eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
894 Commits 11 Branches 57 Tags
06a226fb4e3765ef3f48aa2852b401bc7b98e981
Commit Graph
894 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Pasi Tähkäpää 06a226fb4e Use boolean tag (0x01) for boolean type. 
Fix for problem with ReadASN1Boolean, which uses invalid tag (Integer / 0x02) when trying to read boolean value. This is a fix for the one case mentioned in "x/crypto/cryptobyte: cannot read boolean values #26565"
This is specified in ITU-T X.690, section 8.2, with DER additions specified in 11.1.

Change-Id: I3c9406bd6febb6112f380224fec1d42a6cd64ed4
GitHub-Last-Rev: fd7d01c897d8aa32d92115be9017f84d75fc4467
GitHub-Pull-Request: golang/crypto#137
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/233161
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-05-10 22:35:06 +00:00
Michael Munday 4b2356b1ed poly1305: modify s390x assembly to implement MAC interface 
The vector (vx) implementation has been updated to read in the
state and update it - as opposed to being a single shot function.
This has allowed the new MAC interface can be implemented.

For performance reasons s390x uses a larger buffer than the generic
implementation. There is a relatively high fixed cost to read the
state, calculate the key coefficients and serialize the state, so
it makes sense to buffer more blocks before calling it.

For now I've had to remove the faster VMSL implementation. It is
too complex for me to update in time for Go 1.15. At some point
I'd like to revisit it but for now it looks like using the MAC
interface is more of a win than using VMSL.

The benchmarks show considerable improvements when using the MAC
interface. The Sum benchmarks show slowdown due to a combination
of the removal of the VMSL implementation and also the added
overhead from splitting the summation function into multiple parts.

poly1305:

name              old speed      new speed      delta
64                1.33GB/s ± 0%  0.80GB/s ± 1%   -39.51%  (p=0.000 n=16+20)
1K                4.04GB/s ± 0%  2.97GB/s ± 0%   -26.46%  (p=0.000 n=19+19)
2M                5.32GB/s ± 1%  3.63GB/s ± 0%   -31.76%  (p=0.000 n=20+19)
64Unaligned       1.33GB/s ± 0%  0.80GB/s ± 0%   -39.80%  (p=0.000 n=19+18)
1KUnaligned       4.09GB/s ± 1%  2.94GB/s ± 0%   -28.23%  (p=0.000 n=19+18)
2MUnaligned       5.33GB/s ± 1%  3.52GB/s ± 0%   -34.04%  (p=0.000 n=20+19)
Write64           1.03GB/s ± 1%  1.49GB/s ± 1%   +44.34%  (p=0.000 n=20+20)
Write1K           1.21GB/s ± 0%  3.24GB/s ± 0%  +169.02%  (p=0.000 n=20+17)
Write2M           1.24GB/s ± 1%  3.63GB/s ± 0%  +192.36%  (p=0.000 n=20+19)
Write64Unaligned  1.04GB/s ± 1%  1.50GB/s ± 0%   +44.16%  (p=0.000 n=19+14)
Write1KUnaligned  1.21GB/s ± 0%  3.20GB/s ± 0%  +164.55%  (p=0.000 n=20+16)
Write2MUnaligned  1.24GB/s ± 1%  3.51GB/s ± 0%  +183.96%  (p=0.000 n=20+19)

chacha20poly1305 (this vs. using generic MAC interface - post CL 206977):

name         old speed      new speed      delta
Open-64       147MB/s ± 2%   156MB/s ± 1%   +6.15%  (p=0.000 n=20+19)
Seal-64       151MB/s ± 0%   164MB/s ± 1%   +8.86%  (p=0.000 n=19+16)
Open-64-X     104MB/s ± 2%   111MB/s ± 1%   +6.24%  (p=0.000 n=20+20)
Seal-64-X     109MB/s ± 2%   111MB/s ± 1%   +2.11%  (p=0.000 n=20+19)
Open-1350     555MB/s ± 0%   751MB/s ± 1%  +35.19%  (p=0.000 n=20+20)
Seal-1350     557MB/s ± 0%   759MB/s ± 0%  +36.23%  (p=0.000 n=20+20)
Open-1350-X   517MB/s ± 1%   683MB/s ± 1%  +31.97%  (p=0.000 n=20+20)
Seal-1350-X   511MB/s ± 0%   683MB/s ± 0%  +33.77%  (p=0.000 n=18+19)
Open-8192     672MB/s ± 0%  1013MB/s ± 0%  +50.65%  (p=0.000 n=19+19)
Seal-8192     674MB/s ± 0%  1018MB/s ± 0%  +50.98%  (p=0.000 n=18+20)
Open-8192-X   663MB/s ± 0%   979MB/s ± 0%  +47.57%  (p=0.000 n=20+20)
Seal-8192-X   658MB/s ± 0%   985MB/s ± 0%  +49.62%  (p=0.000 n=18+20)

