eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
912 Commits 11 Branches 57 Tags
be400aefbc4c83e9aab51e82b8d4b12760653b47
Commit Graph
912 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tamir Duberstein be400aefbc all: build tags: appengine,!gccgo => purego,gc 
appengine is obsolete and superseded by purego, and gc is a more
precise tag for files that use gc-syntax assembly.

Change-Id: I716f59de772ebeee4adf4d2a432edf300122cef0
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/269920
Trust: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-12-03 16:30:18 +00:00
Roland Shoemaker c8d3bf9c53 x/crypto/chacha20: fix typo in benchmark 
Change-Id: I003c389585a42089fc9cc595d1f5f1027cd482f2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/272306
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-11-24 20:17:22 +00:00
Filippo Valsorda c1f2f97bff ssh/terminal: bump x/term dependency to fix js/nacl 
Brings in CL 258002 which should fix builds for unsupported targets.

Change-Id: I06e6b79347f9081834ad85699ec66d1903fbdaca
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/270817
Trust: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
 2020-11-17 14:41:27 +00:00
Filippo Valsorda 4be66e5b65 ssh/terminal: replace with a golang.org/x/term wrapper 
The package moved to x/term in CL 258001.

Fixes golang/go#31044

Change-Id: I9d39bfb6f54f09de60e2669fb0d939968af79b40
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/258003
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Filippo Valsorda <filippo@golang.org>
 2020-11-16 15:36:03 +00:00
Mahdi Hosseini Moghaddam 0c6587e931 ssh/terminal: add support for zos 
Fixes golang/go#42496

Change-Id: Iae2ddb916904d9b3947bec9638c9fbf892df7b7c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/269177
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Trust: Tobias Klauser <tobias.klauser@gmail.com>
Trust: Michael Munday <mike.munday@ibm.com>
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
 2020-11-12 15:50:50 +00:00
Aidan Coyle 9e8e0b3908 ssh: improve error message for KeyboardInteractiveChallenge 
Fixes golang/go#41823

Change-Id: I4653f23239bdf2ab472d3d15c6653b89ebf7ccd4
GitHub-Last-Rev: 179b3ee0efc7b4733da9fbbd8e5ec73a72ef8156
GitHub-Pull-Request: golang/crypto#158
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/259902
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-10-16 22:06:09 +00:00
Emmanuel T Odeke 84dcc777aa crypto/ssh: add Client.Close in Dial example 
Fixes golang/go#41906

Change-Id: I2eee82160a4450f531f11d5ba7bd6ed19c019992
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/261417
Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Kevin Burke <kev@inburke.com>
Trust: Roland Shoemaker <roland@golang.org>
 2020-10-12 17:37:05 +00:00
Roland Shoemaker 7f63de1d35 internal/wycheproof: add RSA OAEP decryption tests 
Uses only the test vectors that use the same MGF and label hashes.

Change-Id: I971f78556e7b8fdbc785978dca7a613728676697
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/234917
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-10-02 17:02:05 +00:00
woat c90954cbb9 nacl/auth: use Size instead of KeySize for Sum output 
Fixes golang/go#41692

Change-Id: If6e885ca2e016dfecf534093c989356142ec7823
GitHub-Last-Rev: fe67c18f18ccfc766687b8db4bda92b9f7879a2b
GitHub-Pull-Request: golang/crypto#154
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/258357
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Trust: Roland Shoemaker <roland@golang.org>
 2020-10-02 09:40:18 +00:00
Roland Shoemaker eb9a90e9f9 ocsp: Improve documentation for ParseResponse and ParseResponseForCert 
This change clarifies the behaviors of ParseResponse and ParseResponseForCert,
particularly when parsing responses that contain multiple certificate statuses.

Fixes golang/go#30651

Change-Id: Ia632c8c2a69d1b0c17d71f9f9dcb59ddb0be401b
GitHub-Last-Rev: 481f613438c91521fd90078cc0915cf01cf44b4e
GitHub-Pull-Request: golang/crypto#122
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220353
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Roland Shoemaker <roland@golang.org>
 2020-10-01 19:37:50 +00:00
Daniel Cohen afb6bcd081 ssh: remove slow unnecessary diffie-hellman-group-exchange primality check 
The existing implementation validates that the prime returned by the server is, in fact, prime, which is extremely slow, especially for large key sizes.

As other implementations, including OpenSSH, do not verify the primality of the provided parameters, this change removes that check.

Fixes golang/go#41151

Change-Id: I7539714c690f08b5792a0c540cbf46c3e81f13ba
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/252337
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Roland Shoemaker <roland@golang.org>
 2020-09-30 16:06:38 +00:00
Bryan C. Mills 5c72a88397 sha3: remove go:nocheckptr annotation 
As of Go 1.14.1, -d=checkptr no longer errors on unaligned reads of
non-pointer data.

This reverts the code change (but not the test) from CL 222855.

Fixes golang/go#37644
Updates golang/go#37298

Change-Id: I935c773a3541ed8dca7eb005d39a082eb5f10eb8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/249378
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>
 2020-08-20 21:17:05 +00:00
Roland Shoemaker 123391ffb6 internal/wycheproof: add generic AEAD test 
Add a generic AEAD test that exercises the vectors for AES GCM,
ChaCha20Poly-1305, and XChaCha20-Poly1305. Removes the existing
chacha20_poly1305_test.go test.

Change-Id: Icfaba30f8db2a1e32a9459c98cd3af5d63052027
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/234688
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-07-28 19:59:43 +00:00
chronologos 948cd5f358 pkcs12: drop PKCS#12 attributes with unknown OIDs 
Looking at our own use case as well as people running into the same issue
[1][2], it seems like users usually don't care about decoding unknown
PKCS12Attributes.

[1]: https://github.com/golang/go/issues/24325
[2]: https://github.com/SSLMate/go-pkcs12/pull/4

Fixes golang/go#24325

Change-Id: I4f3700d2551af6dac215c49dd179ce46c4b2a9db
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/241281
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-07-09 23:00:13 +00:00
Filippo Valsorda ab33eee955 pkcs12: document that we use the wrong PEM type 
Fixes golang/go#28018

Change-Id: I2daf99789328ef476de834c3cc703e01b468b3ee
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/241337
Reviewed-by: Katie Hockman <katie@golang.org>
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-07-07 23:50:45 +00:00
Julian Kornberger 75b288015a ssh: Make error message deterministic 
By using a slice instead of a map for tried authentication methods the order is always the same. Small slices are also faster than maps.

Before the change sometimes I get the error:

    ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

and sometimes:

    ssh: handshake failed: ssh: unable to authenticate, attempted methods [publickey none], no supported methods remain

Change-Id: I06507d57e9eef497ff05bce088d52607e69dde3e
GitHub-Last-Rev: 3a46aae4c6e3e5f52ca4b04384b3cc4efc039aa6
GitHub-Pull-Request: golang/crypto#142
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/239171
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-06-22 21:36:23 +00:00
Roland Shoemaker 70a84ac30b internal/wycheproof: add tests for hmac generation 
Required updating wycheproofModVer to pull the most recent test
vectors. Tests against SHA1, SHA224, SHA256, SHA384, and SHA512
constructions but not the SHA3 variants.

Change-Id: I5b66632ac0c7106bd9b405f6636922a6383d8b9e
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/234718
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-06-04 20:27:06 +00:00
Erick Tryzelaar 279210d13f ssh: don't err out on channel request msgs to unknown channels 
rfc4254 section 5.4 states that channel request messages sent to an
unrecognized channel should be replied with a `SSH_MSG_CHANNEL_FAILURE`,
rather than erring out and closing the mux. This can occur with servers
like openssh-portable, which can begin to close a channel and also use
that channel for keepalives before it has received a closed response
from the client.

Fixes golang/go#38908

Change-Id: Id68b77e16b2889d3a21d505ed8018f9f457e067a
GitHub-Last-Rev: 8a92f87dc30697d9e3805af695efdf1b1dc8409b
GitHub-Pull-Request: golang/crypto#136
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/232659
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-06-02 18:02:16 +00:00
Pasi Tähkäpää 06a226fb4e Use boolean tag (0x01) for boolean type. 
Fix for problem with ReadASN1Boolean, which uses invalid tag (Integer / 0x02) when trying to read boolean value. This is a fix for the one case mentioned in "x/crypto/cryptobyte: cannot read boolean values #26565"
This is specified in ITU-T X.690, section 8.2, with DER additions specified in 11.1.

