulting iPXE binary (and the temporary files created during the build process) should be treated as being equivalent to an unencrypted private key file. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use linker tables for RSA digestInfo prefixesMichael Brown2012-03-201-37/+26Star
| | | | | | | Allow external code to specify RSA digestInfo prefixes for additional digest algorithms. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Check certificate validity period against current date and timeMichael Brown2012-03-201-7/+41
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Parse X.509 validity times into seconds since the EpochMichael Brown2012-03-201-12/+14
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Add full X.509 certificate parsingMichael Brown2012-03-192-23/+1206
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rsa] Actually check the unused-bits byte in the public key bit stringMichael Brown2012-03-181-3/+4
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Force caller to provide temporary storage for modular calculationsMichael Brown2012-03-182-26/+43
| | | | | | | | | | | | | bigint_mod_multiply() and bigint_mod_exp() require a fixed amount of temporary storage for intermediate results. (The amount of temporary storage required depends upon the size of the integers involved.) When performing calculations for 4096-bit RSA the amount of temporary storage space required will exceed 2.5kB, which is too much to allocate on the stack. Avoid this problem by forcing the caller to allocate temporary storage. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow entropy_enable() to return an errorMichael Brown2012-03-181-1/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Remove obsolete AXTLS RSA algorithmMichael Brown2012-03-182-1782/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Use iPXE native RSA algorithmMichael Brown2012-03-181-142/+14Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add native RSA algorithmMichael Brown2012-03-182-0/+600
| | | | | | Add an implementation of RSA that uses the iPXE big-integer support. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add abstraction for a public-key algorithmMichael Brown2012-03-181-0/+49
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add more ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-182-2/+106
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Fix build error when assertions are enabledMichael Brown2012-03-181-2/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use real prototypes for AXTLS' AES_encrypt() and AES_decrypt()Michael Brown2012-03-141-3/+3
| | | | | | | | Avoid a compiler warning on some versions of gcc by using real function prototypes. Reported-by: Rob Shelley <Rob@cirris.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add big-integer library for RSA calculationsMichael Brown2012-03-142-0/+122
| | | | | | | | | | | | | | RSA requires modular exponentiation using arbitrarily large integers. Given the sizes of the modulus and exponent, all required calculations can be done without any further dynamic storage allocation. The x86 architecture allows for efficient large integer support via inline assembly using the instructions that take advantage of the carry flag (e.g. "adcl", "rcrl"). This implemention is approximately 80% smaller than the (more generic) AXTLS implementation. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add ASN.1 functions for X.509 certificate parsingMichael Brown2012-03-131-5/+57
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Remove obsolete (and unfinished) get_random_bytes() functionMichael Brown2012-03-131-55/+0Star
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Upgrade AES and RSA code to upstream axTLS version 1.4.5Michael Brown2012-03-0910-602/+504Star
| | | | | | | | | All axTLS files are now vanilla versions of the upstream axTLS files, with one minor exception: the unused "ctx" parameter of bi_int_divide() has been marked with "__unused" to avoid a compilation error. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow HMAC_DRBG to use multiple underlying hash algorithmsMichael Brown2012-03-061-59/+73
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Allow hash_df() to accept multiple underlying hash algorithmsMichael Brown2012-03-062-9/+11
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Replace MD5 implementationMichael Brown2012-03-051-180/+242
| | | | | | | Replace MD5 implementation with one which is around 20% smaller. This implementation has been verified using the existing MD5 self-tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add SHA-256 algorithmMichael Brown2012-03-051-0/+254
| | | | | | This implementation has been verified using the NIST SHA-256 test vectors. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Replace SHA-1 implementationMichael Brown2012-03-043-265/+270
| | | | | | | | | Replace SHA-1 implementation from AXTLS with a dedicated iPXE implementation which is around 40% smaller. This implementation has been verified using the existing SHA-1 self-tests (including the NIST SHA-1 test vectors). Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Eliminate use of AXTLS-specific SHA1_SIZE constantMichael Brown2012-03-041-16/+17
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add missing #include <assert.h>Michael Brown2012-03-042-0/+2
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Use ANS X9.82 Approved get_random_nz() for RSAMichael Brown2012-02-211-2/+9
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add get_random_nz() function required by RSA algorithmMichael Brown2012-02-211-0/+75