name         old allocs/op  new allocs/op  delta
Open-64          0.00           0.00          ~     (all equal)
Seal-64          0.00           0.00          ~     (all equal)
Open-64-X        0.00           0.00          ~     (all equal)
Seal-64-X        0.00           0.00          ~     (all equal)
Open-1350        0.00           0.00          ~     (all equal)
Seal-1350        0.00           0.00          ~     (all equal)
Open-1350-X      0.00           0.00          ~     (all equal)
Seal-1350-X      0.00           0.00          ~     (all equal)
Open-8192        0.00           0.00          ~     (all equal)
Seal-8192        0.00           0.00          ~     (all equal)
Open-8192-X      0.00           0.00          ~     (all equal)
Seal-8192-X      0.00           0.00          ~     (all equal)

chacha20poly1305 (this vs. using asm Sum interface - pre CL 206977):

name         old speed      new speed      delta
Open-64       144MB/s ± 0%   156MB/s ± 1%    +8.16%  (p=0.000 n=20+19)
Seal-64       150MB/s ± 0%   164MB/s ± 1%    +9.35%  (p=0.000 n=20+16)
Open-64-X     104MB/s ± 1%   111MB/s ± 1%    +6.15%  (p=0.000 n=19+20)
Seal-64-X     109MB/s ± 1%   111MB/s ± 1%    +1.43%  (p=0.000 n=19+19)
Open-1350     702MB/s ± 1%   751MB/s ± 1%    +6.98%  (p=0.000 n=20+20)
Seal-1350     715MB/s ± 0%   759MB/s ± 0%    +6.09%  (p=0.000 n=19+20)
Open-1350-X   642MB/s ± 0%   683MB/s ± 1%    +6.37%  (p=0.000 n=19+20)
Seal-1350-X   639MB/s ± 0%   683MB/s ± 0%    +6.98%  (p=0.000 n=20+19)
Open-8192     994MB/s ± 0%  1013MB/s ± 0%    +1.85%  (p=0.000 n=20+19)
Seal-8192    1.00GB/s ± 0%  1.02GB/s ± 0%    +1.90%  (p=0.000 n=20+20)
Open-8192-X   965MB/s ± 0%   979MB/s ± 0%    +1.43%  (p=0.000 n=19+20)
Seal-8192-X   962MB/s ± 0%   985MB/s ± 0%    +2.39%  (p=0.000 n=20+20)

name         old allocs/op  new allocs/op  delta
Open-64          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-64          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-64-X        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-64-X        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-1350        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-1350        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-1350-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-1350-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-8192        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-8192        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-8192-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-8192-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)

Updates golang/go#25219.

Change-Id: Ib491e3a47b6b3ec8bbbe1f41f7bf42ad82f5c249
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219057
Run-TryBot: Michael Munday <mike.munday@ibm.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-29 18:30:12 +00:00
Lily Chung 729f1e841b ssh: improve docs on Certificate.SignCert 
Document the fact that SignCert sets the Nonce field.  This makes it
clear that callers need not set it themselves.

Original change by Jakob Weisblat <jakobw@mit.edu> in CL 57051.

Fixes golang/go#21384

Change-Id: I161e0909ba6c8d07be5f8e68dc6e0f0392bea63f
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/230212
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-27 16:56:52 +00:00
Filippo Valsorda 4bdfaf469e chacha20: don't panic encrypting the final blocks 
Certain operations with counter values close to overflowing were causing
an unnecessary panic, which was reachable due to the SetCounter API and
actually observed in QUIC.

Tests by lukechampine <luke.champine@gmail.com> from CL 220591.

Fixes golang/go#37157

Relanding of CL 224279, which was broken on multi-block buffers.
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224279
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>

Change-Id: Ia382c6f62ae49ffe257b67f7b794e8d7124d981e
(cherry picked from commit 1c2c788b11)
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/229119
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-23 21:15:02 +00:00
Katie Hockman 18b771bd64 cryptobyte: handle AddASN1BigInt with -1 
Fixes golang/go#38510

Change-Id: Ie52db22bf85a5f79046fad95e5bbe2788c3bec92
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/229457
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-23 19:51:18 +00:00
Filippo Valsorda 44a6062868 poly1305: add (*MAC).Verify API and use it in chacha20poly1305 
Also, make sure New inlines so it does not cause an allocation. With
this, we have a zero allocation poly1305 flow and a zero allocation
generic chacha20poly1305 composition! \o/

While at it, remove some redundant code, and prepare to drop some
complexity once the last assembly implementation of sum is dropped.

Benchstat with "-tags purego" on amd64

name              old time/op    new time/op    delta
Open-64-8         461ns ± 2%     415ns ± 1%    -9.93%  (p=0.000 n=10+8)
Seal-64-8         450ns ± 3%     412ns ± 3%    -8.41%  (p=0.000 n=10+10)
Open-64-X-8       603ns ± 2%     544ns ± 2%    -9.84%  (p=0.000 n=10+10)
Seal-64-X-8       580ns ± 3%     553ns ± 1%    -4.56%  (p=0.000 n=9+8)
Open-1350-8      3.98µs ± 2%    3.65µs ± 2%    -8.28%  (p=0.000 n=9+10)
Seal-1350-8      3.95µs ± 2%    3.64µs ± 1%    -7.93%  (p=0.000 n=9+10)
Open-1350-X-8    4.06µs ± 1%    3.68µs ± 3%    -9.31%  (p=0.000 n=9+10)
Seal-1350-X-8    4.08µs ± 4%    3.64µs ± 1%   -10.71%  (p=0.000 n=9+10)
Open-8192-8      21.7µs ± 3%    18.9µs ± 2%   -13.10%  (p=0.000 n=9+10)
Seal-8192-8      21.5µs ± 3%    18.8µs ± 1%   -12.51%  (p=0.000 n=9+9)
Open-8192-X-8    21.4µs ± 1%    19.1µs ± 2%   -10.88%  (p=0.000 n=10+10)
Seal-8192-X-8    21.3µs ± 2%    19.0µs ± 3%   -10.92%  (p=0.000 n=10+10)

name              old speed      new speed      delta
Open-64-8       139MB/s ± 2%   154MB/s ± 2%   +11.05%  (p=0.000 n=10+8)
Seal-64-8       142MB/s ± 3%   155MB/s ± 3%    +9.11%  (p=0.000 n=10+10)
Open-64-X-8     106MB/s ± 2%   118MB/s ± 2%   +10.93%  (p=0.000 n=10+10)
Seal-64-X-8     110MB/s ± 3%   116MB/s ± 1%    +4.75%  (p=0.000 n=9+8)
Open-1350-8     339MB/s ± 2%   370MB/s ± 2%    +9.04%  (p=0.000 n=9+10)
Seal-1350-8     342MB/s ± 2%   371MB/s ± 1%    +8.60%  (p=0.000 n=9+10)
Open-1350-X-8   333MB/s ± 1%   367MB/s ± 3%   +10.30%  (p=0.000 n=9+10)
Seal-1350-X-8   331MB/s ± 4%   371MB/s ± 2%   +11.96%  (p=0.000 n=9+10)
Open-8192-8     377MB/s ± 3%   434MB/s ± 2%   +15.07%  (p=0.000 n=9+10)
Seal-8192-8     381MB/s ± 3%   436MB/s ± 1%   +14.29%  (p=0.000 n=9+9)
Open-8192-X-8   383MB/s ± 1%   429MB/s ± 2%   +12.21%  (p=0.000 n=10+10)
Seal-8192-X-8   385MB/s ± 2%   432MB/s ± 3%   +12.26%  (p=0.000 n=10+10)

name              old alloc/op   new alloc/op   delta
Open-64-8         96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Seal-64-8         96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Open-64-X-8       96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Seal-64-X-8       96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Open-1350-8      1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-1350-8      1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-1350-X-8    1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-1350-X-8    1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-8192-8      9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-8192-8      9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-8192-X-8    9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-8192-X-8    9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)

name              old allocs/op  new allocs/op  delta
Open-64-8          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-64-8          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-64-X-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-64-X-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-1350-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-1350-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-1350-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-1350-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-8192-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-8192-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-8192-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-8192-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)

Change-Id: I2c30ddc960a889b49c8ee8ff8073ffc4e75f43af
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/206977
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-22 19:42:13 +00:00
Andy Wang 3c4aac8981 chacha20: improve generic implementation performance 
Some small changes to improve computation throughput of noasm chacha20 by between 4-11%.

name                 old time/op   new time/op   delta
ChaCha20/64-12         142ns ± 1%    132ns ± 1%   -7.09%  (p=0.000 n=20+20)
ChaCha20/256-12        485ns ± 1%    441ns ± 1%   -9.08%  (p=0.000 n=20+20)
ChaCha20/10x25-12      822ns ± 1%    785ns ± 1%   -4.42%  (p=0.000 n=20+20)
ChaCha20/4096-12       484ns ± 1%    442ns ± 1%   -8.80%  (p=0.000 n=20+19)
ChaCha20/100x40-12    8.65µs ± 1%   8.08µs ± 1%   -6.54%  (p=0.000 n=19+20)
ChaCha20/65536-12      118µs ± 1%    106µs ± 1%  -10.04%  (p=0.000 n=19+20)
ChaCha20/1000x65-12    120µs ± 1%    108µs ± 0%   -9.84%  (p=0.000 n=19+19)

