Create a DRBG for s2n by colmmacc · Pull Request #61 · aws/s2n-tls

colmmacc · 2015-03-12T17:47:33Z

This pull request adds a NIST SP800-90A conformant CTR_DRBG, which removes /dev/urandom as our bottleneck. Some high-lights:

It uses AES128 CTR as the generator. I'd like to replace this with ChaCha20, but this is not yet in regular OpenSSL.
Every thread gets two DRBG instances: one for private data and one for public. These are in thread local storage and new threads will get their own DRBGs (there are tests for this). Process inheritance is handled with pthread_atfork, or minherit() where available - in either case the DRBGs are re-initialized on fork().
NIST test vectors have been added and the DRBG produces output that matches these test vectors.
The DRBG is approximately 200 times faster than reading from /dev/urandom on my platforms.

This change refactors s2n's entropy handling to be able to use a DRBG. The DRBG included is simply the stream output of AES256-CTR and is not yet conformant with NIST SP 800-90A, which will come in a subsequent commit. Highlights: s2n_drbg emulates the NIST DRBG API and generates bits and automatically reseeds itself. s2n_get_public_random_data / s2n_get_private_random_data have been added, each backed by different DRBG instantiations. s2n_get_random_data -> s2n_get_urandom_data all of the random generators have been factored to produce blobs The TLS code has been modified to use the public random data where appropriate. The OpenSSL over-ride now uses the private random data. The public/private DRBGs are kept in thread-local storage: so every thread gets its own automatically. Defensiveness against fork()'ing has been added, including support for minherit() where available. Tests have been added and tweak, including full coverage of the multi-thread and multi-process cases.

This change makes our DRBG conformant with NIST SP800-90A and now matches the NIST test vectors.

Conflicts: error/s2n_errno.c error/s2n_errno.h

baldwinmatt · 2015-03-24T15:17:38Z

crypto/s2n_drbg.c

do we need to call aes_free(&ctx) when we are done with it?

So there's no aes_free() because it's a flat struct that isn't malloc()'d, but this is a good call out. I've restructured things to move the AES_KEY into the drbg struct. I've added an s2n_drbg_wipe call to zero that key and all other DRBG context, and I now wipe the DRBGs from s2n_cleanup().

baldwinmatt · 2015-03-24T15:33:11Z

first pass i was mainly looking at the code layout, looks good.

i'll go through again with the NIST docs at my side - oh and i trust you constructed your test vectors correctly! :)

This change also creates a define for S2N_DRBG_BLOCK_SIZE for the underlying CTR block size.

This change moves the AES_KEY context to the drbg struct, rather than on a function stack, and adds an s2n_drbg_wipe() call to explicitly wipe all of the DRBG state. The public/private DRBGs are now also wiped when s2n_cleanup is called.

This commit makes the DRBG useable with BoringSSL and fixes a few Ubuntu GCC warnings/errors: * DRBG code now uses the EVP interface, which is the only working interface that BoringSSL provides * Fix several zero initialization and cast warnings detected by Ubuntu GCC

Conflicts: tests/unit/s2n_handshake_test.c

baldwinmatt · 2015-04-01T23:26:07Z

Just need to check your nist vectors :)

i'll email you the results of the valgrind, but looks like we are leaking the cipher ctx, in the test at least. a call to s2n_drbg_wipe might be in order at the end of the test, here is an example:

==32339== 3,432 bytes in 13 blocks are definitely lost in loss record 9 of 9
==32339== at 0x4C2CFA7: malloc (vg_replace_malloc.c:296)
==32339== by 0x50739C5: EVP_CipherInit_ex (cipher.c:166)
==32339== by 0x5073CF4: EVP_EncryptInit_ex (cipher.c:239)
==32339== by 0x5067D18: s2n_drbg_update (in /home/local/ANT/baldwinm/dev/awslabs/s2n-baldwinm/lib/libs2n.so)
==32339== by 0x506809A: s2n_drbg_generate (in /home/local/ANT/baldwinm/dev/awslabs/s2n-baldwinm/lib/libs2n.so)
==32339== by 0x4010AE: main (s2n_drbg_test.c:173)
==32339==
{
<insert_a_suppression_name_here>
Memcheck:Leak
match-leak-kinds: definite
fun:malloc
fun:EVP_CipherInit_ex
fun:EVP_EncryptInit_ex
fun:s2n_drbg_update
fun:s2n_drbg_generate
fun:main
}

Per feedback in #61

baldwinmatt · 2015-04-03T14:57:48Z

crypto/s2n_drbg.c

do we want to ensure we don't overflow this?

although unlikely, it's still possible. what is the impact?

The generation variable isn't exposed by any API and it's only used in one place: the unit test. The reason it's there is so that a unit test could cover the case where we cross the 2^35 boundary and check that we reseed the DRBG. I think it's ok to let it overflow. It will overflow only after a DRBG has created 2^97 bits of data.

baldwinmatt · 2015-04-03T20:08:11Z

Ok, I like that better - tested your test vectors and they are all correct :)

merging!

Create a DRBG for s2n

colmmacc · 2015-04-03T20:35:52Z

Thanks! I appreciate the review and especially for digging through the NIST docs and test vectors. I know it makes the review at least 10 times more work than reading the code alone!

This change also creates a define for S2N_DRBG_BLOCK_SIZE for the underlying CTR block size.

Per feedback in #61

Create a DRBG for s2n

1. Add necessary cbmc-proofs.txt file to contracts-based proof directories. 2. Update PROOF_UID for some contracts-based proofs. 3. Remove occurrences where text was appended to variables, such as this one: FUNCTION_NAME = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy PROOF_UID = $(FUNCTION_NAME)_with_contracts HARNESS_ENTRY = $(PROOF_UID)_harness HARNESS_FILE = $(HARNESS_ENTRY).c The above approach doesn't yield the expected variables of: PROOF_UID = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy_with_contracts I changed all "$(VARIABLE_NAME)" occurrences with the string itself.

)" This reverts commit 4001add.

1. Add necessary cbmc-proofs.txt file to contracts-based proof directories. 2. Update PROOF_UID for some contracts-based proofs. 3. Remove occurrences where text was appended to variables, such as this one: FUNCTION_NAME = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy PROOF_UID = $(FUNCTION_NAME)_with_contracts HARNESS_ENTRY = $(PROOF_UID)_harness HARNESS_FILE = $(HARNESS_ENTRY).c The above approach doesn't yield the expected variables of: PROOF_UID = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy_with_contracts I changed all "$(VARIABLE_NAME)" occurrences with the string itself.

)" This reverts commit 4001add.

1. Add necessary cbmc-proofs.txt file to contracts-based proof directories. 2. Update PROOF_UID for some contracts-based proofs. 3. Remove occurrences where text was appended to variables, such as this one: FUNCTION_NAME = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy PROOF_UID = $(FUNCTION_NAME)_with_contracts HARNESS_ENTRY = $(PROOF_UID)_harness HARNESS_FILE = $(HARNESS_ENTRY).c The above approach doesn't yield the expected variables of: PROOF_UID = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy_with_contracts I changed all "$(VARIABLE_NAME)" occurrences with the string itself.

)" This reverts commit 4001add.

1. Add necessary cbmc-proofs.txt file to contracts-based proof directories. 2. Update PROOF_UID for some contracts-based proofs. 3. Remove occurrences where text was appended to variables, such as this one: FUNCTION_NAME = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy PROOF_UID = $(FUNCTION_NAME)_with_contracts HARNESS_ENTRY = $(PROOF_UID)_harness HARNESS_FILE = $(HARNESS_ENTRY).c The above approach doesn't yield the expected variables of: PROOF_UID = __CPROVER_file_local_s2n_hash_c_s2n_evp_hash_copy_with_contracts I changed all "$(VARIABLE_NAME)" occurrences with the string itself.

)" This reverts commit 4001add.

