Add PKCS7-internal BIO_f_cipher#1836
Merged
WillChilds-Klein merged 22 commits intoaws:mainfrom Oct 29, 2024
Merged
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1836 +/- ##
==========================================
+ Coverage 78.67% 78.73% +0.06%
==========================================
Files 585 587 +2
Lines 100854 101133 +279
Branches 14299 14339 +40
==========================================
+ Hits 79342 79623 +281
+ Misses 20877 20874 -3
- Partials 635 636 +1 ☔ View full report in Codecov by Sentry. |
f4627f0 to
4f69b78
Compare
6e5c58d to
94c275e
Compare
Contributor
samuel40791765
left a comment
There was a problem hiding this comment.
Just some preliminary comments, haven't gone through everything yet.
6fe97e9 to
ea1f09d
Compare
justsmth
reviewed
Sep 16, 2024
justsmth
reviewed
Sep 16, 2024
ea1f09d to
f88b1b4
Compare
9e3f145 to
43af6b7
Compare
974506f to
b575aed
Compare
justsmth
reviewed
Oct 1, 2024
290631b to
4a55a5a
Compare
4a55a5a to
8def0f4
Compare
justsmth
approved these changes
Oct 28, 2024
samuel40791765
approved these changes
Oct 29, 2024
| GUARD_PTR(b); | ||
| GUARD_PTR(next); | ||
| GUARD_PTR(ctx); | ||
| while (ctx->ok > 0 && (ctx->buf_len > 0 || !ctx->done)) { |
Contributor
There was a problem hiding this comment.
Nit: Since we're using ctx->ok as a boolean, the logic may be clearer if we use it as one.
Suggested change
| while (ctx->ok > 0 && (ctx->buf_len > 0 || !ctx->done)) { | |
| while (ctx->ok && (ctx->buf_len > 0 || !ctx->done)) { |
|
|
||
| BIO_ENC_CTX *ctx = BIO_get_data(b); | ||
| BIO *next = BIO_next(b); | ||
| if (ctx == NULL) { |
Contributor
There was a problem hiding this comment.
Nit:
Suggested change
| if (ctx == NULL) { | |
| if (ctx == NULL || next == NULL) { |
skmcgrail
added a commit
that referenced
this pull request
Nov 7, 2024
## What's Changed * 800-131Ar1: length of the key-derivation key shall be at least 112 bits. by @skmcgrail in #1924 * Marshalling/Unmarshalling DH public keys by @justsmth in #1916 * Also prune SSM documents from ec2-test-framework by @samuel40791765 in #1925 * Use illegal_parameter instead of decode_error for invalid key shares by @justsmth in #1923 * Add null check in dh testing by @torben-hansen in #1937 * DH paramgen callback by @justsmth in #1928 * Upstream merge 2024 10 17 by @torben-hansen in #1934 * Remove old Intel CPU types by @justsmth in #1942 * Remove retries on PCT failure in EC and RSA key generation. by @nebeid in #1938 * Add p4p, bump up time by @justsmth in #1943 * PQ README by @jakemas in #1932 * bump mysql CI to 9.1.0 by @justsmth in #1939 * HKDF, HKDF_expand, and PBKDF Truncated SHA2-512 by @skmcgrail in #1946 * Missing functionality + Adding Nmap to our CI by @smittals2 in #1915 * Fix FIPS.md typo by @justsmth in #1950 * Support encode or decode ∞ like OpenSSL by @samuel40791765 in #1930 * Expand support for EVP_PKEY_HMAC by @justsmth in #1933 * Add PKCS7-internal BIO_f_cipher by @WillChilds-Klein in #1836 * Add PKCS7-internal BIO_f_md by @WillChilds-Klein in #1886 * Ruby Support - DSA custom md by @justsmth in #1953 * Add support for POINT_CONVERSION_HYBRID by @samuel40791765 in #1936 * Fixes for Coverity Alerts by @smittals2 in #1960 * Also test w/ gcc 4.8 by @justsmth in #1962 * Actually add support for SSL_get_server/peer_tmp_key by @samuel40791765 in #1945 * Coverity Fix Null Check by @smittals2 in #1965 * ML-KEM keygen Pairwise Consistency Test by @dkostic in #1964 * EDDSA PCT by @torben-hansen in #1968 * Expose AES_cfb1_encrypt and AES_cfb8_encrypt by @skmcgrail in #1967 **Full Changelog**: v1.37.0...v1.38.0 By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
smittals2
pushed a commit
to smittals2/aws-lc
that referenced
this pull request
Aug 4, 2025
This change introduces a new filter BIO, `BIO_f_cipher` for use in PR 1816. The cipher BIO sits in front of a backing BIO, encrypting incoming writes before writing to the backing BIO and decrypting data read from the backing BIO. This implementation is almost an exact copy of [OpenSSL's](https://github.com/openssl/openssl/blob/8e0d479b98357bb20ab1bd073cf75f7d42531553/crypto/evp/bio_enc.c#L59) with some functionality removed. We try to change as little of the underlying logic as possible, but rename variables and add comments for clarity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues:
Addresses CryptoAlg-2494
Description of changes:
This change introduces a new filter BIO,
BIO_f_cipherfor use in PR 1816.The cipher BIO sits in front of a backing BIO, encrypting incoming writes before writing to the backing BIO and decrypting data read from the backing BIO. This implementation is almost an exact copy of OpenSSL's with some functionality removed. We try to change as little of the underlying logic as possible, but rename variables and add comments for clarity.
Call-outs:
Testing:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.