delta/gnutls.git/lib/auth, branch tmp-remove-debugging-code

_gnutls_proc_srp_client_kx: use same type in subtracted values

2017-08-16T08:33:45+00:00

This ensures that there are no issues with subtracting those values.
Note that the second is read from an uint16_t and thus it is always
positive regardless its type.

Resolves #244

Signed-off-by: Nikos Mavrogiannopoulos

rsa-psk: corrected memory leak on invalid decrypt

2017-08-09T13:33:01+00:00

Signed-off-by: Nikos Mavrogiannopoulos

cert selection: prioritize RSA-PSS certs over RSA

2017-08-08T14:10:51+00:00

RSA and RSA-PSS can both be used for RSA-PSS operations, and
as such without prioritizing RSA-PSS certificates it is unknown
which certificate will be used for an RSA-PSS operation. The
reason we want to have only RSA-PSS keys used for RSA-PSS operations
is to cover the use case where a server uses a legacy RSA certificate
for clients that don't support RSA-PSS and an RSA-PSS certificate
for the rest, thus separating the keys used for these client
groups. That separation ensures that any issue on PKCS#1 1.5
(legacy RSA), would not affect sessions which use RSA-PSS.

Resolves #243

Signed-off-by: Nikos Mavrogiannopoulos

gnutls_certificate_credentials_t: combine privkey into cert_st structure

2017-08-08T14:10:51+00:00

This reduces the number of applications and allows for easier
use of the structure information, as they are now self-contained
for most uses.

Signed-off-by: Nikos Mavrogiannopoulos

gnutls_pk_params_st: separate flags/qbits and curve

2017-08-08T06:30:01+00:00

Previously we were using the field flags to store the
size of q in case of GNUTLS_PK_DH, some key generation flags
in case of GNUTLS_PK_RSA, and the curve in case of elliptic
curve key. Separate this into multiple fields to reduce
confusion on the field.

Signed-off-by: Nikos Mavrogiannopoulos

prior to negotiating a signature check compatibility with private key

2017-08-04T14:46:18+00:00

That is, check if the private key can support the public key operation
needed for the signature. That in particular includes, excluding the
Ed25519 and RSA-PSS from being used with the 'EXT' keys as the
current API cannot handle them, and RSA-PSS from being used by PKCS#11
RSA keys which do not provide the CKM_RSA_PKCS_PSS mechanism.

Relates #234
Resolves #209

Signed-off-by: Nikos Mavrogiannopoulos

handshake: select a signature algorithm early

2017-08-04T11:54:42+00:00

That is, select the signature algorithm at the point the certificate and
ciphersuites are decided. Also ensure that a compatible signature algorithm
with the ciphersuite and the key is selected.

That prevents situations where a ciphersuite and a certificate are
negotiated, but later on the handshake we figure that there are no
common signature algorithms.

Signed-off-by: Nikos Mavrogiannopoulos

cleanup: removed duplicate parameter in gnutls_pubkey_st

2017-08-03T09:57:52+00:00

Signed-off-by: Nikos Mavrogiannopoulos

security_parameters: ease access to group information by keeping pointer to it

2017-08-02T06:26:32+00:00

Signed-off-by: Nikos Mavrogiannopoulos

security_parameters: simplified contents by keeping pointer to cipher_suite_entry_st

2017-08-02T06:26:28+00:00

That, in addition to simplifying the contents, it allows faster access
to ciphersuite's properties.

Signed-off-by: Nikos Mavrogiannopoulos