# This is the 1st commit message: ci: remove S2N_TEST_IN_FIPS_MODE (aws#4994) # This is the commit message aws#2: Migrate PQ Rust code to TLS 1.3 (aws#4998) # This is the commit message aws#3: chore: add new team member (aws#5006) # This is the commit message aws#4: chore(s2n-tls-hyper): Publish s2n-tls-hyper (aws#5000) # This is the commit message aws#5: ci: add script to help launch stuck codebuild jobs (aws#5004) # This is the commit message aws#6: ci: config logging for integration tests (aws#4751) Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com> # This is the commit message aws#7: Migrate PQ Python code to TLS 1.3 (aws#4999) # This is the commit message aws#8: fix: don't prefix empty string when interning (aws#5015) # This is the commit message aws#9: chore: remove unused imports (aws#5017) # This is the commit message aws#10: fix(bindings/bench): Prevent IO from going out of scope (aws#5007) # This is the commit message aws#11: ci: commit integrationv2 small batch spec (aws#5020) # This is the commit message aws#12: ci: keep start_codebuild.sh up-to-date (aws#5023) # This is the commit message aws#13: chore: remove unused test utils (aws#5005) # This is the commit message aws#14: ci: improve output of validate_start_codebuild_script (aws#5031) # This is the commit message aws#15: refactor(bin): remove references to FIPS_mode_set (aws#5026) # This is the commit message aws#16: chore: improve the dashboard comment query (aws#5016) # This is the commit message aws#17: tests: make integV2 locally runnable (aws#5029) # This is the commit message aws#18: feature: remove openssl-1.0.2-fips fips mode support (aws#5030) # This is the commit message aws#19: chore: run more checks on pushes to main (aws#4963) # This is the commit message aws#20: fix: add build specs to copyright check (aws#5025) # This is the commit message aws#21: fix(bindings): Specify correct minimum versions (aws#5028) # This is the commit message aws#22: ci: add timeout for cbmc proof (aws#5038) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#23: test: add sslv2 client hello test w/ jvm (aws#5019) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> # This is the commit message aws#24: docs: add C / s2n-tls-sys doc references to s2n-tls docs (aws#5012) # This is the commit message aws#25: Add Security Policy Deprecation API (aws#5034) Co-authored-by: James Mayclin <maycj@amazon.com> Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> # This is the commit message aws#26: ci: add openssl-3.0-fips builds (aws#5037) # This is the commit message aws#27: fix: initial config should not influence sslv2 (aws#4987) Co-authored-by: maddeleine <59030281+maddeleine@users.noreply.github.com> # This is the commit message aws#28: chore: bindings release for 0.3.10 (aws#5046) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#29: chore: bump osx Openssl to latest (aws#5041) Signed-off-by: Rui Chen <rui@chenrui.dev> Co-authored-by: Rui Chen <rui@chenrui.dev> # This is the commit message aws#30: chore: fix typos (aws#5052) # This is the commit message aws#31: build(deps): bump cross-platform-actions/action from 0.26.0 to 0.27.0 in /.github/workflows in the all-gha-updates group (aws#5053) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#32: ci: pin duvet version (aws#5057) # This is the commit message aws#33: refactor: remove openssl-1.0.2-fips 'allow md5' logic (aws#5048) # This is the commit message aws#34: ci: Adding integ tests back to integv2 (aws#5054) # This is the commit message aws#35: refactor: cleanup CBMC proofs after aws#5048 (aws#5058) # This is the commit message aws#36: feat(bench): impl into for base config type (aws#5056) # This is the commit message aws#37: Revert "ci: remove openssl-1.0.2-fips builds (aws#4995)" (aws#5060) # This is the commit message aws#38: ci: change rust-toolchain format to toml (aws#5070) # This is the commit message aws#39: ci: Emit benchmark metrics from scheduled runs (aws#5064) # This is the commit message aws#40: fix(bindings): prevent temp connection free after panic (aws#5067) # This is the commit message aws#41: docs(integv2): add architecture diagram (aws#5072) # This is the commit message aws#42: docs(s2n-tls-hyper): Add hyper client/server example (aws#5069) # This is the commit message aws#43: ci: fix dependabot, commit & check Cargo.toml (aws#5065) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#44: fix(integration): Update PQ integration test expectations (aws#5082) # This is the commit message aws#45: fix: add support for `S2N_INTERN_LIBCRYPTO` with FetchContent (aws#5076) # This is the commit message aws#46: fix: calculation of session ticket age (aws#5001) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#47: fix: error for uninit psk, check for all-zero psk (aws#5084) # This is the commit message aws#48: fix: don't use DEPENDS with add_custom_command(TARGET) (aws#5074) # This is the commit message aws#49: fix(ci): Allow validate_start_codebuild to run on pushes to main (aws#5080) # This is the commit message aws#50: test: add minimal openssl-3.0-fips test (aws#5081) # This is the commit message aws#51: feat(bindings): add external psk apis (aws#5061) # This is the commit message aws#52: Fixed formatting for debugging statements (aws#5094) # This is the commit message aws#53: chore: ktls buildspec (aws#5083) # This is the commit message aws#54: chore: bindings release 0.3.11 (aws#5098) # This is the commit message aws#55: fix(integrationv2): Skip unsupported client auth tests (aws#5096) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#56: build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 4.1.0 in /.github/workflows in the all-gha-updates group across 1 directory (aws#5107) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#57: refactor: remove s2n_hmac_is_available (aws#5104) # This is the commit message aws#58: refactor: remove unused evp support for md5+sha1 (aws#5106) # This is the commit message aws#59: fix: allow b64 decoding using libcrypto for sidechannel resistance (aws#5103) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com> # This is the commit message aws#60: fix: don't enable custom random for openssl fips (aws#5093) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#61: ci: add default provider to openssl-3.0-fips (aws#5114) # This is the commit message aws#62: Revert "refactor: remove unused evp support for md5+sha1 (aws#5106)" (aws#5118) # This is the commit message aws#63: Add new security policy (20250211) (aws#5111) # This is the commit message aws#64: refactor: move "s2n_libcrypto_is" methods into s2n_libcrypto.h (aws#5117) # This is the commit message aws#65: bindings: unpin openssl crate from a specific patch version (aws#5120) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#66: chore: fix a typo in API comments (aws#5123) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#67: build(deps): update rand requirement (aws#5125) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#68: fix(bindings): make Context borrow immutable (aws#5071) # This is the commit message aws#69: feat: Option to disable RAND engine override (aws#5108) # This is the commit message aws#70: refactor: use EVP_MD_fetch() if available (aws#5116) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#71: chore: binding release 0.3.12 (aws#5128) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#72: fix(bindings): remove mutation behind Arc (aws#5124) # This is the commit message aws#73: chore: remove unused well-known-endpoints.py (aws#5127) # This is the commit message aws#74: feat: add async cert validation support (aws#5110) # This is the commit message aws#75: ci: add check for third-party-src in disable rand override buildspec (aws#5137) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#76: refactor: always use EVP hashing (aws#5121) # This is the commit message aws#77: fix: update callback return value (aws#5136) # This is the commit message aws#78: ci: always set values for command line defines (aws#5126) # This is the commit message aws#79: tests: use sig schemes as source of truth for valid hash+sig algs (aws#5129) # This is the commit message aws#80: build(deps): update rtshark requirement from 2.9.0 to 3.1.0 in /tests/pcap in the all-cargo-updates group across 1 directory (aws#5087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#81: test(integv2): fixes to allow test_record_padding to partially run (aws#5099) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#82: chore(nix): Add aws-lc-fips 2022/4 (aws#5109) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> # This is the commit message aws#83: Ruff Formatting and add to CI (aws#5138) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#84: feat(bindings): expose context on cert chain (aws#5132) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#85: refactor: cleanup prf header (aws#5144) # This is the commit message aws#86: refactor: add alternative EVP signing method (aws#5141) # This is the commit message aws#87: fix: memory leak during STEK rotation (aws#5146) # This is the commit message aws#88: chore(ci): make the awslc fips install script version aware (aws#5100) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#89: refactor: remove unused prf hmac impls (aws#5148) # This is the commit message aws#90: chore(bindings): change in rustup behavior (aws#5160) # This is the commit message aws#91: chore: git-blame-ignore ruff formatting (aws#5151) # This is the commit message aws#92: tests: try to make s2n_mem_usage_test more useful (aws#5139) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#93: chore(ci): pin symbolic-common (aws#5166) # This is the commit message aws#94: chore: binding release 0.3.13 (aws#5167) # This is the commit message aws#95: refactor: add libcrypto PRF impl for openssl-3.0-fips (aws#5158) # This is the commit message aws#96: build(deps): bump nixbuild/nix-quick-install-action from 29 to 30 in /.github/workflows in the all-gha-updates group (aws#5153) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#97: style: fix redundant return (aws#5150) # This is the commit message aws#98: chore: update git blame ignore commit ID (aws#5164) # This is the commit message aws#99: tests: fix flaky ja4 test (aws#5169) # This is the commit message aws#100: fix: mark chachapoly as unavailable with openssl-3.0-fips (aws#5168) # This is the commit message aws#101: fix(ruff): resolve linting errors detected by Ruff (aws#5140) # This is the commit message aws#102: chore: pin once_cell version to unblock the CI (aws#5174) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#103: ci: use ruff --diff instead of --check (aws#5177) # This is the commit message aws#104: (docs): Improve PQ docs (aws#5173) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#105: test(integv2): add partial support for OpenSSL 3.0 provider (aws#5131) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#106: ci: make start_codebuild.sh work for forks (aws#5178) # This is the commit message aws#107: chore: add inline noqa suppression (aws#5159) # This is the commit message aws#108: test: reduce parameter selection (aws#5161) # This is the commit message aws#109: test: fix self-talk pkey offload test for openssl-3.0-fips (aws#5175) # This is the commit message aws#110: build(deps): update aws-lc-rs version to remove paste deps (aws#5192) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#111: chore: bump linting action Ubuntu version (aws#5186) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#112: ci: cleanup awslc-fips versioning (aws#5156) # This is the commit message aws#113: chore: include Need By Date section in github issue template (aws#5187) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#114: ci: move openssl3fips build to existing asan build (aws#5181) # This is the commit message aws#115: fix: openssl-3.0-fips should use separate private rand (aws#5184) # This is the commit message aws#116: fix: remove unnecessary RC4 restriction (aws#5170) # This is the commit message aws#117: fix: openssl-3.0-fips should use libcrypto HKDF (aws#5183) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#118: ci: defend against unset version number in awslc installer (aws#5195) # This is the commit message aws#119: feature: openssl-3.0-fips support (aws#5191) # This is the commit message aws#120: ci: add libcrypto openssl-3.0-fips to integ tests (aws#5202) # This is the commit message aws#121: ci: add openssl-3.0-fips to asan build properly (aws#5204) # This is the commit message aws#122: fix: handshake message length integer overflow in s2n_handshake_finish_header (aws#5206) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#123: chore: deprecate s2n_set (aws#5155) # This is the commit message aws#124: chore: binding release 0.3.14 (aws#5210) # This is the commit message aws#125: Remove PQ TLS 1.2 from all Security Policies (aws#5194) # This is the commit message aws#126: ci: exclude new setuptools (aws#5215) # This is the commit message aws#127: fix: Update README.md to include Rust bindings docs (aws#5212) # This is the commit message aws#128: feat: add s2n_connection_get_key_exchange_group (aws#5209) # This is the commit message aws#129: chore: bindings release 0.3.15 (aws#5221) # This is the commit message aws#130: ci: add openssl-3.0-fips to valgrind (aws#5211) # This is the commit message aws#131: docs: fix openssl-3.0-fips provider requirements documentation (aws#5214) # This is the commit message aws#132: refactor(bindings): use implicit linking for aws-lc (aws#5218) # This is the commit message aws#133: fix: tighten session ticket lifetime (aws#5217) # This is the commit message aws#134: ci: Fix cppcheck build (aws#5238) # This is the commit message aws#135: refactor: implement match the same for all pkeys (aws#5224) # This is the commit message aws#136: ci: add openssl-3.0-fips to general batch (aws#5207) # This is the commit message aws#137: refactor: add evp pkey size/encrypt/decrypt methods (aws#5225) # This is the commit message aws#138: feat(bindings): expose certificate match api (aws#5220) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#139: ci: add ruff linting (aws#5182) # This is the commit message aws#140: ci: pin nix installer to older version (aws#5245) # This is the commit message aws#141: chore: Fix new clippy warning (aws#5243) Co-authored-by: Boquan Fang <boquanfang3@gmail.com> # This is the commit message aws#142: ci: rebalance integV2 testcases (aws#5232) # This is the commit message aws#143: fix: tainted handshake.io and add large client hello test (aws#5208) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#144: chore: bindings release 0.3.16 (aws#5242) Co-authored-by: Boquan Fang <boquanfang3@gmail.com> # This is the commit message aws#145: refactor: remove legacy pkey impls (aws#5241) # This is the commit message aws#146: Revert "ci: exclude new setuptools (aws#5215)" (aws#5226) # This is the commit message aws#147: fix: make -fPIC flag private (aws#5227) Co-authored-by: Souvik Banerjee <souvik1997@gmail.com> # This is the commit message aws#148: doc: tainted stuffer reset operation (aws#5231) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#149: feat: Expose `as_ptr()` for external build (aws#5229) # This is the commit message aws#150: ci: pytest generate junit reports (aws#5235) # This is the commit message aws#151: add compiler flag # This is the commit message aws#152: added c check x86 and correct compiler # This is the commit message aws#153: cmake fix # This is the commit message aws#154: testing # This is the commit message aws#155: removed clang # This is the commit message aws#156: Print statements # This is the commit message aws#157: compiler check # This is the commit message aws#158: print # This is the commit message aws#159: find clang # This is the commit message aws#160: branch probing # This is the commit message aws#161: removed individual probing # This is the commit message aws#162: removed old unneeded changes # This is the commit message aws#163: added back original line # This is the commit message aws#164: fixed .c file # This is the commit message aws#165: ci: use correct openssl version for updated AL2023 version (aws#5255) # This is the commit message aws#166: chore(ci): revert nix installer pin (aws#5251) # This is the commit message aws#167: ci: add awslcfips to nix jobs (aws#5205) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> # This is the commit message aws#168: moved adding options to the bottom # This is the commit message aws#169: copmiler debug prints # This is the commit message aws#170: clang printout # This is the commit message aws#171: remove setting compiler to clang # This is the commit message aws#172: set clang as default # This is the commit message aws#173: remove clang # This is the commit message aws#174: move fuzz cmake into it's own directory # This is the commit message aws#175: fixed path to fuzz # This is the commit message aws#176: back to original # This is the commit message aws#177: only branch if we're not fuzz tests # This is the commit message aws#178: add clang back now # This is the commit message aws#179: removed debugging prints # This is the commit message aws#180: removed checking for compiler # This is the commit message aws#181: testing move back original block

