Merge branch 'ia/ssl/public_key/crypto/elliptic_curve/OTP-11009' into maint

* ia/ssl/public_key/crypto/elliptic_curve/OTP-11009: (21 commits)
  ssl: Do not advertise EC ciphers if crypto support is insufficient
  crypto: Ctify tests and test new API
  crypto: Allow integer as srp_private arguments according to docs
  ssl: Remove unused `srp_parameters` type spec
  crypto, public_key & ssl: Make more functions accept integer keys
  snmp: Remove use of deprecated crypto functions
  crypto,ssh, netconf, inets: binary_to_integer -> bytes_to_integer
  netconf: Remove use of deprecated crypto functions
  crypto: Documentation fixes from review
  crypto: Change argument order of crypto:next_iv/3
  crypto,public_key,ssl: Change return value of crypto:generate_key(ecdh,..)
  ssl, public_key, crypto: crypto:algorithms/0 -> crypto:supports/0
  ssl, public_key & inets: Remove use of deprecated crypto functions from test code
  ssl: Remove use of deprecated crypto functions
  public_key: Remove use of deprecated crypto functions
  dialyzer: Remove use of deprecated crypto functions
  ssh & crypto: Remove use of deprecated crypto functions from ssh
  Update primary bootstrap
  common_test: Replace use of deprecated crypto functions
  beam_lib, compile: Replace use of deprecated crypto functions
  ...

2 files changed, 45 insertions, 36 deletions

diff --git a/lib/snmp/src/agent/snmp_user_based_sm_mib.erl b/lib/snmp/src/agent/snmp_user_based_sm_mib.erl
index 3c4ba1af66..e675cf1b83 100644
--- a/lib/snmp/src/agent/snmp_user_based_sm_mib.erl
+++ b/lib/snmp/src/agent/snmp_user_based_sm_mib.erl
@@ -1,7 +1,7 @@
 %% 
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 1999-2012. All Rights Reserved.
+%% Copyright Ericsson AB 1999-2013. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -214,12 +214,12 @@ check_user(User) ->
     case element(?usmUserAuthProtocol, User) of
 	?usmNoAuthProtocol -> ok;
 	?usmHMACMD5AuthProtocol ->
-	    case is_crypto_supported(md5_mac_96) of
+	    case is_crypto_supported(md5) of
 		true -> ok;
 		false -> exit({unsupported_crypto, md5_mac_96})
 	    end;
 	?usmHMACSHAAuthProtocol ->
-	    case is_crypto_supported(sha_mac_96) of
+	    case is_crypto_supported(sha) of
 		true -> ok;
 		false -> exit({unsupported_crypto, sha_mac_96})
 	    end
@@ -227,14 +227,14 @@ check_user(User) ->
     case element(?usmUserPrivProtocol, User) of
 	?usmNoPrivProtocol -> ok;
 	?usmDESPrivProtocol ->
-	    case is_crypto_supported(des_cbc_decrypt) of
+	    case is_crypto_supported(des_cbc) of
 		true -> ok;
-		false -> exit({unsupported_crypto, des_cbc_decrypt})
+		false -> exit({unsupported_crypto, des_cbc})
 	    end;
 	?usmAesCfb128Protocol ->
-	    case is_crypto_supported(aes_cfb_128_decrypt) of
+	    case is_crypto_supported(aes_cfb128) of
 		true -> ok;
-		false -> exit({unsupported_crypto, aes_cfb_128_decrypt})
+		false -> exit({unsupported_crypto, aes_cfb128})
 	    end
     end.
     