name                 old speed     new speed     delta
ChaCha20/64-12       450MB/s ± 1%  484MB/s ± 1%   +7.61%  (p=0.000 n=19+19)
ChaCha20/256-12      527MB/s ± 1%  580MB/s ± 1%  +10.03%  (p=0.000 n=20+20)
ChaCha20/10x25-12    304MB/s ± 1%  318MB/s ± 1%   +4.62%  (p=0.000 n=20+20)
ChaCha20/4096-12     529MB/s ± 1%  580MB/s ± 1%   +9.70%  (p=0.000 n=19+20)
ChaCha20/100x40-12   463MB/s ± 1%  495MB/s ± 1%   +7.00%  (p=0.000 n=19+20)
ChaCha20/65536-12    556MB/s ± 1%  618MB/s ± 1%  +11.16%  (p=0.000 n=19+20)
ChaCha20/1000x65-12  542MB/s ± 1%  602MB/s ± 0%  +10.92%  (p=0.000 n=19+19)

Redundant bound checks on loading key and nonce as uint32s in newUnauthenticatedCipher
are eliminated.

In the main block loop, two changes were made:
1. Specialise the xor function to addXor, so the final block state variables don't need to be
separately incremented by the initial block state before XORing with the input block.
2. Change the loop condition to be bound by len(src) >=64 and len(dst) >= 64.
This eliminates all bound checks later in the load-xor-store stage.
As a result, src and dst are resliced in-place after each block.

Change-Id: Ic3165a556bf7cb2d71349d534cdd21d06d9a7a2c
GitHub-Last-Rev: b3b1a185004c551919a8984547a5bac0283919a1
GitHub-Pull-Request: golang/crypto#131
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/228618
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-20 20:11:42 +00:00
Filippo Valsorda a76a400e30 Revert "chacha20: don't panic encrypting the final blocks" 
This reverts CL 224279.

Reason for revert: broken on arm64, ppc64le and s390x 😢

Change-Id: I8632ee78a79696a3117c81729904797233e0071d
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/229118
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-20 19:28:32 +00:00
Filippo Valsorda 1c2c788b11 chacha20: don't panic encrypting the final blocks 
Certain operations with counter values close to overflowing were causing
an unnecessary panic, which was reachable due to the SetCounter API and
actually observed in QUIC.

Tests by lukechampine <luke.champine@gmail.com> from CL 220591.

Fixes golang/go#37157

Change-Id: Iba52edb1ba36af391b8fe4ee615c5c41d7e64f48
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224279
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-20 19:18:34 +00:00
Bob McNaughton 884d27f428 Update reference to CBC vulnerability in cipher.go 
The original referenced paper is no longer available. I contacted the author, and this is the reference he supplied.

Change-Id: Ib5ad88932f2bfc12ff62639f7fb7c3ee568610d6
GitHub-Last-Rev: 2cf7d15c63a114952c90a018ea5afe085965202e
GitHub-Pull-Request: golang/crypto#132
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/228638
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-04-20 10:45:11 +00:00
Filippo Valsorda 0848c95719 chacha20poly1305: improve ExampleNewX 
The example was failing to direct users on what to do with the nonce,
which should be almost universally prepended to the ciphertext.

Also, leaving key out of the function was pulling the entire file into
the example.

Updates golang/go#38369

Change-Id: I3a13342fff02e1a5d6f9c4ef2a8bddf0b1097707
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/227937
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-14 17:38:20 +00:00
Hana (Hyang-Ah) Kim 4f8f47aa79 ssh/terminal: handle ctrl+C, ctrl+F, ctrl+B 
ctrl+C: terminate readline, which may result in application termination.
ctrl+F: keyRight
ctrl+B: keyLeft

Update golang/go#27147

Change-Id: If319ef79708b98c030cbce102400a785d15137f8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/228223
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-04-14 15:58:20 +00:00
Alex Gaynor 056763e48d ssh/agent: handle ed25519.PrivateKey by value in AddedKey 
Also document that ed25519 is supported.

