| commit | 5bcaa113e285b98f8d8ebbf9f5f5a991fc95e307 | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Sat Dec 16 15:34:00 2017 -0500 |
| committer | CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> | Wed Jan 03 22:15:11 2018 +0000 |
| tree | efa5f27762239e861f07f88ca7a96a1dafa59d46 | |
| parent | e15019572b3294e3410a4ee6d4bcbbf76450df31 [diff] |
Tighten EC_KEY's association with its group. This is to simplify https://boringssl-review.googlesource.com/c/boringssl/+/24445/. Setting or changing an EC_KEY's group after the public or private keys have been configured is quite awkward w.r.t. consistency checks. It becomes additionally messy if we mean to store private keys as EC_SCALARs (and avoid the BIGNUM timing leak), whose size is curve-dependent. Instead, require that callers configure the group before setting either half of the keypair. Additionally, reject EC_KEY_set_group calls that change the group. This will simplify clearing one more BIGNUM timing leak. Update-Note: This will break code which sets the group and key in a weird order. I checked calls of EC_KEY_new and confirmed they all set the group first. If I missed any, let me know. Change-Id: Ie89f90a318b31b6b98f71138e5ff3de5323bc9a6 Reviewed-on: https://boringssl-review.googlesource.com/24425 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
There are other files in this directory which might be helpful: