1. 12 Oct, 2020 1 commit
    • Kevin Jacobs's avatar
      Bug 1631890 - Add support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke-05). r=mt · bd4ef1c9
      Kevin Jacobs authored
      This patch adds support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke-05).
      
      Because the draft number (and the eventual RFC number) is an input to the key schedule, future updates will *not* be backwards compatible in terms of key material or encryption/decryption. For this reason, a default compilation will produce stubs that simply return an "Invalid Algorithm" error. To opt into using the HPKE functionality , compile with `NSS_ENABLE_DRAFT_HPKE` defined. Once finalized, this flag will not be required to access the functions.
      
      Lastly, the `DeriveKeyPair` API is not implemented as it adds complextiy around PKCS #11 and is unnecessary for ECH.
      
      Differential Revision: https://phabricator.services.mozilla.com/D73947
      
      --HG--
      extra : moz-landing-system : lando
      bd4ef1c9
  2. 05 May, 2020 2 commits
  3. 06 Jan, 2020 1 commit
  4. 02 Dec, 2019 1 commit
  5. 05 Nov, 2019 1 commit
  6. 27 Sep, 2019 1 commit
  7. 29 Aug, 2019 1 commit
  8. 10 Jul, 2019 1 commit
  9. 15 Jul, 2019 1 commit
    • Martin Thomson's avatar
      Bug 1563078 - Set authKeyBits for delegated credentials, r=jcj · ab49f550
      Martin Thomson authored
      The delegated credentials patch left the channel info unmodified, which meant
      that it reported the key strength of the end entity certificate and not the
      delegated credential.  For a using application, this is problematic because it
      can't access information about delegated credentials.  In this case, the only
      omission was the strength of the key.
      
      Firefox checks key strength for the entire certificate chain according to its
      policies, but it also wants to apply the same sort of policy to the delegated
      credential.  In particular, it wants to ensure that an RSA credential (which
      shouldn't be used, but whatever...) has a long enough modulus, because the NSS
      policy is less strict than the Firefox one.
      
      To address this use case, SSLChannelInfo.authKeyBits is set to the length of the
      delegated credential key when delegated credentials are in use.  This is
      consistent with the definition of the parameter, but implies a different
      understanding of its meaning when delegated credentials are enabled.
      
      Differential Revision: https://phabricator.services.mozilla.com/D36699
      
      --HG--
      extra : rebase_source : f0da859a0c947fc816a98984607687f8fddf8e0d
      ab49f550
  10. 25 Jun, 2019 1 commit
    • Martin Thomson's avatar
      Bug 1558681 - Anti-replay contexts, r=jcj,kjacobs · 601f3e1f
      Martin Thomson authored
      Stop using a global anti-replay context and enable creating a context directly.
      This increases the overhead of managing anti-replay for applications marginally,
      but allows much greater flexibility in use of anti-replay mechanisms.  In
      particular, it enables the testing of 0-RTT in a threaded environment.
      
      The comments in sslexp should be clear enough in explaining how this works.
      Basically, this is a new reference-counted object that can be created and
      tracked by applications.
      
      The only thing that I can see might be a problem with the API is that I haven't
      exposed a function to add a reference for use by applications.  My thinking is
      that reference counting is an internal thing; it seems like applications won't
      need to worry about that.
      
      selfserv is updated to create a context and attach it to sockets.  This shows
      that the management overhead is minor.
      
      The gtests have been tweaked to create a context during setup. The context is
      owned by the overall test framework and is passed to server instances after the
      sockets are initialized.
      
      Bonus changes:
      
      * ESNI keys are copied from the model socket when calling SSL_ReConfigFD().
      * Some better tracing in the anti-replay functions.
      
      Neither of these seemed worth the overhead of a bug to fix.
      
      Differential Revision: https://phabricator.services.mozilla.com/D34660
      
      --HG--
      extra : rebase_source : ded5e9a70c76a6c4178d374aa8bcbce158abc505
      extra : absorb_source : 54a054bc14ab32fd1b671f53381cdeaa48a001ef
      601f3e1f
  11. 03 Jun, 2019 1 commit
  12. 31 May, 2019 2 commits
  13. 08 Apr, 2019 1 commit
    • Daiki Ueno's avatar
      Bug 1532312, recognize certificate_required alert, r=mt · e98c5e11
      Daiki Ueno authored
      Summary: Some servers send a certificate_required alert when the client returns no certificate while it is required.  For server, it is not mandatory to send this alert, but it could make it easier for the client to distinguish bad_certificate and the declined cases.
      
      Reviewers: mt
      
      Reviewed By: mt
      
      Bug #: 1532312
      
      Differential Revision: https://phabricator.services.mozilla.com/D22083
      
      --HG--
      extra : amend_source : fbf8b92659c03ff43141d3aee9a590b6a29ceeba
      e98c5e11
  14. 10 Dec, 2018 1 commit
  15. 17 Feb, 2019 2 commits
  16. 08 Nov, 2018 1 commit
  17. 23 Oct, 2018 1 commit
  18. 03 Aug, 2018 1 commit
    • Franziskus Kiefer's avatar
      Bug 1479787 - build mozpkix as part of NSS, r=mt,keeler · 53850b92
      Franziskus Kiefer authored
      Differential Revision: https://phabricator.services.mozilla.com/D2719
      Differential Revision: https://phabricator.services.mozilla.com/D2720
      Differential Revision: https://phabricator.services.mozilla.com/D2861
      
      --HG--
      rename : cpputil/scoped_ptrs.h => cpputil/nss_scoped_ptrs.h
      rename : lib/mozpkix/test/gtest/README.txt => gtests/mozpkix_gtest/README.txt
      rename : lib/mozpkix/test/gtest/pkixbuild_tests.cpp => gtests/mozpkix_gtest/pkixbuild_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcert_extension_tests.cpp => gtests/mozpkix_gtest/pkixcert_extension_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcert_signature_algorithm_tests.cpp => gtests/mozpkix_gtest/pkixcert_signature_algorithm_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_CheckExtendedKeyUsage_tests.cpp => gtests/mozpkix_gtest/pkixcheck_CheckExtendedKeyUsage_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_CheckIssuer_tests.cpp => gtests/mozpkix_gtest/pkixcheck_CheckIssuer_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_CheckKeyUsage_tests.cpp => gtests/mozpkix_gtest/pkixcheck_CheckKeyUsage_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_CheckSignatureAlgorithm_tests.cpp => gtests/mozpkix_gtest/pkixcheck_CheckSignatureAlgorithm_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_CheckValidity_tests.cpp => gtests/mozpkix_gtest/pkixcheck_CheckValidity_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_ParseValidity_tests.cpp => gtests/mozpkix_gtest/pkixcheck_ParseValidity_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixcheck_TLSFeaturesSatisfiedInternal_tests.cpp => gtests/mozpkix_gtest/pkixcheck_TLSFeaturesSatisfiedInternal_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixder_input_tests.cpp => gtests/mozpkix_gtest/pkixder_input_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixder_pki_types_tests.cpp => gtests/mozpkix_gtest/pkixder_pki_types_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixder_universal_types_tests.cpp => gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixgtest.cpp => gtests/mozpkix_gtest/pkixgtest.cpp
      rename : lib/mozpkix/test/gtest/pkixgtest.h => gtests/mozpkix_gtest/pkixgtest.h
      rename : lib/mozpkix/test/gtest/pkixnames_tests.cpp => gtests/mozpkix_gtest/pkixnames_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp => gtests/mozpkix_gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
      rename : lib/mozpkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp => gtests/mozpkix_gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
      rename : lib/mozpkix/test/lib/pkixtestnss.h => lib/mozpkix/include/pkix-test/pkixtestnss.h
      rename : lib/mozpkix/test/lib/pkixtestutil.h => lib/mozpkix/include/pkix-test/pkixtestutil.h
      rename : lib/mozpkix/lib/pkixcheck.h => lib/mozpkix/include/pkix/pkixcheck.h
      rename : lib/mozpkix/lib/pkixder.h => lib/mozpkix/include/pkix/pkixder.h
      rename : lib/mozpkix/lib/pkixutil.h => lib/mozpkix/include/pkix/pkixutil.h
      rename : lib/mozpkix/test/lib/pkixtestalg.cpp => lib/mozpkix/test-lib/pkixtestalg.cpp
      rename : lib/mozpkix/test/lib/pkixtestnss.cpp => lib/mozpkix/test-lib/pkixtestnss.cpp
      rename : lib/mozpkix/test/lib/pkixtestutil.cpp => lib/mozpkix/test-lib/pkixtestutil.cpp
      extra : rebase_source : 7b1375fef0c8e0c361f44d16f69c31d0bd6d0b41
      53850b92
  19. 01 May, 2018 1 commit
  20. 26 Jun, 2018 1 commit
  21. 17 Mar, 2018 1 commit
  22. 14 Feb, 2018 1 commit
  23. 16 Jan, 2018 1 commit
  24. 21 Jan, 2018 1 commit
    • EKR's avatar
      Bug 1429475: Tests for delayed failure and be more aggressive about making... · d2b3c946
      EKR authored
      Bug 1429475: Tests for delayed failure and be more aggressive about making failures persistent. r=mt, wtc
      
      Summary:
      - Make any call to ssl3_GatherCompleteHandshake (which transitively
        means any read from the wire) return PR_IO_ERROR if an alert has
        been sent.
      
      - Patch up a few of the tests to handle this new behavior properly.
        These tests actually were a bit harder to follow so they should
        also be a bit clearer.
      
      - Add a new set of tests for certificate authentication failure.
      
      Reviewers: mt
      
      Differential Revision: https://phabricator.services.mozilla.com/D365
      
      d2b3c946
  25. 28 May, 2018 1 commit
  26. 18 May, 2018 1 commit
  27. 16 May, 2018 1 commit
  28. 07 Sep, 2017 1 commit
  29. 04 Sep, 2017 1 commit
  30. 10 Aug, 2017 1 commit
  31. 16 Jul, 2017 1 commit
  32. 03 Jul, 2017 1 commit
  33. 01 Aug, 2017 1 commit
  34. 27 Jun, 2017 1 commit
  35. 12 Oct, 2017 1 commit
  36. 08 Jun, 2017 1 commit
  37. 30 Apr, 2017 1 commit