Change-Id: Ibc4f44069eae4ff1aad27f22fc651a2f7611679d
GitHub-Last-Rev: ee2ce0ae9900b11e1fa891e3587b111168f708c9
GitHub-Pull-Request: golang/crypto#119
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219506
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-04-06 17:35:13 +00:00
Katie Hockman baeed622b8 blake2b,blake2s: clarify difference between blake2b and blake2s 
Fixes golang/go#37784

Change-Id: I2fdaf96979390f3744ba8135da78107a15f5e9a8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/226845
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-03 20:14:58 +00:00
Ross Kinsey 0ec3e9974c ssh: support aes256-cbc for passphrase-protected OpenSSH keys 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-03-23 16:52:09 +00:00
Yannic Bonenberger 891825fb96 gitignore: remove obsolete reference to .hgignore in comment 
Change-Id: Ie2b79a1132b3d59e5bedc71cb5aa8d9aafeb8c68
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224297
Reviewed-by: Ian Lance Taylor <iant@golang.org>
 2020-03-20 18:11:02 +00:00
Katie Hockman 97fc981609 internal/wycheproof: update TestEcdsa to use ecdsa.VerifyASN1 
Change-Id: Ibd6ce156550615cb85c06e734641c34fca0cfcd0
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220697
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-03-20 14:53:29 +00:00
Lucas Bremgartner 1b76d66859 ssh: fix data race in dh group exchange sha256 
Fixes golang/go#37607

Change-Id: Iedf6522ec9b9a676ac51c054407a6aef894885f5
GitHub-Last-Rev: 8cb2460c59d2e32bc3f0480bcd7867a113361c67
GitHub-Pull-Request: golang/crypto#126
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/222078
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-03-17 14:21:12 +00:00
Bryan C. Mills f7b00557c8 sha3: mark xorInUnaligned with go:nocheckptr 
It is unclear whether unaligned reads should be allowed, or if they
are even actually a good idea here. However, while we figure that out,
we should un-break 'go test -race' for users of this package.

Updates golang/go#37644
Updates golang/go#37298
Updates golang/go#37715
Updates golang/go#34972
Updates golang/go#35128

Change-Id: I088f5703023e4f05ee274a6753e925973f12ac1b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/222855
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>
 2020-03-11 17:13:14 +00:00
Andrew Louis 78000ba7a0 acme: make WaitAuthorization return authorization errors consistently 
Fixes golang/go#37340

Change-Id: I19c4f150b8607ad4a1613cf97ad3362f4b779d7c
GitHub-Last-Rev: 4215964b4a680b135301695ccd56cff88a8ffb26
GitHub-Pull-Request: golang/crypto#121
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220343
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-03-02 21:09:43 +00:00
Ian Lance Taylor 32487eceac openpgp/packet: ensure that first partial packet is 512 bytes 
This requirement is from RFC 4880 4.2.2.4.

Also simplify the partialLengthWriter loop. The old code worked but
was written in a confusing way, with a loop whose terminating condition
didn't make sense and was never true in practice.
Rewrite it to more clearly do a set of partial writes of decreasing size.

Fixes golang/go#32474

Change-Id: Ia53ceb39a34f1d6f2ea7c60190d52948bb0db59b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/181121
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
 2020-03-02 21:01:49 +00:00
Filippo Valsorda 2aa609cf4a chacha20,poly1305,chacha20poly1305: set consistent build tags 
appengine was only necessary for the legacy system based on Go 1.9, drop
that. Add purego tags instead. Remove redundant architecture tags.

Change-Id: Ib1f65a4837511e63e08c1aa43163a79cfe868e0c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215498
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
 2020-02-21 23:15:18 +00:00
lukechampine eddbd5da47 chacha20: add SetCounter method 
Fixes golang/go#35506

Change-Id: I5cfc6b4dc07ab368e370edaee11841c2c1377f82
GitHub-Last-Rev: 16147a1668a903532f2d3777b873ddad8f0f26f5
GitHub-Pull-Request: golang/crypto#108
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/206638
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-21 23:14:36 +00:00
Katie Hockman 0f24fbd83d internal/wycheproof: add test for ChaCha20-Poly1305 AEAD encryption/decryption 
Change-Id: I71d62f95954a39c476bee55e22b6fcf96a196de1
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/214939
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-21 17:05:53 +00:00
Filippo Valsorda bac4c82f69 ssh: return an error for malformed ed25519 public keys rather than panic 
An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com
public key, such that the library will panic when trying to verify a
signature with it. Clients can deliver such a public key and signature
to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and
servers can deliver them to any golang.org/x/crypto/ssh client.

This issue was discovered and reported by Alex Gaynor, Fish in a Barrel,
and is tracked as CVE-2020-9283.

Change-Id: Ie25b78a0b0181fbbc8cc7de4f4e27d908777529c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220357
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-02-20 18:36:23 +00:00
Katie Hockman 1ad67e1f0e internal/wycheproof: add test for CBC decryption with PKCS#5 padding 
Change-Id: Ie60bdc10065018e193271b4f90f50298f1272396
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/218323
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-19 23:42:26 +00:00
Brad Fitzpatrick 1d94cc7ab1 acme/autocert: remove unused listener struct field 
Change-Id: Ie7f4848d7388811bdcf1937eab9d603de64d6e96
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219220
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-14 03:40:16 +00:00
Jason Baker 86ce3cb696 acme/autocert: fix TLS-ALPN identifier in tests 
CL 204177 broke autocert tests because they expected the old OID.