Change-Id: I3c9406bd6febb6112f380224fec1d42a6cd64ed4
GitHub-Last-Rev: fd7d01c897d8aa32d92115be9017f84d75fc4467
GitHub-Pull-Request: golang/crypto#137
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/233161
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-05-10 22:35:06 +00:00
Michael Munday 4b2356b1ed poly1305: modify s390x assembly to implement MAC interface 
The vector (vx) implementation has been updated to read in the
state and update it - as opposed to being a single shot function.
This has allowed the new MAC interface can be implemented.

For performance reasons s390x uses a larger buffer than the generic
implementation. There is a relatively high fixed cost to read the
state, calculate the key coefficients and serialize the state, so
it makes sense to buffer more blocks before calling it.

For now I've had to remove the faster VMSL implementation. It is
too complex for me to update in time for Go 1.15. At some point
I'd like to revisit it but for now it looks like using the MAC
interface is more of a win than using VMSL.

The benchmarks show considerable improvements when using the MAC
interface. The Sum benchmarks show slowdown due to a combination
of the removal of the VMSL implementation and also the added
overhead from splitting the summation function into multiple parts.

poly1305:

name              old speed      new speed      delta
64                1.33GB/s ± 0%  0.80GB/s ± 1%   -39.51%  (p=0.000 n=16+20)
1K                4.04GB/s ± 0%  2.97GB/s ± 0%   -26.46%  (p=0.000 n=19+19)
2M                5.32GB/s ± 1%  3.63GB/s ± 0%   -31.76%  (p=0.000 n=20+19)
64Unaligned       1.33GB/s ± 0%  0.80GB/s ± 0%   -39.80%  (p=0.000 n=19+18)
1KUnaligned       4.09GB/s ± 1%  2.94GB/s ± 0%   -28.23%  (p=0.000 n=19+18)
2MUnaligned       5.33GB/s ± 1%  3.52GB/s ± 0%   -34.04%  (p=0.000 n=20+19)
Write64           1.03GB/s ± 1%  1.49GB/s ± 1%   +44.34%  (p=0.000 n=20+20)
Write1K           1.21GB/s ± 0%  3.24GB/s ± 0%  +169.02%  (p=0.000 n=20+17)
Write2M           1.24GB/s ± 1%  3.63GB/s ± 0%  +192.36%  (p=0.000 n=20+19)
Write64Unaligned  1.04GB/s ± 1%  1.50GB/s ± 0%   +44.16%  (p=0.000 n=19+14)
Write1KUnaligned  1.21GB/s ± 0%  3.20GB/s ± 0%  +164.55%  (p=0.000 n=20+16)
Write2MUnaligned  1.24GB/s ± 1%  3.51GB/s ± 0%  +183.96%  (p=0.000 n=20+19)

chacha20poly1305 (this vs. using generic MAC interface - post CL 206977):

name         old speed      new speed      delta
Open-64       147MB/s ± 2%   156MB/s ± 1%   +6.15%  (p=0.000 n=20+19)
Seal-64       151MB/s ± 0%   164MB/s ± 1%   +8.86%  (p=0.000 n=19+16)
Open-64-X     104MB/s ± 2%   111MB/s ± 1%   +6.24%  (p=0.000 n=20+20)
Seal-64-X     109MB/s ± 2%   111MB/s ± 1%   +2.11%  (p=0.000 n=20+19)
Open-1350     555MB/s ± 0%   751MB/s ± 1%  +35.19%  (p=0.000 n=20+20)
Seal-1350     557MB/s ± 0%   759MB/s ± 0%  +36.23%  (p=0.000 n=20+20)
Open-1350-X   517MB/s ± 1%   683MB/s ± 1%  +31.97%  (p=0.000 n=20+20)
Seal-1350-X   511MB/s ± 0%   683MB/s ± 0%  +33.77%  (p=0.000 n=18+19)
Open-8192     672MB/s ± 0%  1013MB/s ± 0%  +50.65%  (p=0.000 n=19+19)
Seal-8192     674MB/s ± 0%  1018MB/s ± 0%  +50.98%  (p=0.000 n=18+20)
Open-8192-X   663MB/s ± 0%   979MB/s ± 0%  +47.57%  (p=0.000 n=20+20)
Seal-8192-X   658MB/s ± 0%   985MB/s ± 0%  +49.62%  (p=0.000 n=18+20)

name         old allocs/op  new allocs/op  delta
Open-64          0.00           0.00          ~     (all equal)
Seal-64          0.00           0.00          ~     (all equal)
Open-64-X        0.00           0.00          ~     (all equal)
Seal-64-X        0.00           0.00          ~     (all equal)
Open-1350        0.00           0.00          ~     (all equal)
Seal-1350        0.00           0.00          ~     (all equal)
Open-1350-X      0.00           0.00          ~     (all equal)
Seal-1350-X      0.00           0.00          ~     (all equal)
Open-8192        0.00           0.00          ~     (all equal)
Seal-8192        0.00           0.00          ~     (all equal)
Open-8192-X      0.00           0.00          ~     (all equal)
Seal-8192-X      0.00           0.00          ~     (all equal)

chacha20poly1305 (this vs. using asm Sum interface - pre CL 206977):

name         old speed      new speed      delta
Open-64       144MB/s ± 0%   156MB/s ± 1%    +8.16%  (p=0.000 n=20+19)
Seal-64       150MB/s ± 0%   164MB/s ± 1%    +9.35%  (p=0.000 n=20+16)
Open-64-X     104MB/s ± 1%   111MB/s ± 1%    +6.15%  (p=0.000 n=19+20)
Seal-64-X     109MB/s ± 1%   111MB/s ± 1%    +1.43%  (p=0.000 n=19+19)
Open-1350     702MB/s ± 1%   751MB/s ± 1%    +6.98%  (p=0.000 n=20+20)
Seal-1350     715MB/s ± 0%   759MB/s ± 0%    +6.09%  (p=0.000 n=19+20)
Open-1350-X   642MB/s ± 0%   683MB/s ± 1%    +6.37%  (p=0.000 n=19+20)
Seal-1350-X   639MB/s ± 0%   683MB/s ± 0%    +6.98%  (p=0.000 n=20+19)
Open-8192     994MB/s ± 0%  1013MB/s ± 0%    +1.85%  (p=0.000 n=20+19)
Seal-8192    1.00GB/s ± 0%  1.02GB/s ± 0%    +1.90%  (p=0.000 n=20+20)
Open-8192-X   965MB/s ± 0%   979MB/s ± 0%    +1.43%  (p=0.000 n=19+20)
Seal-8192-X   962MB/s ± 0%   985MB/s ± 0%    +2.39%  (p=0.000 n=20+20)

name         old allocs/op  new allocs/op  delta
Open-64          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-64          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-64-X        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-64-X        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-1350        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-1350        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-1350-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-1350-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-8192        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-8192        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Open-8192-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)
Seal-8192-X      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=20+20)

Updates golang/go#25219.

Change-Id: Ib491e3a47b6b3ec8bbbe1f41f7bf42ad82f5c249
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219057
Run-TryBot: Michael Munday <mike.munday@ibm.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-29 18:30:12 +00:00
Lily Chung 729f1e841b ssh: improve docs on Certificate.SignCert 
Document the fact that SignCert sets the Nonce field.  This makes it
clear that callers need not set it themselves.

Original change by Jakob Weisblat <jakobw@mit.edu> in CL 57051.

Fixes golang/go#21384

Change-Id: I161e0909ba6c8d07be5f8e68dc6e0f0392bea63f
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/230212
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-27 16:56:52 +00:00
Filippo Valsorda 4bdfaf469e chacha20: don't panic encrypting the final blocks 
Certain operations with counter values close to overflowing were causing
an unnecessary panic, which was reachable due to the SetCounter API and
actually observed in QUIC.

Tests by lukechampine <luke.champine@gmail.com> from CL 220591.

Fixes golang/go#37157

Relanding of CL 224279, which was broken on multi-block buffers.
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224279
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>

Change-Id: Ia382c6f62ae49ffe257b67f7b794e8d7124d981e
(cherry picked from commit 1c2c788b11)
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/229119
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-23 21:15:02 +00:00
Katie Hockman 18b771bd64 cryptobyte: handle AddASN1BigInt with -1 
Fixes golang/go#38510

Change-Id: Ie52db22bf85a5f79046fad95e5bbe2788c3bec92
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/229457
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-23 19:51:18 +00:00
Filippo Valsorda 44a6062868 poly1305: add (*MAC).Verify API and use it in chacha20poly1305 
Also, make sure New inlines so it does not cause an allocation. With
this, we have a zero allocation poly1305 flow and a zero allocation
generic chacha20poly1305 composition! \o/

While at it, remove some redundant code, and prepare to drop some
complexity once the last assembly implementation of sum is dropped.

Benchstat with "-tags purego" on amd64

name              old time/op    new time/op    delta
Open-64-8         461ns ± 2%     415ns ± 1%    -9.93%  (p=0.000 n=10+8)
Seal-64-8         450ns ± 3%     412ns ± 3%    -8.41%  (p=0.000 n=10+10)
Open-64-X-8       603ns ± 2%     544ns ± 2%    -9.84%  (p=0.000 n=10+10)
Seal-64-X-8       580ns ± 3%     553ns ± 1%    -4.56%  (p=0.000 n=9+8)
Open-1350-8      3.98µs ± 2%    3.65µs ± 2%    -8.28%  (p=0.000 n=9+10)
Seal-1350-8      3.95µs ± 2%    3.64µs ± 1%    -7.93%  (p=0.000 n=9+10)
Open-1350-X-8    4.06µs ± 1%    3.68µs ± 3%    -9.31%  (p=0.000 n=9+10)
Seal-1350-X-8    4.08µs ± 4%    3.64µs ± 1%   -10.71%  (p=0.000 n=9+10)
Open-8192-8      21.7µs ± 3%    18.9µs ± 2%   -13.10%  (p=0.000 n=9+10)
Seal-8192-8      21.5µs ± 3%    18.8µs ± 1%   -12.51%  (p=0.000 n=9+9)
Open-8192-X-8    21.4µs ± 1%    19.1µs ± 2%   -10.88%  (p=0.000 n=10+10)
Seal-8192-X-8    21.3µs ± 2%    19.0µs ± 3%   -10.92%  (p=0.000 n=10+10)

name              old speed      new speed      delta
Open-64-8       139MB/s ± 2%   154MB/s ± 2%   +11.05%  (p=0.000 n=10+8)
Seal-64-8       142MB/s ± 3%   155MB/s ± 3%    +9.11%  (p=0.000 n=10+10)
Open-64-X-8     106MB/s ± 2%   118MB/s ± 2%   +10.93%  (p=0.000 n=10+10)
Seal-64-X-8     110MB/s ± 3%   116MB/s ± 1%    +4.75%  (p=0.000 n=9+8)
Open-1350-8     339MB/s ± 2%   370MB/s ± 2%    +9.04%  (p=0.000 n=9+10)
Seal-1350-8     342MB/s ± 2%   371MB/s ± 1%    +8.60%  (p=0.000 n=9+10)
Open-1350-X-8   333MB/s ± 1%   367MB/s ± 3%   +10.30%  (p=0.000 n=9+10)
Seal-1350-X-8   331MB/s ± 4%   371MB/s ± 2%   +11.96%  (p=0.000 n=9+10)
Open-8192-8     377MB/s ± 3%   434MB/s ± 2%   +15.07%  (p=0.000 n=9+10)
Seal-8192-8     381MB/s ± 3%   436MB/s ± 1%   +14.29%  (p=0.000 n=9+9)
Open-8192-X-8   383MB/s ± 1%   429MB/s ± 2%   +12.21%  (p=0.000 n=10+10)
Seal-8192-X-8   385MB/s ± 2%   432MB/s ± 3%   +12.26%  (p=0.000 n=10+10)

name              old alloc/op   new alloc/op   delta
Open-64-8         96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Seal-64-8         96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Open-64-X-8       96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Seal-64-X-8       96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Open-1350-8      1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-1350-8      1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-1350-X-8    1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-1350-X-8    1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-8192-8      9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-8192-8      9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-8192-X-8    9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-8192-X-8    9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)

name              old allocs/op  new allocs/op  delta
Open-64-8          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-64-8          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-64-X-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-64-X-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-1350-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-1350-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-1350-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-1350-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-8192-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-8192-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-8192-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-8192-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)

Change-Id: I2c30ddc960a889b49c8ee8ff8073ffc4e75f43af
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/206977
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-22 19:42:13 +00:00
Andy Wang 3c4aac8981 chacha20: improve generic implementation performance 
Some small changes to improve computation throughput of noasm chacha20 by between 4-11%.

name                 old time/op   new time/op   delta
ChaCha20/64-12         142ns ± 1%    132ns ± 1%   -7.09%  (p=0.000 n=20+20)
ChaCha20/256-12        485ns ± 1%    441ns ± 1%   -9.08%  (p=0.000 n=20+20)
ChaCha20/10x25-12      822ns ± 1%    785ns ± 1%   -4.42%  (p=0.000 n=20+20)
ChaCha20/4096-12       484ns ± 1%    442ns ± 1%   -8.80%  (p=0.000 n=20+19)
ChaCha20/100x40-12    8.65µs ± 1%   8.08µs ± 1%   -6.54%  (p=0.000 n=19+20)
ChaCha20/65536-12      118µs ± 1%    106µs ± 1%  -10.04%  (p=0.000 n=19+20)
ChaCha20/1000x65-12    120µs ± 1%    108µs ± 0%   -9.84%  (p=0.000 n=19+19)

name                 old speed     new speed     delta
ChaCha20/64-12       450MB/s ± 1%  484MB/s ± 1%   +7.61%  (p=0.000 n=19+19)
ChaCha20/256-12      527MB/s ± 1%  580MB/s ± 1%  +10.03%  (p=0.000 n=20+20)
ChaCha20/10x25-12    304MB/s ± 1%  318MB/s ± 1%   +4.62%  (p=0.000 n=20+20)
ChaCha20/4096-12     529MB/s ± 1%  580MB/s ± 1%   +9.70%  (p=0.000 n=19+20)
ChaCha20/100x40-12   463MB/s ± 1%  495MB/s ± 1%   +7.00%  (p=0.000 n=19+20)
ChaCha20/65536-12    556MB/s ± 1%  618MB/s ± 1%  +11.16%  (p=0.000 n=19+20)
ChaCha20/1000x65-12  542MB/s ± 1%  602MB/s ± 0%  +10.92%  (p=0.000 n=19+19)

Redundant bound checks on loading key and nonce as uint32s in newUnauthenticatedCipher
are eliminated.

In the main block loop, two changes were made:
1. Specialise the xor function to addXor, so the final block state variables don't need to be
separately incremented by the initial block state before XORing with the input block.
2. Change the loop condition to be bound by len(src) >=64 and len(dst) >= 64.
This eliminates all bound checks later in the load-xor-store stage.
As a result, src and dst are resliced in-place after each block.

Change-Id: Ic3165a556bf7cb2d71349d534cdd21d06d9a7a2c
GitHub-Last-Rev: b3b1a185004c551919a8984547a5bac0283919a1
GitHub-Pull-Request: golang/crypto#131
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/228618
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-20 20:11:42 +00:00
Filippo Valsorda a76a400e30 Revert "chacha20: don't panic encrypting the final blocks" 
This reverts CL 224279.

Reason for revert: broken on arm64, ppc64le and s390x 😢

Change-Id: I8632ee78a79696a3117c81729904797233e0071d
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/229118
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-20 19:28:32 +00:00
Filippo Valsorda 1c2c788b11 chacha20: don't panic encrypting the final blocks 
Certain operations with counter values close to overflowing were causing
an unnecessary panic, which was reachable due to the SetCounter API and
actually observed in QUIC.

Tests by lukechampine <luke.champine@gmail.com> from CL 220591.

Fixes golang/go#37157

Change-Id: Iba52edb1ba36af391b8fe4ee615c5c41d7e64f48
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224279
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-20 19:18:34 +00:00
Bob McNaughton 884d27f428 Update reference to CBC vulnerability in cipher.go 
The original referenced paper is no longer available. I contacted the author, and this is the reference he supplied.

Change-Id: Ib5ad88932f2bfc12ff62639f7fb7c3ee568610d6
GitHub-Last-Rev: 2cf7d15c63a114952c90a018ea5afe085965202e
GitHub-Pull-Request: golang/crypto#132
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/228638
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-04-20 10:45:11 +00:00
Filippo Valsorda 0848c95719 chacha20poly1305: improve ExampleNewX 
The example was failing to direct users on what to do with the nonce,
which should be almost universally prepended to the ciphertext.

Also, leaving key out of the function was pulling the entire file into
the example.