colmmacc added 7 commits March 7, 2015 22:09

Merge remote-tracking branch 'upstream/master'

2277990

Update DRBG to conform to NIST SP800-90C

74dcbf5

Implementation of NIST SP800-90A CTR_DRBG

1e5221b

This change makes our DRBG conformant with NIST SP800-90A and now matches the NIST test vectors.

Merge remote-tracking branch 'upstream/master'

2d9d9e6

Conflicts: error/s2n_errno.c error/s2n_errno.h

Add libcrypto README back

3bc7640

Remove stray debugging lines

b4fdcbd

colmmacc mentioned this pull request Mar 13, 2015

Issues around including a PRNG #26

Closed

Add DRBG tests, missing from previous commit

1eba749

baldwinmatt reviewed Mar 24, 2015
View reviewed changes

colmmacc added 5 commits March 24, 2015 09:26

Syntax and cleanup nits for #61

1199927

This change also creates a define for S2N_DRBG_BLOCK_SIZE for the underlying CTR block size.

Add s2n_drbg_wipe

2e76855

This change moves the AES_KEY context to the drbg struct, rather than on a function stack, and adds an s2n_drbg_wipe() call to explicitly wipe all of the DRBG state. The public/private DRBGs are now also wiped when s2n_cleanup is called.

Merge remote-tracking branch 'upstream/master'

0961c28

Conflicts: tests/unit/s2n_handshake_test.c

Merge remote-tracking branch 'upstream/master'

763cad4

colmmacc added 2 commits April 1, 2015 22:20

Wipe the DRBGs that are instantiated during test

433b222

Per feedback in #61

Free our alloc'd drbg NIST test vectors for valgrind

3f592a7

baldwinmatt reviewed Apr 3, 2015
View reviewed changes

Use the DRBG personalization string when reseeding

08b3725

baldwinmatt added a commit that referenced this pull request Apr 3, 2015

Merge pull request #61 from colmmacc/master

7483b20

Create a DRBG for s2n

baldwinmatt merged commit 7483b20 into aws:master Apr 3, 2015

colmmacc added a commit that referenced this pull request Jun 29, 2015

Syntax and cleanup nits for #61

339ac0a

This change also creates a define for S2N_DRBG_BLOCK_SIZE for the underlying CTR block size.

colmmacc added a commit that referenced this pull request Jun 29, 2015

Wipe the DRBGs that are instantiated during test

f7ae14c

Per feedback in #61

baldwinmatt added a commit that referenced this pull request Jun 29, 2015

Merge pull request #61 from colmmacc/master

2119ebf

Create a DRBG for s2n

feliperodri pushed a commit to feliperodri/s2n that referenced this pull request Dec 6, 2021

Revert "3 minor changes to re-enable generation of proof report: (aws#61

6f99015

)" This reverts commit 4001add.

feliperodri pushed a commit to feliperodri/s2n that referenced this pull request Dec 6, 2021

Revert "3 minor changes to re-enable generation of proof report: (aws#61

72e7e34

)" This reverts commit 4001add.

feliperodri pushed a commit to feliperodri/s2n that referenced this pull request Feb 15, 2022

Revert "3 minor changes to re-enable generation of proof report: (aws#61

025c255

)" This reverts commit 4001add.

feliperodri pushed a commit to feliperodri/s2n that referenced this pull request Jun 16, 2022

Revert "3 minor changes to re-enable generation of proof report: (aws#61

5a74fff

)" This reverts commit 4001add.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create a DRBG for s2n#61

Create a DRBG for s2n#61
baldwinmatt merged 16 commits intoaws:masterfrom
colmmacc:master

colmmacc commented Mar 12, 2015

Uh oh!

baldwinmatt Mar 24, 2015

Uh oh!

colmmacc Mar 25, 2015

Uh oh!

baldwinmatt commented Mar 24, 2015

Uh oh!

baldwinmatt commented Apr 1, 2015

Uh oh!

baldwinmatt Apr 3, 2015

Uh oh!

colmmacc Apr 3, 2015

Uh oh!

baldwinmatt commented Apr 3, 2015

Uh oh!

colmmacc commented Apr 3, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

colmmacc commented Mar 12, 2015

Uh oh!

baldwinmatt Mar 24, 2015

Choose a reason for hiding this comment

Uh oh!

colmmacc Mar 25, 2015

Choose a reason for hiding this comment

Uh oh!

baldwinmatt commented Mar 24, 2015

Uh oh!

baldwinmatt commented Apr 1, 2015

Uh oh!

baldwinmatt Apr 3, 2015

Choose a reason for hiding this comment

Uh oh!

colmmacc Apr 3, 2015

Choose a reason for hiding this comment

Uh oh!

baldwinmatt commented Apr 3, 2015

Uh oh!

colmmacc commented Apr 3, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants