Age | Commit message (Collapse) | Author |
|
|
|
The current crypto module implementations require all of the data
being encrypted or authenticated to be in memory at one time. When
trying to encrypt or authenticate a large file (on order of GBs),
this is problematic.
The implementation of AES CTR uses the same underlying implementation
as aes_ctr_[en|de]crypt, but hands the state back to the client
after every operation.
The HMAC implementation differs from the previous implementations of
sha_mac and md5_mac. The old implementations did not utilize the
OpenSSL HMAC implementation. In order to ensure that I didn't
implement something incorrectly, I chose to use the OpenSSL HMAC
implementation directly, since it handles streaming as well. This
has the added side benefit of allowing other hash functions to be
used as desired (for instances, I added support for ripemd160
hashing).
While I haven't done this, it seems like the existing md5_mac and
sha_mac functions could either be depricated or redefined in terms
of the new hmac_ functions.
Update AES CTR and HMAC streaming with code review input
Ensure that memcpy operations in hmac operations are being size
checked properly. Rename aes_ctr_XXX_with_state to
aes_ctr_stream_XXX. Remove redundant hmac_init_[sha|md5|ripemd160]
functions. Fix documentation for hmac_final_n.
Fix possible error using negative value as a marker on an unsigned int
Now, use a separate marker and add a unit test to test specifically for
a case where HashLen is larger than the underlying resultant hash.
Revert "Fix possible error using negative value as a marker on an unsigned int"
This reverts commit 59cb177aa96444c0fd3ace6d01f7b8a70dd69cc9.
Resolve buffer overflow posibility on an unsigned int.
Change handling the marker for HashLen to use the fact that a second
parameter that has to be the the HashLen was passed. Also, ensure
that HashLen parameter is positive.
|
|
|
|
Added some checks in crypto.erl and crypto.c.
Changed ssh_bits to use strong_rand_mpint.
|
|
|
|
Also adds documentation and unit tests.
Thanks to Geoff Cant.
|
|
* bd/doc_fixes2:
Fix mistake in blowfish_ebc_en/decrypt docs
Compile fixes for earlier documentation fixes
Various small documentation fixes
OTP-9172
|
|
|
|
This change fixes a bunch of small (and a few less small) typos and
other errors in various modules that I've spotted throughout my travels.
|
|
* hw/call-chmod-without-f:
Call chmod without the "-f" flag
Conflicts:
erts/emulator/test/Makefile
lib/asn1/test/Makefile
lib/crypto/test/Makefile
lib/debugger/test/Makefile
lib/docbuilder/test/Makefile
lib/edoc/test/Makefile
lib/erl_interface/test/Makefile
lib/inviso/test/Makefile
lib/parsetools/test/Makefile
lib/percept/test/Makefile
lib/ssl/test/Makefile
lib/syntax_tools/test/Makefile
lib/test_server/test/Makefile
lib/tools/test/Makefile
OTP-9170
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
"-f" is a non-standard chmod option which at least SGI IRIX and HP UX do
not support. As the only effect of the "-f" flag is to suppress warning
messages, it can be safely omitted.
|
|
|
|
|
|
The NIF library for crypto can now be built for valgrind
and/or debug as separate NIF libraries that will be
automatically loaded if the runtime system has been built
with a matching build type.
|
|
|
|
|
|
Changed return types from "binary" to "binary()"
for md5_mac, md5_mac_96, sha_mac and sha_mac_96.
|
|
|
|
New variants of crypto:dss_sign and crypto:dss_verify with an extra
argument to control how the digest is calculated.
|
|
* commit 'bg/nif_error':
crypto: Add type specs for all documented functions
crypto: Use erlang:nif_error/1 to squelch false Dialyzer warnings
Add erlang:nif_error/1,2
|
|
New NIF features:
Send messages from a NIF, or from thread created by NIF, to any local
process (enif_send)
Store terms between NIF calls (enif_alloc_env, enif_make_copy)
Create binary terms with user defined memory management
(enif_make_resource_binary)
|
|
|
|
|
|
crypto application changed to use NIFs instead of driver.
|
|
Don't use the deprecated concat_binary/1 BIF in test suites
that don't specifically test concat_binary/1 itself.
|
|
* au/crypto:
Add missing docs for crypto:md4/1
Add des_ecb_encrypt/2 and des_ecb_decrypt/2 to crypto module
OTP-8551 au/crypto
des_ecb_encrypt/2 and des_ecb_decrypt/2 has been added to the crypto
module. The crypto:md4/1 function has been documented.
|
|
|
|
|
|
|
|
* kr/crypto_makefile:
Fix Makefile permission problem of crypto library on FreeBSD Erlang/OTP building
|
|
This patch changes INSTALL_PROGRAM to INSTALL_DATA for the Makefile at
lib/crypto/priv/obj, which discontinues the building procedure of Erlang/OTP
on FreeBSD. Originally posted by Giacomo Olgeni as a part of FreeBSD port
patch files.
See
http://www.erlang.org/cgi-bin/ezmlm-cgi?3:mss:335:200811:hijljjocpmpkhgkhfkdl
for the detailed analysis.
|
|
improvements.
Most notable:
Lots of cross compilation improvements. The old cross compilation
support was more or less non-existing as well as broken. Please,
note that the cross compilation support should still be
considered as experimental. Also note that old cross compilation
configurations cannot be used without modifications. For more
information on cross compiling Erlang/OTP see the
$ERL_TOP/xcomp/README file.
Support for staged install using <url
href="http://www.gnu.org/prep/standards/html_node/DESTDIR.html">D
ESTDIR</url>. The old broken INSTALL_PREFIX has also been fixed.
For more information see the $ERL_TOP/README file.
Documentation of the release target of the top Makefile. For more
information see the $ERL_TOP/README file.
make install now by default creates relative symbolic links
instead of absolute ones. For more information see the
$ERL_TOP/README file.
$ERL_TOP/configure --help=recursive now works and prints help for
all applications with configure scripts.
Doing make install, or make release directly after make all no
longer triggers miscellaneous rebuilds.
Existing bootstrap system is now used when doing make install, or
make release without a preceding make all.
The crypto and ssl applications use the same runtime library path
when dynamically linking against libssl.so and libcrypto.so. The
runtime library search path has also been extended.
The configure scripts of erl_interface and odbc now search for
thread libraries and thread library quirks the same way as erts
do.
The configure script of the odbc application now also looks for
odbc libraries in lib64 and lib/64 directories when building on a
64-bit system.
The config.h.in file in the erl_interface application is now
automatically generated in instead of statically updated which
reduces the risk of configure tests without any effect.
|
|
environment after a number of bugs are fixed and some features
are added in the documentation build process.
- The arity calculation is updated.
- The module prefix used in the function names for bif's are
removed in the generated links so the links will look like
http://www.erlang.org/doc/man/erlang.html#append_element-2
instead of
http://www.erlang.org/doc/man/erlang.html#erlang:append_element-2
- Enhanced the menu positioning in the html documentation when a
new page is loaded.
- A number of corrections in the generation of man pages (thanks
to Sergei Golovan)
- Moved some man pages to more apropriate sections, pages in
section 4 moved to 5 and pages in 6 moved to 7.
- The legal notice is taken from the xml book file so OTP's
build process can be used for non OTP applications.
|
|
|
|
* po/blowfish_ecb_cbc_ofb-rebased:
Add Blowfish tests
Add Blowfish ECB, CBC and OFB modes
OTP-8331 The crypto module now supports Blowfish in ECB, CBC and OFB
modes. (Thanks to Paul Oliver.)
|
|
|
|
My previous patch added CFB mode. This patch adds all remaining
Blowfish modes. According to the man page
http://www.fifi.org/cgi-bin/man2html/usr/share/man/man3/blowfish.3ssl.gz
these are available in all versions of OpenSSL.
[ Squashed in elimination of signed/unsigned compiler warnings. /bg ]
|