eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,361 Commits 11 Branches 57 Tags
master
Commit Graph
5 Commits
Author SHA1 Message Date
mohammadmseet-hue d37c95e27d pkcs12: limit PBKDF iteration count to prevent CPU exhaustion 
The PKCS#12 PBKDF iteration count is read directly from
the input file with no upper bound. A crafted 83-byte .p12
file can set iterations to 2^31-1 (2147483647), causing
Decode() to block a CPU core permanently.

This change adds a maximum iteration limit of 1000000 in
both verifyMac and pbDecrypterFor. Any file that specifies
more iterations than this cap is rejected with an error.

For reference, OpenSSL caps PBKDF2 at 10000000 iterations,
and scrypt is bounded by its memory-hardness parameters.
The 1000000 limit is generous for legitimate PKCS#12 files
while still preventing denial of service.

Fixes golang/go#78524

Change-Id: I1d12d6f5d90e347ca0dc113678abc51b0cff8d85
GitHub-Last-Rev: a0370d492dd4735cc7c1bb082b359ad79863fdae
GitHub-Pull-Request: golang/crypto#343
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/759900
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 2026-06-04 06:58:05 -07:00
cuishuang 4a75ba54c2 all: make function and struct comments match the names 
Change-Id: Iba9c1fc2895adca0d3455f8068b040d0ca006408
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/639575
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Ian Lance Taylor <iant@google.com>
 2025-01-02 08:15:46 -08:00
cui fliter 4161e89ecf all: replace bytes.Compare with bytes.Equal 
Change-Id: I911366b91ff2a1d02d7de202a166d876fb873142
GitHub-Last-Rev: f50e00376856fb9da36bb98ed0cdfd96c2f3b304
GitHub-Pull-Request: golang/crypto#233
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/438536
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Run-TryBot: Ian Lance Taylor <iant@google.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
 2022-10-05 02:52:14 +00:00
namusyaka b0c9c05bfe all: fix article typos 
a -> an

Change-Id: I95a940df64cb825887b75a80eadc822095b49781
Reviewed-on: https://go-review.googlesource.com/63991
Run-TryBot: Alex Vaghin <ddos@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Vaghin <ddos@google.com>
 2017-09-15 13:46:28 +00:00
Paul Meyer c8b9e6388e x/crypto: Add pkcs12 package for reading pkcs12 data 
Package pkcs12 provides some Go implementations of PKCS#12.
This implementation is distilled from https://tools.ietf.org/html/rfc7292 and
referenced documents. It is intented for decoding P12/PFX-stored certificate+key
for use with the crypto/tls package.

Package includes @dgryski's RC2 implementation as a sub package as requested in
https://github.com/golang/go/issues/10621.

Change-Id: I78401241e39cd0099e9082a3a227cf0a3a36e6d1
Reviewed-on: https://go-review.googlesource.com/11986
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
 2015-10-04 18:58:11 +00:00