| | | | | | | | | RSA requires the generation of random non-zero bytes (i.e. a sequence of random numbers in the range [0x01,0xff]). ANS X9.82 provides various Approved methods for converting random bits into random numbers. The simplest such method is the Simple Discard Method. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 RBG wrapper functionsMichael Brown2012-02-211-0/+114
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 mandatory start-up testsMichael Brown2012-02-211-0/+32
| | | | | | | ANS X9.82 specifies that the start-up tests shall consist of at least one full cycle of the continuous tests. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 mandatory continuous testsMichael Brown2012-02-211-1/+295
| | | | | | | ANS X9.82 specifies two mandatory continuous tests to be performed upon the noise source. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved Source of Entropy InputMichael Brown2012-02-213-15/+152
| | | | | | | | | | | | | | | | ANS X9.82 specifies several Approved Sources of Entropy Input (SEI). One such SEI uses an entropy source as the Source of Entropy Input, condensing each entropy source output after each GetEntropy call. This can be implemented relatively cheaply in iPXE and avoids the need to allocate potentially very large buffers. (Note that the terms "entropy source" and "Source of Entropy Input" are not synonyms within the context of ANS X9.82.) Use the iPXE API mechanism to allow entropy sources to be selected at compilation time. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Record validity within DRBG stateMichael Brown2012-02-211-4/+13
| | | | | | | | Treat an empty (zeroed) DRBG as invalid. This ensures that a DRBG that has not yet been instantiated (or that has been uninstantiated) will refuse to attempt to generate random bits. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add missing #include <string.h>Michael Brown2012-02-213-0/+3
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [802.11] Add missing #include <string.h>Michael Brown2012-02-211-0/+1
| | | | Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved Hash_df derivation functionMichael Brown2012-02-191-0/+134
| | | | | | | | | ANS X9.82 specifies several Approved derivation functions for use in distributing entropy throughout a buffer. One such derivation function is Hash_df, which can be implemented using the existing iPXE SHA-1 functionality. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved DRBG mechanismMichael Brown2012-01-231-0/+416
| | | | | | | | | ANS X9.82 specifies that an Approved DRBG must consist of an Approved algorithm wrapped inside an envelope which handles entropy gathering, prediction resistance, automatic reseeding and other housekeeping tasks. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add dummy entropy sourceMichael Brown2012-01-231-0/+48
| | | | | | | | | | | Cryptographic random number generation requires an entropy source, which is used as the input to a Deterministic Random Bit Generator (DRBG). iPXE does not currently have a suitable entropy source. Provide a dummy source to allow the DRBG code to be implemented. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [rng] Add ANS X9.82 Approved HMAC_DRBG algorithmMichael Brown2012-01-231-0/+342
| | | | | | | | | | ANS X9.82 specifies several Approved algorithms for use in a Deterministic Random Bit Generator (DRBG). One such algorithm is HMAC_DRBG, which can be implemented using the existing iPXE SHA-1 and HMAC functionality. This algorithm provides a maximum security strength of 128 bits. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [tls] Accept certificates without a version numberMichael Brown2011-08-132-28/+49
| | | | | | | The version field of an X.509 certificate appears to be optional. Reported-by: Sebastiano Manusia <Sebastiano.Manusia@chuv.ch> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [legal] Add FILE_LICENCE macro to some GPL-v2-or-later filesShao Miller2010-12-043-0/+6
| | | | | | | | | Changes were made to files where the licence text within the files themselves confirms that the files are GPL version 2 or later. Signed-off-by: Shao Miller <shao.miller@yrdsb.edu.on.ca> Modified-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [build] Rename gPXE to iPXEMichael Brown2010-04-2014-26/+26
| | | | | | | | | | | Access to the gpxe.org and etherboot.org domains and associated resources has been revoked by the registrant of the domain. Work around this problem by renaming project from gPXE to iPXE, and updating URLs to match. Also update README, LOG and COPYRIGHTS to remove obsolete information. Signed-off-by: Michael Brown <mcb30@ipxe.org>
* [crypto] Add a placeholder for a proper random number generatorJoshua Oreman2010-01-051-0/+55
| | | | | | Currently it just calls random(). Signed-off-by: Marty Connor <mdc@etherboot.org>
* [crypto] Add AES key-wrap mode (RFC 3394)Joshua Oreman2010-01-051-0/+123
| | | | | | | The unwrapping half is used by WPA2 code; the wrapping half is currently unused. Signed-off-by: Marty Connor <mdc@etherboot.org>
* [crypto] Make AES context size and algorithm structure externally availableJoshua Oreman2010-01-051-12/+1Star
| | | | | | This is required to support modes of AES beyond cipher-block chaining. Signed-off-by: Marty Connor <mdc@etherboot.org>
* [digest] Add HMAC-SHA1 based pseudorandom function and PBKDF2Joshua Oreman2010-01-051-0/+165
| | | | | | | Both of these routines are used by 802.11 WPA, but they are generic and could be needed by other protocols as well. Signed-off-by: Marty Connor <mdc@etherboot.org>
* [cipher] Add the ARC4 stream cipherJoshua Oreman2010-01-051-0/+131
| | | | Signed-off-by: Marty Connor <mdc@etherboot.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-02-27 18:00:11 +0100