| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix(apps): correct TLS cert, cipher names, and KDF listing Load TLS certificate/key pairs for client and server authentication. Accept HITLS_* cipher names and list valid KDF algorithms. Update CLI documentation and regression tests. Fix #203 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1691 | 2 个月前 | |
fix: harden file permissions for sensitive data and add input validation - Introduce HITLS_APP_UioOpenPrivate to create key files with 0600 permissions, replacing open-then-chmod pattern to avoid TOCTOU race - Migrate key/PKCS12/rand output paths to use private file creation - Refactor PKCS12 generation to use GenBuff + private UIO write - Add null check for confirmP.data in SPAKE2+ RespDerive - Add max length validation for private pass token challenge requests - Reject AEAD ciphers in enc command explicitly - Add 30s handshake timeout on accepted TCP connections Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1625 | 4 个月前 | |
feat: add DES, Retail MAC, Base64 UIO and crypto optimizations Add DES/TDES cipher support and ISO 7816-4 Retail MAC with context copy support. Add UIO Base64 and CRYPT_EAL_BytesToKey capabilities. Optimize the ARM64 CE/PMULL GHASH assembly path. Adapt Base64 UIO and cipher MAC buffering to the openhitls-0.3 branch. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1931 | 17 天前 | |
crypto: remove unused FIPS provider and harden MdMB/RSA checks - remove fips_prov sources and HITLS_CRYPTO_CMVP_FIPS build/test wiring - keep CMVP selftest guards scoped to ISO19790 and SM providers - validate CRYPT_EAL_MdMB update/final state transitions - check RSA param value/valueLen before reading MD and MGF IDs Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1341 | 5 个月前 | |
fix:Fixing some issues,See details for the list. List of issues: 1: The certificate time check is not considered an error if there is no callback return value of 0 at the lower level. 2: Some comment issues. 3: The provider initialization is not protected by a lock. 4: Some functions lack parameter checks. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1471 | 5 个月前 | |
fix: harden PQC key codecs and signature handling Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1764 | 3 天前 | |
fix: harden PQC key codecs and signature handling Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1764 | 3 天前 | |
fix(tls): allow internal handshake reads during HITLS_Peek RecordDecryptPrepare rejected any non-application record while peekFlag was set. The assumption that peek mode only reads application records does not hold: when a TLS 1.2 client calls HITLS_Peek and the peer requests renegotiation (HelloRequest), the renegotiation state machine legitimately reads handshake records (ServerHello etc.) inside the same Peek call, hit the check, and the connection died with HITLS_INTERNAL_EXCEPTION in CM_STATE_RENEGOTIATION. TLS 1.3 post-handshake messages driven by Peek are equally affected. The peek non-consuming semantics are already confined to application data by every RecBufListGetBuffer caller (isPeek is passed only for REC_TYPE_APP), and the DTLS read path never had this check, so remove it to align TLS with DTLS behavior. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1949 | 12 天前 |