Updates golang/go#38369

Change-Id: I3a13342fff02e1a5d6f9c4ef2a8bddf0b1097707
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/227937
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-14 17:38:20 +00:00
Hana (Hyang-Ah) Kim 4f8f47aa79 ssh/terminal: handle ctrl+C, ctrl+F, ctrl+B 
ctrl+C: terminate readline, which may result in application termination.
ctrl+F: keyRight
ctrl+B: keyLeft

Update golang/go#27147

Change-Id: If319ef79708b98c030cbce102400a785d15137f8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/228223
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-04-14 15:58:20 +00:00
Alex Gaynor 056763e48d ssh/agent: handle ed25519.PrivateKey by value in AddedKey 
Also document that ed25519 is supported.

Change-Id: Ibc4f44069eae4ff1aad27f22fc651a2f7611679d
GitHub-Last-Rev: ee2ce0ae9900b11e1fa891e3587b111168f708c9
GitHub-Pull-Request: golang/crypto#119
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219506
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-04-06 17:35:13 +00:00
Katie Hockman baeed622b8 blake2b,blake2s: clarify difference between blake2b and blake2s 
Fixes golang/go#37784

Change-Id: I2fdaf96979390f3744ba8135da78107a15f5e9a8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/226845
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-04-03 20:14:58 +00:00
Ross Kinsey 0ec3e9974c ssh: support aes256-cbc for passphrase-protected OpenSSH keys 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-03-23 16:52:09 +00:00
Yannic Bonenberger 891825fb96 gitignore: remove obsolete reference to .hgignore in comment 
Change-Id: Ie2b79a1132b3d59e5bedc71cb5aa8d9aafeb8c68
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224297
Reviewed-by: Ian Lance Taylor <iant@golang.org>
 2020-03-20 18:11:02 +00:00
Katie Hockman 97fc981609 internal/wycheproof: update TestEcdsa to use ecdsa.VerifyASN1 
Change-Id: Ibd6ce156550615cb85c06e734641c34fca0cfcd0
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220697
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-03-20 14:53:29 +00:00
Lucas Bremgartner 1b76d66859 ssh: fix data race in dh group exchange sha256 
Fixes golang/go#37607

Change-Id: Iedf6522ec9b9a676ac51c054407a6aef894885f5
GitHub-Last-Rev: 8cb2460c59d2e32bc3f0480bcd7867a113361c67
GitHub-Pull-Request: golang/crypto#126
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/222078
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-03-17 14:21:12 +00:00
Bryan C. Mills f7b00557c8 sha3: mark xorInUnaligned with go:nocheckptr 
It is unclear whether unaligned reads should be allowed, or if they
are even actually a good idea here. However, while we figure that out,
we should un-break 'go test -race' for users of this package.

Updates golang/go#37644
Updates golang/go#37298
Updates golang/go#37715
Updates golang/go#34972
Updates golang/go#35128

Change-Id: I088f5703023e4f05ee274a6753e925973f12ac1b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/222855
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>
 2020-03-11 17:13:14 +00:00
Andrew Louis 78000ba7a0 acme: make WaitAuthorization return authorization errors consistently 
Fixes golang/go#37340

Change-Id: I19c4f150b8607ad4a1613cf97ad3362f4b779d7c
GitHub-Last-Rev: 4215964b4a680b135301695ccd56cff88a8ffb26
GitHub-Pull-Request: golang/crypto#121
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220343
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-03-02 21:09:43 +00:00
Ian Lance Taylor 32487eceac openpgp/packet: ensure that first partial packet is 512 bytes 
This requirement is from RFC 4880 4.2.2.4.

Also simplify the partialLengthWriter loop. The old code worked but
was written in a confusing way, with a loop whose terminating condition
didn't make sense and was never true in practice.
Rewrite it to more clearly do a set of partial writes of decreasing size.

Fixes golang/go#32474

Change-Id: Ia53ceb39a34f1d6f2ea7c60190d52948bb0db59b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/181121
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
 2020-03-02 21:01:49 +00:00
Filippo Valsorda 2aa609cf4a chacha20,poly1305,chacha20poly1305: set consistent build tags 
appengine was only necessary for the legacy system based on Go 1.9, drop
that. Add purego tags instead. Remove redundant architecture tags.

Change-Id: Ib1f65a4837511e63e08c1aa43163a79cfe868e0c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215498
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
 2020-02-21 23:15:18 +00:00
lukechampine eddbd5da47 chacha20: add SetCounter method 
Fixes golang/go#35506

Change-Id: I5cfc6b4dc07ab368e370edaee11841c2c1377f82
GitHub-Last-Rev: 16147a1668a903532f2d3777b873ddad8f0f26f5
GitHub-Pull-Request: golang/crypto#108
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/206638
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-21 23:14:36 +00:00
Katie Hockman 0f24fbd83d internal/wycheproof: add test for ChaCha20-Poly1305 AEAD encryption/decryption 
Change-Id: I71d62f95954a39c476bee55e22b6fcf96a196de1
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/214939
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-21 17:05:53 +00:00
Filippo Valsorda bac4c82f69 ssh: return an error for malformed ed25519 public keys rather than panic 
An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com
public key, such that the library will panic when trying to verify a
signature with it. Clients can deliver such a public key and signature
to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and
servers can deliver them to any golang.org/x/crypto/ssh client.

This issue was discovered and reported by Alex Gaynor, Fish in a Barrel,
and is tracked as CVE-2020-9283.

Change-Id: Ie25b78a0b0181fbbc8cc7de4f4e27d908777529c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220357
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-02-20 18:36:23 +00:00
Katie Hockman 1ad67e1f0e internal/wycheproof: add test for CBC decryption with PKCS#5 padding 
Change-Id: Ie60bdc10065018e193271b4f90f50298f1272396
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/218323
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-19 23:42:26 +00:00
Brad Fitzpatrick 1d94cc7ab1 acme/autocert: remove unused listener struct field 
Change-Id: Ie7f4848d7388811bdcf1937eab9d603de64d6e96
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219220
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-14 03:40:16 +00:00
Jason Baker 86ce3cb696 acme/autocert: fix TLS-ALPN identifier in tests 
CL 204177 broke autocert tests because they expected the old OID.

Fixes golang/go#37160

Change-Id: Id732d4d249bbe5107fa0a3ba4829012600d8a52d
GitHub-Last-Rev: 77e8d1ff0072866d8466c56885d01d3b91d5baef
GitHub-Pull-Request: golang/crypto#117
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/218941
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-02-10 22:22:08 +00:00
Jason Baker 6ca56c2f2e acme: update TLS-ALPN identifier to the latest IANA assignment 
It looks like the source code has fallen out of date with the draft spec.
The latest version https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05 has a different OID 1.3.6.1.5.5.7.1.31 assigned.

You can test that you're using the correct OID by performing a TLS-ALPN-01 challenge against a Pebble (https://github.com/letsencrypt/pebble) ACME server running with the -strict argument. This implementation will reject the obsolete OID.

Change-Id: I58c52eaed487949e9071d3b9772f7acfdcc91201
GitHub-Last-Rev: 4cacc0723c431a29aec77d4fb3320d91c66c1ff5
GitHub-Pull-Request: golang/crypto#91
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/204177
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Alex Vaghin <alex@cloudware.io>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-10 19:18:31 +00:00
Alex Brainman ecb85df213 ssh/terminal: adjust ReadConsole rules on windows 
CL 212377 changed end of input character on windows - from \n to \r.
But CL 212377 did not adjust ReadConsole accordingly. For example,
after CL 212377 \n was still used to end of password processing,
and \r was ignored.

This CL swaps these rules - \r is now used to end password processing,
and \n are ignored. The change only affects windows, all non windows
code should work as before.

This CL also adjusts TestReadPasswordLineEnd to fit new rules.

Fixes golang/go#36609

Change-Id: I027bf80d10e7d4d4b17ff0264935d14b8bea9097
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215417
Run-TryBot: Alex Brainman <alex.brainman@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-08 06:05:01 +00:00
Mariano Cano a95e85b341 ssh: support ECDSA private keys in OpenSSH format 
This adds support for parsing OpenSSH ECDSA private keys. It
implements parsing for P-256, P-384, and P-521 keys.

Fixes golang/go#36722

Change-Id: I77c8e0a23ed6353f6667686cc79ec14661cb10db
GitHub-Last-Rev: 2324b920d080fc7ac35fbcf0a79e25161b6a7f82
GitHub-Pull-Request: golang/crypto#114
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215540
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2020-02-07 20:58:29 +00:00
Katie Hockman a0c6ece9d3 internal/wycheproof: add test for hkdf key extraction 
Change-Id: I501bcc2f4bd8107937756087d20e849e3a4bc182
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/214584
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-02-06 16:14:12 +00:00