@@ -874,13 +874,13 @@ validate_auth_protocol(RowIndex, Cols) ->
 				_ -> inconsistentValue(?usmUserAuthProtocol)
 			    end;
 			?usmHMACMD5AuthProtocol ->
-			    case is_crypto_supported(md5_mac_96) of
+			    case is_crypto_supported(md5) of
 				true -> ok;
 				false ->
 				    wrongValue(?usmUserAuthProtocol)
 			    end;
 			?usmHMACSHAAuthProtocol ->
-			    case is_crypto_supported(sha_mac_96) of
+			    case is_crypto_supported(sha) of
 				true -> ok;
 				false ->
 				    wrongValue(?usmUserAuthProtocol)
@@ -1008,7 +1008,7 @@ validate_priv_protocol(RowIndex, Cols) ->
 			?usmDESPrivProtocol ->
 			    %% The 'catch' handles the case when 'crypto' is
 			    %% not present in the system.
-			    case is_crypto_supported(des_cbc_decrypt) of
+			    case is_crypto_supported(des_cbc) of
 				true ->
 				    case get_auth_proto(RowIndex, Cols) of
 					?usmNoAuthProtocol ->
@@ -1022,7 +1022,7 @@ validate_priv_protocol(RowIndex, Cols) ->
 			?usmAesCfb128Protocol ->
 			    %% The 'catch' handles the case when 'crypto' is
 			    %% not present in the system.
-			    case is_crypto_supported(aes_cfb_128_decrypt) of
+			    case is_crypto_supported(aes_cfb128) of
 				true ->
 				    case get_auth_proto(RowIndex, Cols) of
 					?usmNoAuthProtocol ->
@@ -1164,7 +1164,7 @@ mk_key_change(Hash, OldKey, NewKey) ->
 %% case in the standard where Random is pre-defined.
 mk_key_change(Alg, OldKey, NewKey, KeyLen, Random) ->
     %% OldKey and Random is of length KeyLen...
-    Digest = lists:sublist(binary_to_list(crypto:Alg(OldKey++Random)), KeyLen),
+    Digest = lists:sublist(binary_to_list(crypto:hash(Alg, OldKey++Random)), KeyLen),
     %% ... and so is Digest
     Delta = snmp_misc:str_xor(Digest, NewKey),
     Random ++ Delta.
@@ -1181,7 +1181,7 @@ extract_new_key(Hash, OldKey, KeyChange) ->
 	      sha -> sha
 	  end,
     {Random, Delta} = split(KeyLen, KeyChange, []),
-    Digest = lists:sublist(binary_to_list(crypto:Alg(OldKey++Random)), KeyLen),
+    Digest = lists:sublist(binary_to_list(crypto:hash(Alg, OldKey++Random)), KeyLen),
     NewKey = snmp_misc:str_xor(Digest, Delta),
     NewKey.
 
@@ -1219,10 +1219,13 @@ split(N, [H | T], FirstRev) when N > 0 ->
     split(N-1, T, [H | FirstRev]).
 
 
-is_crypto_supported(Func) ->
+is_crypto_supported(Algo) ->
     %% The 'catch' handles the case when 'crypto' is
     %% not present in the system (or not started).
-    case catch lists:member(Func, crypto:info()) of
+    Supported = crypto:supports(),
+    Hashs = proplists:get_value(hashs, Supported),
+    Ciphers = proplists:get_value(ciphers, Supported),
+    case catch lists:member(Algo, Hashs ++ Ciphers) of
 	true -> true;
 	_ -> false
     end.
diff --git a/lib/snmp/src/misc/snmp_usm.erl b/lib/snmp/src/misc/snmp_usm.erl
index df2c1f0b18..53c291ca0e 100644
--- a/lib/snmp/src/misc/snmp_usm.erl
+++ b/lib/snmp/src/misc/snmp_usm.erl
@@ -1,7 +1,7 @@
 %% 
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2013. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -69,7 +69,7 @@ passwd2localized_key(Alg, Passwd, EngineID) when length(Passwd) > 0 ->
 %%-----------------------------------------------------------------
 localize_key(Alg, Key, EngineID) ->
     Str = [Key, EngineID, Key],
-    binary_to_list(crypto:Alg(Str)).
+    binary_to_list(crypto:hash(Alg, Str)).
 
 
 mk_digest(md5, Passwd) ->
@@ -78,25 +78,25 @@ mk_digest(sha, Passwd) ->
     mk_sha_digest(Passwd).
 
 mk_md5_digest(Passwd) ->
-    Ctx = crypto:md5_init(),
+    Ctx = crypto:hash_init(md5),
     Ctx2 = md5_loop(0, [], Ctx, Passwd, length(Passwd)),
-    crypto:md5_final(Ctx2).
+    crypto:hash_final(Ctx2).
 
 md5_loop(Count, Buf, Ctx, Passwd, PasswdLen) when Count < 1048576 ->
     {Buf64, NBuf} = mk_buf64(length(Buf), Buf, Passwd, PasswdLen),
-    NCtx = crypto:md5_update(Ctx, Buf64),
+    NCtx = crypto:hash_update(Ctx, Buf64),
     md5_loop(Count+64, NBuf, NCtx, Passwd, PasswdLen);
 md5_loop(_Count, _Buf, Ctx, _Passwd, _PasswdLen) ->
     Ctx.
 
 mk_sha_digest(Passwd) ->
-    Ctx = crypto:sha_init(),
+    Ctx = crypto:hash_init(sha),
     Ctx2 = sha_loop(0, [], Ctx, Passwd, length(Passwd)),
-    crypto:sha_final(Ctx2).
+    crypto:hash_final(Ctx2).
 
 sha_loop(Count, Buf, Ctx, Passwd, PasswdLen) when Count < 1048576 ->
     {Buf64, NBuf} = mk_buf64(length(Buf), Buf, Passwd, PasswdLen),
-    NCtx = crypto:sha_update(Ctx, Buf64),
+    NCtx = crypto:hash_update(Ctx, Buf64),
     sha_loop(Count+64, NBuf, NCtx, Passwd, PasswdLen);
 sha_loop(_Count, _Buf, Ctx, _Passwd, _PasswdLen) ->
     Ctx.
@@ -147,7 +147,12 @@ md5_auth_out(AuthKey, Message, UsmSecParams) ->
     Packet = snmp_pdus:enc_message_only(Message2),
     %% 6.3.1.2-4 is done by the crypto function
     %% 6.3.1.4
-    MAC = binary_to_list(crypto:md5_mac_96(AuthKey, Packet)),
+    MAC = binary_to_list(crypto:hmac(md5, AuthKey, Packet, 12)),
+    ?vtrace("md5_auth_out -> entry with"
+    	    "~n   Packet:    ~w"
+     	    "~n   AuthKey:   ~w"
+     	    "~n   MAC:       ~w"
+    , [Packet, AuthKey, MAC]),
     %% 6.3.1.5
     set_msg_auth_params(Message, UsmSecParams, MAC).
 
@@ -155,13 +160,14 @@ md5_auth_in(AuthKey, AuthParams, Packet) when length(AuthParams) == 12 ->
     %% 6.3.2.3
     Packet2 = patch_packet(binary_to_list(Packet)),
     %% 6.3.2.5
-    MAC = binary_to_list(crypto:md5_mac_96(AuthKey, Packet2)),
+    MAC = binary_to_list(crypto:hmac(md5, AuthKey, Packet2, 12)),
     %% 6.3.2.6
-%%     ?vtrace("md5_auth_in -> entry with"
-%% 	    "~n   Packet2:    ~w"
-%% 	    "~n   AuthKey:    ~w"
-%% 	    "~n   AuthParams: ~w"
-%% 	    "~n   MAC:        ~w", [Packet2, AuthKey, AuthParams, MAC]),
+    ?vtrace("md5_auth_in -> entry with"
+     	    "~n   Packet2:    ~w"
+     	    "~n   AuthKey:    ~w"
+     	    "~n   AuthParams: ~w"
+     	    "~n   MAC:        ~w"
+     	    , [Packet2, AuthKey, AuthParams, MAC]),
     MAC == AuthParams;
 md5_auth_in(_AuthKey, _AuthParams, _Packet) ->
     %% 6.3.2.1
@@ -177,7 +183,7 @@ sha_auth_out(AuthKey, Message, UsmSecParams) ->
     Packet = snmp_pdus:enc_message_only(Message2),
     %% 7.3.1.2-4 is done by the crypto function
     %% 7.3.1.4
-    MAC = binary_to_list(crypto:sha_mac_96(AuthKey, Packet)),
+    MAC = binary_to_list(crypto:hmac(sha, AuthKey, Packet, 12)),
     %% 7.3.1.5
     set_msg_auth_params(Message, UsmSecParams, MAC).
 
@@ -185,7 +191,7 @@ sha_auth_in(AuthKey, AuthParams, Packet) when length(AuthParams) =:= 12 ->
     %% 7.3.2.3
     Packet2 = patch_packet(binary_to_list(Packet)),
     %% 7.3.2.5
-    MAC = binary_to_list(crypto:sha_mac_96(AuthKey, Packet2)),
+    MAC = binary_to_list(crypto:hmac(sha, AuthKey, Packet2, 12)),
     %% 7.3.2.6
     MAC == AuthParams;
 sha_auth_in(_AuthKey, _AuthParams, _Packet) ->
@@ -203,7 +209,7 @@ des_encrypt(PrivKey, Data, SaltFun) ->
     IV = list_to_binary(snmp_misc:str_xor(PreIV, Salt)),
     TailLen = (8 - (length(Data) rem 8)) rem 8,
     Tail = mk_tail(TailLen),
-    EncData = crypto:des_cbc_encrypt(DesKey, IV, [Data,Tail]),
+    EncData = crypto:block_encrypt(des_cbc, DesKey, IV, [Data,Tail]),
     {ok, binary_to_list(EncData), Salt}.
 
 des_decrypt(PrivKey, MsgPrivParams, EncData) 
@@ -217,7 +223,7 @@ des_decrypt(PrivKey, MsgPrivParams, EncData)
     Salt = MsgPrivParams,
     IV = list_to_binary(snmp_misc:str_xor(PreIV, Salt)),
     %% Whatabout errors here???  E.g. not a mulitple of 8!
-    Data = binary_to_list(crypto:des_cbc_decrypt(DesKey, IV, EncData)),
+    Data = binary_to_list(crypto:block_decrypt(des_cbc, DesKey, IV, EncData)),
     Data2 = snmp_pdus:strip_encrypted_scoped_pdu_data(Data),
     {ok, Data2};
 des_decrypt(PrivKey, BadMsgPrivParams, EncData) ->
@@ -235,7 +241,7 @@ aes_encrypt(PrivKey, Data, SaltFun) ->
     EngineBoots = snmp_framework_mib:get_engine_boots(),
     EngineTime = snmp_framework_mib:get_engine_time(),
     IV = list_to_binary([?i32(EngineBoots), ?i32(EngineTime) | Salt]),
-    EncData = crypto:aes_cfb_128_encrypt(AesKey, IV, Data),
+    EncData = crypto:block_encrypt(aes_cbf128, AesKey, IV, Data),
     {ok, binary_to_list(EncData), Salt}.
 
 aes_decrypt(PrivKey, MsgPrivParams, EncData, EngineBoots, EngineTime)
@@ -244,7 +250,7 @@ aes_decrypt(PrivKey, MsgPrivParams, EncData, EngineBoots, EngineTime)
     Salt = MsgPrivParams,
     IV = list_to_binary([?i32(EngineBoots), ?i32(EngineTime) | Salt]),
     %% Whatabout errors here???  E.g. not a mulitple of 8!
-    Data = binary_to_list(crypto:aes_cfb_128_decrypt(AesKey, IV, EncData)),
+    Data = binary_to_list(crypto:block_decrypt(aes_cbf128, AesKey, IV, EncData)),
     Data2 = snmp_pdus:strip_encrypted_scoped_pdu_data(Data),
     {ok, Data2}.