Fixes golang/go#37160

Change-Id: Id732d4d249bbe5107fa0a3ba4829012600d8a52d
GitHub-Last-Rev: 77e8d1ff0072866d8466c56885d01d3b91d5baef
GitHub-Pull-Request: golang/crypto#117
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/218941
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-02-10 22:22:08 +00:00
Jason Baker 6ca56c2f2e acme: update TLS-ALPN identifier to the latest IANA assignment 
It looks like the source code has fallen out of date with the draft spec.
The latest version https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05 has a different OID 1.3.6.1.5.5.7.1.31 assigned.

You can test that you're using the correct OID by performing a TLS-ALPN-01 challenge against a Pebble (https://github.com/letsencrypt/pebble) ACME server running with the -strict argument. This implementation will reject the obsolete OID.

Change-Id: I58c52eaed487949e9071d3b9772f7acfdcc91201
GitHub-Last-Rev: 4cacc0723c431a29aec77d4fb3320d91c66c1ff5
GitHub-Pull-Request: golang/crypto#91
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/204177
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Alex Vaghin <alex@cloudware.io>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-10 19:18:31 +00:00
Alex Brainman ecb85df213 ssh/terminal: adjust ReadConsole rules on windows 
CL 212377 changed end of input character on windows - from \n to \r.
But CL 212377 did not adjust ReadConsole accordingly. For example,
after CL 212377 \n was still used to end of password processing,
and \r was ignored.

This CL swaps these rules - \r is now used to end password processing,
and \n are ignored. The change only affects windows, all non windows
code should work as before.

This CL also adjusts TestReadPasswordLineEnd to fit new rules.

Fixes golang/go#36609

Change-Id: I027bf80d10e7d4d4b17ff0264935d14b8bea9097
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215417
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-08 06:05:01 +00:00
Mariano Cano a95e85b341 ssh: support ECDSA private keys in OpenSSH format 
This adds support for parsing OpenSSH ECDSA private keys. It
implements parsing for P-256, P-384, and P-521 keys.

Fixes golang/go#36722

Change-Id: I77c8e0a23ed6353f6667686cc79ec14661cb10db
GitHub-Last-Rev: 2324b920d080fc7ac35fbcf0a79e25161b6a7f82
GitHub-Pull-Request: golang/crypto#114
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215540
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-02-07 20:58:29 +00:00
Katie Hockman a0c6ece9d3 internal/wycheproof: add test for hkdf key extraction 
Change-Id: I501bcc2f4bd8107937756087d20e849e3a4bc182
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/214584
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-06 16:14:12 +00:00
Filippo Valsorda c9f3fb736b ssh: support encrypted OpenSSH private keys 
Includes the bcrypt_pbkdf package by Dmitry Chestnykh,
submitted with permission on his behalf under the CLA:
https://go-review.googlesource.com/c/crypto/+/207600/2#message-6a035dd62ff76f6c9367299b911076a1be237fb8

Fixes golang/go#18692

Change-Id: I74e3ab355a8d720948d64d87adc009783a9d9732
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/207600
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
 2020-02-04 10:40:54 +00:00
Filippo Valsorda 69ecbb4d6d cryptobyte: fix panic due to malformed ASN.1 inputs on 32-bit archs 
When int is 32 bits wide (on 32-bit architectures like 386 and arm), an
overflow could occur, causing a panic, due to malformed ASN.1 being
passed to any of the ASN1 methods of String.

Tested on linux/386 and darwin/amd64.

This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof
test vectors.

Change-Id: I8c9696a8bfad1b40ec877cd740dba3467d66ab54
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/645211
Reviewed-by: Katie Hockman <katiehockman@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/216677
Run-TryBot: Katie Hockman <katie@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-01-28 17:40:31 +00:00
Katie Hockman 530e935923 openpgp/armor: allow armored PGP signature without a CRC 
RFC 4800, Section 6 specifies that the CRC at the end of the
armor is optional, so do not fail to decode signatures missing
the CRC.

Credit: armor.go patch from engineer at Google

Change-Id: I39b04e0afaaafdf7aa86577fe4a35c50e7cf0b2b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215022
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-01-17 16:03:49 +00:00
Yasuhiro Matsumoto 6d4e4cb37c ssh/terminal: stop using ENABLE_LINE_INPUT 
ReadConsole does not read more than 254 bytes when ENABLE_LINE_INPUT is
enabled.

