| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix:harden const time operation and clear sensitive data in asm implementation Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1807 | 10 天前 | |
Fixing the RSA 512-bit flipping issue Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1798 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1816 | 9 天前 | |
Fix code review issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1374 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1395 | 3 个月前 | |
fix: address security review findings on rsa, bn, sha2, mldsa, cmac and CI - ci: run the riscv64 self-hosted job on push only, so untrusted PR code cannot execute on the self-hosted runner - sha2: gate the multi-buffer SHA256 path on the ARM SHA2 extension at init to avoid SIGILL on cores without it; add missing input checks to the one-shot CRYPT_SHA256_MB - mldsa: decrement the loop counter in the ARMv8 UseHint32/88 routines; the missing decrement emitted a 17th 64-byte chunk store, writing 64 bytes past each w[i] polynomial during signature verification. Add an SDV case with a canary after the last polynomial to guard the bound - rsa: reject inLen < 2 in CRYPT_RSA_VerifyPkcsV15Type2TLS before reading in[0]/in[1] to prevent an out-of-bounds read with a malformed short modulus - bn: BN_GenPrime now retries only on a composite candidate and aborts on real errors, preventing an infinite loop when the rand source fails persistently (aligned with OpenSSL behavior) - cmac: replace NULL + 0 pointer arithmetic on empty updates with an index loop to remove undefined behavior - curve25519: clear the partially duplicated key context on the DupCtx failure path - benchmark: reject -l values beyond the fixed buffer size Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1803 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1816 | 9 天前 | |
feat(sm9): remove key exchange capability Remove all SM9 key exchange functionality including algorithm implementation, EAL layer, CTRL commands, test cases, and cmake options. Sign and encrypt operations remain fully functional. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1412 | 3 个月前 | |
fix:bug fix of pki 、cms and cpdecskey 1:The value of unusedBits may not be zero. 2: Side-channel issues 3: Inconsistency between version field and standard 4: CMS streaming signature performs the signature operation twice 5: Annotation issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1769 | 21 天前 | |
fix:fix issues on resources leakage, sensitive information etc. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1760 | 24 天前 | |
fix: reject out-of-subgroup DH peer public keys Port the DH half of 49db3e46 (fix: validate DH and DSA finite-field groups). Range checks alone do not prove that a peer public key belongs to the configured q-order subgroup. Reject custom-group peer keys unless y^q mod p is one before performing the private exponentiation, and keep the range-only fast path for known safe-prime groups. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1741 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1800 | 13 天前 | |
fix: harden entropy/rand handling and CMS streaming verification Add timestamp entropy startup auto-tests and related SDV coverage, preserve seed DRBG lock and rand fallback across provider/libctx teardown, and fix detached CMS streaming verification without signedAttrs while aligning key checks and build dependencies. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1451 | 3 个月前 | |
Fixed missing validation and memory issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1612 | 2 个月前 | |
fix(kdf): pass non-NULL out-param in CRYPT_EAL_KdfIsValidAlgId EAL_KdfFindMethod rejects a NULL method pointer with CRYPT_NULL_INPUT, so the previous call EAL_KdfFindMethod(id, NULL) made CRYPT_EAL_KdfIsValidAlgId return false for every algorithm ID, including valid ones. apps/src/app_list.c filters HKDF/PBKDF2/KDFTLS12 listings through this API, so the CLI printed empty KDF sections. Use a local EAL_KdfMethod probe like CRYPT_EAL_CipherIsValidAlgId does. Adds SDV_CRYPTO_EAL_KDF_API_ERR_TC001 covering valid IDs (true) and CRYPT_KDF_MAX (false); fails before the fix, passes after. Closes #199 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1680 | 1 个月前 | |
fix:fix issues of cms and CRYPT_EAL_CleanUp for PROVIDER_RAND bit Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1499 | 3 个月前 | |
fix:harden const time operation and clear sensitive data in asm implementation Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1807 | 10 天前 | |
Fix sizeof enumeration error Signed-off-by: balabala-123 <guozhang4@huawei.com> | 6 个月前 | |
fix: replace unsafe memory clearing functions with secure alternatives Replace memset/BSL_SAL_FREE with BSL_SAL_CleanseData/BSL_SAL_ClearFree to prevent sensitive data leakage. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1313 | 3 个月前 | |
