| commit | 417069f8b2fd6dd4f8c2f5f69de7c038a2397050 | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Mon Feb 13 18:33:02 2023 -0500 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Tue Jul 11 19:05:08 2023 +0000 |
| tree | a756b9a6d276c71b0b978fc9911cef88d7a934de | |
| parent | 8267582590020ca2877592084f3a56b2f6e3209b [diff] |
Make built-in curves static. This replaces our dynamically creating singleton EC_GROUPs from curve data with static EC_GROUP instances. They're just shy of being fully static because delocate still forces us go to through CRYPTO_once to initialize structures with pointers. (Though, without delocate, the loader would need similar initialization via a runtime relocation.) This means we can now have functions like EC_group_p256(), analogous to EVP_sha256(). These are infallible functions that return const EC_GROUP pointers. Although there is an initial 2KiB hit to binary size (now we precompute a few more Montgomery values), I'm hoping it'll eventually help binaries that only use a few of the curves to drop the others. Also it removes some locks used to initialize the static curve objects, as well as removing an annoying error condition. Bug: 20 Change-Id: Id051c5439f2b2fe2b09bf10964d656503ee27d9e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/60931 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: