399 Commits

Author SHA1 Message Date
Brian Smith
bbf935c17b Switch Poly1305 implementation to the BoringSSL implementation.
Previously the OpenSSL implementation was being used. Switch to the BoringSSL
version.

Switching to the BoringSSL implementation will make it easier to refactor the CPU feature
detection, which is important for upcoming ports.

This switch will also implicitly add support for BTI and pointer authentication for
Poly1305.

This is based on BoringSSL 63d06626d3a104868eee622e8e56d9f2dd643366.
2020-11-17 10:19:30 -08:00
Brian Smith
3ac3e8b020 CI/CD: Test wasm32-unknown-unknown in GitHub Actions.
Bump the wasm-bindgen-test dependency version to be compatible with
the latest wasm-bindgen-cli version.
2020-11-10 17:12:46 -08:00
francescocarzaniga
3dbfb785a8 Update Cargo.toml
Add illumos support.
2020-10-12 17:27:06 -07:00
Brian Smith
796ef8e83a Split aead::nonce into aead::{counter, iv, nonce}. 2020-07-05 12:36:03 -05:00
Brian Smith
1e971371d2 0.16.15 2020-06-16 18:26:52 -05:00
Brian Smith
7f5bc42d3f Add doc/link-to-readme.md to the published crate.
Cargo may start requiring the readme to be in the published crate.
2020-06-15 16:06:04 -05:00
Brian Smith
ef7cf3bfc5 Merge BoringSSL 47b1e39: Tidy up third_party/fiat. 2020-06-02 14:02:26 -05:00
Brian Smith
dbd606f142 0.16.4. 2020-05-30 01:00:07 -05:00
Brian Smith
fae863956b bigint: Replace GFp_bn_mul_add_word with GFp_limbs_mul_add_limb.
Replace `GFp_bn_mul_add_word` with a clearer, simpler implementation.
The new `GFp_limbs_mul_add_limb` avoid explicit branches at the C code
level, unlike the code it replaces. (Obviously, even with the new
"branchless" code the compiler might be able to synthesize branches.)
2020-05-29 21:07:20 -05:00
Brian Smith
0e7fdf5e91 Split ASSERT into dev_assert_secret and debug_assert_nonsecret. 2020-05-29 13:23:29 -05:00
Brian Smith
0c5f61b14f Merge BoringSSL c556d87: Add aes_nohw.c fallback AES implementation.
Add the BoringSSL aes_nohw implementation with minimal changes needed to
build. Enable the AES-GCM AEAD tests for wasm32 targets gated on the "wasm_c"
feature.
2020-05-28 10:51:03 -05:00
Brian Smith
10c4b68e63 Add new "wasm32_c" feature to enable more functionality for wasm32 targets. 2020-05-27 14:59:52 -05:00
Brian Smith
12c02bfa04 Add tests specifically for constant_time::verify_slices_are_equal. 2020-05-27 14:59:52 -05:00
Brian Smith
e2543e48d0 AES: Import ARMv7 VPAES implementation from BoringSSL.
Use the VPAES implementation from BoringSSL as of commit c556d87ddfe836294c8e04fc59d0c298951a4cc7,
with the 192-bit key handling and decryption removed.

Merge the VPAES and BSAES cases to VPAES_BSAES. Switch between the VPAES and BSAES implementation
on ARMv7 based on the amount of data being encrypted.

Clarify the dispatching logic in `ring::aead::aes`. In particular, avoid using `_` patterns
when matching on the result of `detect_implementation()`. Also rename Fallback to NOHW.
2020-05-21 18:44:42 -05:00
Brian Smith
192d946b82 Replace gcm_nohw.c with gcm_nohw.rs. 2020-05-06 10:57:33 -05:00
Brian Smith
d3cab43a4a Merge BoringSSL 9855c1c: Add a constant-time fallback GHASH
implementation.

*ring* tries to work without type-punning `memcpy`, so the use of that
in `GFp_gcm_ghash_nohw` was replaced by the use of `u64_from_be_bytes`.
This will (I hope) also help with the eventual support for big-endian
targets. Here's the diff from BoringSSL in that function:

```diff
-void gcm_ghash_nohw(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
-                    size_t len) {
+void GFp_gcm_ghash_nohw(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
+                        size_t len) {
   uint64_t swapped[2];
   swapped[0] = CRYPTO_bswap8(Xi[1]);
   swapped[1] = CRYPTO_bswap8(Xi[0]);

   while (len >= 16) {
-    uint64_t block[2];
-    OPENSSL_memcpy(block, inp, 16);
-    swapped[0] ^= CRYPTO_bswap8(block[1]);
-    swapped[1] ^= CRYPTO_bswap8(block[0]);
+    swapped[0] ^= u64_from_be_bytes(&inp[8]);
+    swapped[1] ^= u64_from_be_bytes(inp);
     gcm_polyval_nohw(swapped, &Htable[0]);
     inp += 16;
     len -= 16;
```

I also had to add a couple of (uint32_t) truncating casts where
BoringSSL expects an implicit truncation to occur, to avoid
`-Werror=conversion`.

During the merge, I found that `GFp_gcm_gmult_clmul` had its
`.cfi_startproc` on the wrong line. I fixed that as part of the merge.

During my review of the BoringSSL changes, I noticed that BoringSSL had
left some of the dead code in ghash-x86_64.pl, which had previously been
removed in *ring*. That removal is being done in BoringSSL in [1].

[1] https://boringssl-review.googlesource.com/c/boringssl/+/41144
2020-05-04 10:54:19 -05:00
Brian Smith
2f8b7e7568 Remove unused aes128gcmsiv-x86_64.pl. 2020-05-01 10:40:21 -05:00
Brian Smith
521218897a 0.16.13: Update all dependencies. 2020-04-29 12:20:20 -05:00
Sean Klein
0feaae0ad3 [cargo] Remove no-op 'exclude' field
From
https://doc.rust-lang.org/cargo/reference/manifest.html#the-exclude-and-include-fields

"The options are mutually exclusive: setting include will override an
exclude."

I agree to license my contributions to each file under the terms given
at the top of each file I changed.
2020-04-27 19:40:52 -05:00
Brian Smith
0ac6ca6cbc Switch dev_urandom_fallback to use once_cell instead of lazy_static!.
This is a step towards removing the spin-rs dependency. `lazy_static!`'s
conditial use of spin-rs based on a feature flag was particularly problematic
because often other dependencies would enable that feature flag even in cases
where the `std::sync::Once` implementation was preferable.
2020-04-27 18:51:23 -05:00
Brian Smith
7fc553dbbb 0.16.12. 2020-03-27 11:38:53 -05:00
Brian Smith
da4f7ba2b9 0.16.11. 2020-02-04 12:53:19 -06:00
Brian Smith
5a131ff450 0.16.10. 2020-01-31 10:44:05 -06:00
Brian Smith
56cddd73d2 0.16.9. 2019-08-30 05:48:12 -10:00
Brian Smith
e7db166ca9 0.16.8: Depend on spin-rs ^0.5.2.
spin-rs 0.5.2 fixes a bug in `rw_lock`. That bug doesn't seem to affect *ring* based
on the bug report and the fix PR, since *ring* uses only `spin::Once` and the fix
for the bug doesn't touch `spin::Once` at all. (I manually verified `spin::Once`
doesn't depend on `spin::rw_lock` at all.) Still, upgrade so that people don't get
scared and to avoid various inconveniences.
2019-08-30 05:39:37 -10:00
Brian Smith
fe1a947b59 0.16.7: & -> &dyn in agreement_tests.rs to fix beta/nightly build. 2019-08-11 16:08:00 -10:00
Brian Smith
5c36a93e4d 0.16.6 2019-08-11 14:49:23 -10:00
Brian Smith
5d32f5bf75 0.16.5 2019-07-26 10:22:50 -10:00
Brian Smith
68f1509f9f 0.16.4 2019-07-24 17:58:09 -10:00
Brian Smith
85007f838f 0.16.3 2019-07-24 13:37:17 -10:00
Brian Smith
d8724ef357 0.16.2 2019-07-23 10:27:19 -10:00
Brian Smith
e6102197e4 0.16.1 2019-07-22 12:26:25 -10:00
Brian Smith
ab18f6ebcd 0.16.0 2019-07-18 15:34:17 -10:00
Brian Smith
4c392ad338 Remove the libc dependency for most platforms. 2019-07-17 14:44:28 -10:00
Brian Smith
bc22053bdf Make std a non-default feature.
Dont enable `std`-based functionality unless requested. This requires removing
the `std` feature dependency from `dev_urandom_fallback` and `test_logging`.
Tweak the meaning of `test_logging` to keep this tractable.
2019-07-15 22:03:17 -10:00
Brian Smith
dd60763446 Use untrusted 0.7.0. 2019-07-15 17:49:40 -10:00
Brian Smith
70e5d96a37 FreeBSD, NetBSD, OpenBSD, Solaris: Use /dev/urandom. 2019-07-15 17:30:40 -10:00
Brian Smith
d9044d6f57 0.15.0 2019-07-14 08:51:19 -10:00
Brian Smith
b582a420ce 0.15.0-alpha6. 2019-07-13 15:14:10 -10:00
Brian Smith
2903aeca8a 0.15.0-alpha4 2019-07-11 19:47:52 -10:00
Brian Smith
feabcc7705 Upgrade to wasm-bindgen 0.2.48. 2019-07-11 19:34:29 -10:00
Brian Smith
9c42fa187d Allow tests to be run when alloc is enabled without std. 2019-07-09 21:15:18 -10:00
Brian Smith
7071dda618 Replace use_heap feature with alloc and std features; use alloc crate. 2019-07-09 21:15:18 -10:00
Brian Smith
d367526a27 Remove 32-bit x86 SHA-2 assembly code. 2019-07-09 17:25:46 -10:00
Brian Smith
957934286d 0.15.0-alpha3. 2019-07-03 12:43:53 -10:00
Brian Smith
d8921f39a2 0.15.0-alpha2. 2019-07-03 12:20:01 -10:00
Brian Smith
f86911d3b5 Use untrusted 0.7.0-alpha1. 2019-07-03 12:20:01 -10:00
Brian Smith
89a56db450 Fix typo in Cargo.toml. 2019-07-03 12:20:00 -10:00
Brian Smith
c53955ea8a Initial wasm32-unknown-unknown support. 2019-07-03 12:20:00 -10:00
Brian Smith
33bffc7cef Minimize and update dependencies. 2019-07-03 08:28:42 -10:00