Fixes golang/go#36071

Change-Id: If5c160404b855387a80f1d57638aac3f2db1a097
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/212377
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
 2020-01-15 08:54:10 +00:00
Filippo Valsorda 61a87790db poly1305: drop broken arm assembly 
The ARM assembly uses the reserved G register. This started causing
frequent crashes due to async preemption, but it was already broken in
the presence of signals, including SIGPROF.

name                          old speed      new speed      delta
Chacha20Poly1305/Open-64      2.88MB/s ± 0%  1.85MB/s ± 0%   -35.76%  (p=0.008 n=6+7)
Chacha20Poly1305/Seal-64      3.17MB/s ± 1%  1.97MB/s ± 0%   -37.78%  (p=0.000 n=10+8)
Chacha20Poly1305/Open-64-X    2.41MB/s ± 0%  1.61MB/s ± 0%   -33.29%  (p=0.000 n=9+9)
Chacha20Poly1305/Seal-64-X    2.55MB/s ± 0%  1.64MB/s ± 0%   -35.61%  (p=0.000 n=10+9)
Chacha20Poly1305/Open-1350    8.43MB/s ± 0%  4.15MB/s ± 0%   -50.78%  (p=0.000 n=10+10)
Chacha20Poly1305/Seal-1350    8.55MB/s ± 0%  4.18MB/s ± 0%   -51.12%  (p=0.000 n=9+9)
Chacha20Poly1305/Open-1350-X  8.16MB/s ± 0%  4.06MB/s ± 0%   -50.18%  (p=0.000 n=10+10)
Chacha20Poly1305/Seal-1350-X  8.24MB/s ± 1%  4.08MB/s ± 1%   -50.53%  (p=0.000 n=10+10)
Chacha20Poly1305/Open-8192    9.73MB/s ± 1%  4.56MB/s ± 0%   -53.15%  (p=0.000 n=9+10)
Chacha20Poly1305/Seal-8192    9.57MB/s ± 0%  4.52MB/s ± 0%   -52.77%  (p=0.000 n=9+9)
Chacha20Poly1305/Open-8192-X  9.65MB/s ± 0%  4.54MB/s ± 0%   -52.95%  (p=0.000 n=10+7)
Chacha20Poly1305/Seal-8192-X  9.47MB/s ± 1%  4.50MB/s ± 0%   -52.50%  (p=0.000 n=10+9)

Fixes golang/go#35511

Change-Id: I5e5ca3a0499f04c5fece5bc669a417e32d2656c6
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/213880
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Cherry Zhang <cherryyz@google.com>
 2020-01-09 15:21:10 +00:00
Michael Munday 5d647ca157 sha3: fix SHA-3 on s390x when using KIMD instruction 
An illegal instruction would occur due to a bug in the way input
slices were rounded down in size to a multiple of the rate for a
given hash type. This would only occur when the Write function
was called with more than ~3KiB of data and the length of the data
was not a multiple of the rate.

Fixes golang/go#36459.

Change-Id: I621ef8d75602bcd59bb44491e17f721050001e6d
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/213857
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Michael Munday <mike.munday@ibm.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-01-08 21:55:11 +00:00
Katie Hockman 53104e6ec8 internal/wycheproof: skip failing test on 32-bit arm 
Fixes golang/go#36164

Change-Id: I4248cb3e25346f6859c473b729811b36ac6cf872
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/212625
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2019-12-27 16:37:50 +00:00
Ben Toews becbf705a9 nacl/box: support anonymous seal/open 
This adds SealAnonymous and OpenAnonymous functions that implement the
libsodium "sealed box" functionality.

Fixes golang/go#35346

Change-Id: I22455f1b83595ec8a68d1861e635bd6cb0573f44
GitHub-Last-Rev: 7d334cf861942ec63ad613b7f28fb6dd7a1f9992
GitHub-Pull-Request: golang/crypto#107
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/205241
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2019-12-19 19:50:13 +00:00
Katie Hockman e9b2fee464 internal/wycheproof: add Wycheproof tests for verifying signatures 
https://github.com/google/wycheproof provides test vectors exposing
vulnerabilities in crypto packages. This change creates a new package
called internal/wycheproof that runs these Wycheproof tests against
a number of pacakages in the standard library (and in the future,
x/crypto).

Directory structure:
 - interal/wycheproof/internal/ecdsa: internal version of ecdsa package which
includes a new function that verifies ASN encoded signatures directly
 - interal/wycheproof/internal/dsa: internal version of dsa package which
includes a new function that verifies ASN encoded signatures directly
 - internal/wycheproof: all tests

internal/wycheproof/wycheproof_test.go provides utility functions that are
common to many tests in the package, and contains the TestMain which
fetches github.com/google/wycheproof from the source.

This change includes tests for signature verification with dsa, ecdsa,
eddsa, and rsa (both PKCS#1 v1.5 and PSS signatures).

Note that these tests download testdata from github.com/google/wycheproof
by running `go mod download` in the TestMain. This means that internet
access will be necessary in order to run these tests if the testdata is
not already in your module cache.

More tests will be added incrementally.

Change-Id: I0378d4be24b5679fdc186e9fc94c1cc0068e81f7
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/209221
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2019-12-06 17:25:30 +00:00
edef e7c4368fe9 acme: expect standard ASN.1 signatures from ECDSA Client.Key 
Previously, an ECDSA crypto.Signer would have been expected to return a
signature in RFC7518 format, which violates crypto.Signer's interface
contract.

Fixes golang/go#35829

Change-Id: Id0cc2d9296cfb9f89925ab9ac02e12d68eec734b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/209537
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2019-12-05 18:06:55 +00:00
Filippo Valsorda 0a08dada0f ssh: reject unencrypted keys from ParsePrivateKeyWithPassphrase 
The behavior of ParsePrivateKeyWithPassphrase when the key is
unencrypted is unspecified. Currently, it just parses them like
ParsePrivateKey, which is unlikely to be what anyone wants: for us to
ignore a passphrase that they explicitly passed. It also makes the
implementation of encrypted OpenSSH keys in the next CL more confused.

Instead, make ParsePrivateKey return a PassphraseNeededError, so the
application logic can be ParsePrivateKey -> detect encrypted key ->
obtain passphrase -> ParsePrivateKeyWithPassphrase. That error will also
let us return the public key for OpenSSH keys.

Change-Id: Ife4fb2499ae538bef36e353adf9bc8e902662386
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/207599
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
 2019-12-05 16:18:47 +00:00
Sebastian Kinne 86a70503ff ssh: add sk-ecdsa-sha2-nistp256 and sk-ed25519 
This adds server-side support for the newly introduced OpenSSH
keytypes sk-ecdsa-sha2-nistp256@openssh.com and sk-ed25519@openssh.com
(including their corresponding certificates), which are backed
by U2F/FIDO2 tokens.

Change-Id: I53d5ed3d0457ae4758ee986055e187ee5787a2d1
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/208017
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2019-12-02 14:38:27 +00:00
Fazlul Shahriar b544559bb6 ssh/agent: fix TestServerResponseTooLarge on Plan 9 
First, modify the test to report a better error by waiting for the
Marshal+Write goroutine to finish before returning from the test. If we
return too early, a failure inside that goroutine can generate a panic.

Second, we workaround plan9 not returning the actual number of bytes
written on the connection in case of a hangup (due to closed
connection). I've verified that syscall.Pwrite returns -1 on hangup in
this particular case even when some data did get written.

Fixes golang/go#35888

Change-Id: I7998cff926295f0d577b125c137021a9adc1be5a
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/209298
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2019-11-28 16:05:24 +00:00
Filippo Valsorda ac88ee75c9 ssh/agent: fix example 
Since there is no ClientAgent identifier, ExampleClientAgent wasn't
displayed as an example by godoc.

Change-Id: Ied8df7d8412c4aa483d42315986af49ba8fdbcef
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/208480
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
 2019-11-22 22:04:53 +00:00
Bryan C. Mills 4f8c1d86b1 ssh/agent: clear the environment when starting ssh-agent in client_test 
Certain environment variables can influence the behavior of ssh-agent,
causing the test to fail. Avoid that influence by using a consistent
environment.

This fixes a locally-observed test failure for me.

Change-Id: I0f5e8d643199519f88e80825335ee8e6eb08e3af
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/207901
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
 2019-11-19 21:36:27 +00:00
Lars Lehtonen 497ca9f6d6 ssh/test: fix test goroutine error handling 
Adds an error channel to the test helper function
testPortForward() to collect errors that happen inside
a goroutine.

Change-Id: I6db1d24b935fdfad637c971581ae80beaebd8a1f
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/207462
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2019-11-17 06:32:00 +00:00
Katie Hockman e1110fd1c7 openpgp/elgamal: prevent bad key from causing panic in Decrypt 
If the mod inverse of the private key's P value does not exist,
return an error in Decrypt rather than panic.

Change-Id: Ia075a60108863b14ba98bb62364a17131423b819
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/573976
Reviewed-by: Filippo Valsorda <valsorda@google.com>
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/205502
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2019-11-12 22:21:19 +00:00
Filippo Valsorda 16651526fd chacha20: implement XChaCha20 
Simply add the NonceSizeX constant, and accept 24 bytes nonces in
NewUnauthenticatedCipher. Based on draft-irtf-cfrg-xchacha-01 and
libsodium's implementation.

Fixes golang/go#24485

Change-Id: I551c8ace258bd54b95bb204c8bb34bccd1c4b615
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/185991
Reviewed-by: Michael Munday <mike.munday@ibm.com>
 2019-11-11 21:39:47 +00:00