Fix the issue where SM4-HCTR context copying still copies by default 4096 bytes after the internal cache expansio Fix the issue where SM4-HCTR context copying still copies by default 4096 bytes after the internal cache expansion, and instead copy and release based on the actual dataBuffer.bufSize of the source context. Also, add regression test cases for CipherDupCtx + Final when the cache size exceeds the default. Synchronize the correction of the relative paths in the macOS SDV reproduction commands in the Chinese and English test guides, changing from entering the script directory from the build directory to cd .. /testcode/script Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1437 | 3 个月前 | |
fix:Clean up sensitive data and fix some code issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1500 | 3 个月前 | |
Harden FrodoKEM secret-key handling against timing leaks Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1701 | 1 个月前 | |
Add context copy capability for cipher, kdf and MAC algorithms. | 7 个月前 | |
Ingore the reinit return value that does not fail. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1825 | 3 天前 | |
fix:Fixed issues with CMAC sensitive data not being cleared and HMAC error return values being ignored. Signed-off-by: dsy678 <dongshunyu1@huawei.com> Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1828 | 4 天前 | |
Standardize the naming of external structures Co-authored-by: jchx<chenqi180@huawei.com> # message auto-generated for no-merge-commit merge: !1147 merge 03 into openhitls-0.3 Standardize the naming of external structures Created-by: jchx Commit-by: jchx Merged-by: liwei3013 Description: <!-- 感谢您提交 Pull Request！以下是一些提示： 1) 如果您是第一次提交，请阅读我们的贡献者指南：https://gitcode.com/openHiTLS/openhitls/wiki/FAQ-社区需求贡献流程.md --> **此 PR 的作用 / 为什么需要它**： **自检清单**： - [ ] **测试**：代码是否已有UT/ST测试用例覆盖，新增测试用例是否随本PR一并上库 - [ ] **接口**：是否涉及对外接口变更，变更已通过接口评审 - [ ] **文档**：是否涉及文档修改 <!-- **给审查者的特别说明**： --> <!-- + - [ ] 是否导致无法前向兼容 --> <!-- + - [ ] 是否涉及依赖的三方库变更 --> See merge request: openHiTLS/openhitls!1147 | 5 个月前 | |
fix: decouple xmssmt from xmss dispatch Decouple XMSSMT keymgmt, sign, decoder, provider, and EAL dispatch from XMSS in the openhitls-0.3 subset. Fix XMSS/XMSSMT XDR parameter handling, build guards, feature/macro dependencies, and repeated SetParaById checks. Add subset SDV coverage and RFC 9802 XMSSMT X.509 certificate vectors. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1599 | 2 个月前 | |
crypto: add Paillier HE provider load Add a simple Paillier provider for homomorphic add, multiply, message encode and decode callbacks, and cover provider pkey context creation and successful provider unload in the SDV Paillier test suite. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1672 | 1 个月前 | |
Ingore the reinit return value that does not fail. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1825 | 3 天前 | |
fix:remove uio overflow check and param maker free Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1827 | 3 天前 | |
Correction of crypto error stack Co-authored-by: xuzhengyi<xuzhengyi1@h-partners.com> # message auto-generated for no-merge-commit merge: !1016 merge cherry-pick-mr-944-1768913527687-auto into openhitls-0.3 Correction of crypto error stack Created-by: liwei3013 Commit-by: xuzhengyi Merged-by: dumb Description: <!-- 感谢您提交 Pull Request！以下是一些提示： 1) 如果您是第一次提交，请阅读我们的贡献者指南：https://gitcode.com/openHiTLS/openhitls/wiki/FAQ-社区需求贡献流程.md --> **此 PR 的作用 / 为什么需要它**： **自检清单**： - [ ] **测试**：代码是否已有UT/ST测试用例覆盖，新增测试用例是否随本PR一并上库 - [ ] **接口**：是否涉及对外接口变更，变更已通过接口评审 - [ ] **文档**：是否涉及文档修改 <!-- **给审查者的特别说明**： --> <!-- + - [ ] 是否导致无法前向兼容 --> <!-- + - [ ] 是否涉及依赖的三方库变更 --> See merge request: openHiTLS/openhitls!1016 | 7 个月前 | |
fix: various PQC bugfixes for SLH-DSA, ML-DSA Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1572 | 2 个月前 | |
fix:fix issues on resources leakage, sensitive information etc. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1760 | 24 天前 | |
feat:Modification of the final interface use cases for the symmetric algorithm and code synchronization. 1:set flags can only use in dec. 2:testcase repair and supplementation Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1769 | 21 天前 | |
Fixing the RSA 512-bit flipping issue Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1798 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1816 | 9 天前 | |
Ingore the reinit return value that does not fail. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1825 | 3 天前 | |
Update ISO_19790_PROVIDER_VERSION Signed-off-by: dsy678 <dongshunyu1@huawei.com> Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1781 | 18 天前 | |
Ingore the reinit return value that does not fail. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1825 | 3 天前 | |
fix:Fixed some function-related issues. Signed-off-by: dsy <dongshunyu1@huawei.com> Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1388 | 3 个月前 | |
fix inappropriate memory free and delete the redundant AARCH64_PACIASP | 6 个月前 | |
fix: address security review findings on rsa, bn, sha2, mldsa, cmac and CI - ci: run the riscv64 self-hosted job on push only, so untrusted PR code cannot execute on the self-hosted runner - sha2: gate the multi-buffer SHA256 path on the ARM SHA2 extension at init to avoid SIGILL on cores without it; add missing input checks to the one-shot CRYPT_SHA256_MB - mldsa: decrement the loop counter in the ARMv8 UseHint32/88 routines; the missing decrement emitted a 17th 64-byte chunk store, writing 64 bytes past each w[i] polynomial during signature verification. Add an SDV case with a canary after the last polynomial to guard the bound - rsa: reject inLen < 2 in CRYPT_RSA_VerifyPkcsV15Type2TLS before reading in[0]/in[1] to prevent an out-of-bounds read with a malformed short modulus - bn: BN_GenPrime now retries only on a composite candidate and aborts on real errors, preventing an infinite loop when the rand source fails persistently (aligned with OpenSSL behavior) - cmac: replace NULL + 0 pointer arithmetic on empty updates with an index loop to remove undefined behavior - curve25519: clear the partially duplicated key context on the DupCtx failure path - benchmark: reject -l values beyond the fixed buffer size Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1803 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1816 | 9 天前 | |
Fix the using of the x18 register in the AArch64 assembly code The x18 register in ShadowCallStack(SCS) is reserved for storing the shadow stack(-ffixed-x18, -fsanitize=shadow-call-stack). It cannot be regarded as a common register and modified randomly. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1272 | 4 个月前 | |
fix(crypto/siphash): fix Reinit/FreeCtx/Deinit sensitive data handling - Reinit: restore key-derived init state instead of zeroing - FreeCtx: cleanse context before free - Deinit: cleanse entire context, preserve algorithm config - Init: reset runtime state for safe repeated calls Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1341 | 3 个月前 | |
feat:Rename slhdsa algorithm internal interface Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1712 | 1 个月前 | |
fix sm2 verify authentication Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1788 | 17 天前 | |
Correction of crypto error stack Co-authored-by: xuzhengyi<xuzhengyi1@h-partners.com> # message auto-generated for no-merge-commit merge: !1016 merge cherry-pick-mr-944-1768913527687-auto into openhitls-0.3 Correction of crypto error stack Created-by: liwei3013 Commit-by: xuzhengyi Merged-by: dumb Description: <!-- 感谢您提交 Pull Request！以下是一些提示： 1) 如果您是第一次提交，请阅读我们的贡献者指南：https://gitcode.com/openHiTLS/openhitls/wiki/FAQ-社区需求贡献流程.md --> **此 PR 的作用 / 为什么需要它**： **自检清单**： - [ ] **测试**：代码是否已有UT/ST测试用例覆盖，新增测试用例是否随本PR一并上库 - [ ] **接口**：是否涉及对外接口变更，变更已通过接口评审 - [ ] **文档**：是否涉及文档修改 <!-- **给审查者的特别说明**： --> <!-- + - [ ] 是否导致无法前向兼容 --> <!-- + - [ ] 是否涉及依赖的三方库变更 --> See merge request: openHiTLS/openhitls!1016 | 7 个月前 | |
fix:harden const time operation and clear sensitive data in asm implementation Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1807 | 10 天前 | |
Fixed missing validation and memory issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1612 | 2 个月前 | |
fix: decouple xmssmt from xmss dispatch Decouple XMSSMT keymgmt, sign, decoder, provider, and EAL dispatch from XMSS in the openhitls-0.3 subset. Fix XMSS/XMSSMT XDR parameter handling, build guards, feature/macro dependencies, and repeated SetParaById checks. Add subset SDV coverage and RFC 9802 XMSSMT X.509 certificate vectors. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1599 | 2 个月前 | |
docs: clarify stateful signing key handling Document the security requirements for XMSS and XMSSMT public APIs: - require a single active owner for each private-key state - prohibit signing with contexts inherited across fork - persist updated state after every signing attempt - prevent reuse or rollback of exported state snapshots - clarify that duplicated contexts contain public-key material only - add missing XMSSMT API documentation - propagate the requirements to certificate, CSR, and CRL signing APIs Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1703 | 1 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 10 天前 | ||
| 9 天前 | ||
| 3 个月前 | ||
| 9 天前 | ||
| 3 个月前 | ||
| 21 天前 | ||
| 24 天前 | ||
| 13 天前 | ||
| 3 个月前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 3 个月前 | ||
| 10 天前 | ||
| 6 个月前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 3 天前 | ||
| 4 天前 | ||
| 5 个月前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 3 天前 | ||
| 3 天前 | ||
| 7 个月前 | ||
| 2 个月前 | ||
| 24 天前 | ||
| 21 天前 | ||
| 9 天前 | ||
| 3 天前 | ||
| 18 天前 | ||
| 3 天前 | ||
| 3 个月前 | ||
| 6 个月前 | ||
| 9 天前 | ||
| 4 个月前 | ||
| 3 个月前 | ||
| 1 个月前 | ||
| 17 天前 | ||
| 7 个月前 | ||
| 10 天前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 1 个月前 |