[Heimdal-source-changes] [heimdal/heimdal] afac43: hcrypto: Add HMAC_CTX_new and HMAC_CTX_free

Tis May 15 16:59:35 CEST 2018

  Branch: refs/heads/sxw/iovecs
  Home:   https://github.com/heimdal/heimdal
  Commit: afac436710b4c015f6c0fabc5524be38318cdb12
      https://github.com/heimdal/heimdal/commit/afac436710b4c015f6c0fabc5524be38318cdb12
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/hcrypto/hmac.c
    M lib/hcrypto/hmac.h
    M lib/hcrypto/libhcrypto-exports.def
    M lib/hcrypto/version-script.map

  Log Message:
  -----------
  hcrypto: Add HMAC_CTX_new and HMAC_CTX_free

Add a pair of functions which can be used to allocate and free
an HMAC_CTX structure on the heap. This means that the caller doesn't
need to know the size of the underlying structure.

  Commit: 6eca043847e008682761a5da30d67425c11540be
      https://github.com/heimdal/heimdal/commit/6eca043847e008682761a5da30d67425c11540be
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h

  Log Message:
  -----------
  krb5: Add _krb5_crypto_iov_should_sign helper function

Add a helper function which contains the knowledge about whether
a particular portion of a krb5_crypto_iovec should be signed or not.

  Commit: 25ec6d8f0cb2c58798c0aeb627ba73e0f06d6ddd
      https://github.com/heimdal/heimdal/commit/25ec6d8f0cb2c58798c0aeb627ba73e0f06d6ddd
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-evp.c

  Log Message:
  -----------
  krb5: Add _krb5_evp_digest_iov

Add a function which can apply an EVP message digest algorithm over
a set of iovecs to produce a signature.

  Commit: 1e2b3715228f492b1861c213427e32aad33b3d34
      https://github.com/heimdal/heimdal/commit/1e2b3715228f492b1861c213427e32aad33b3d34
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-evp.c

  Log Message:
  -----------
  krb5: Add _krb5_evp_hmac_iov

Add a function which will perform an HMAC over a set of iovecs,
using the hcrypto provided HMAC functions.

Join contiguous iovecs together before passing them to the hash
function so we make as few calls into the hash as possible.

  Commit: 56d21e9e299d043f0fe5550519e5fde0c99892d4
      https://github.com/heimdal/heimdal/commit/56d21e9e299d043f0fe5550519e5fde0c99892d4
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-aes-sha1.c
    M lib/krb5/crypto-aes-sha2.c
    M lib/krb5/crypto-arcfour.c
    M lib/krb5/crypto-des-common.c
    M lib/krb5/crypto-des.c
    M lib/krb5/crypto-des3.c
    M lib/krb5/crypto-null.c
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h
    M lib/krb5/pac.c

  Log Message:
  -----------
  krb5: Use iovecs for internal checksum handling

Modify the signature of the checksum operation in the
krb5_checksum_type structure so that it processes iovecs rather than
solid blocks of data.

Update all of the implementations of these functions for all of the
checksum types that we support so that they process iovecs, either
by iterating through the iovec in each function, or by calling
_krb5_evp_digest_iov or _krb5_evp_hmac_iov()

Update callers of these functions so that they turn their single blocks
of data into a single iovec of the correct type before calling checksum

  Commit: 2161a0c592265b0d164143a5a4bc339eefa8225a
      https://github.com/heimdal/heimdal/commit/2161a0c592265b0d164143a5a4bc339eefa8225a
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-des-common.c
    M lib/krb5/crypto-des.c
    M lib/krb5/crypto-des3.c
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h

  Log Message:
  -----------
  krb5: Use iovecs internally for checksum verification

When verifying checksums, pass iovecs through to the individual
verify routines.

  Commit: 291fad7a8e415628e0181716771751611d80683d
      https://github.com/heimdal/heimdal/commit/291fad7a8e415628e0181716771751611d80683d
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/test_rfc3961.c

  Log Message:
  -----------
  test_rfc3961: Add performance tests for HMAC-SHA1

Add a selection of performance tests for HMAC-SHA1 to the
RFC3961 library tests.

  Commit: 76ac41e2865ffd9359f12c50c67cc808f656fb43
      https://github.com/heimdal/heimdal/commit/76ac41e2865ffd9359f12c50c67cc808f656fb43
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c
    M lib/krb5/test_rfc3961.c

  Log Message:
  -----------
  krb5: Use EVP HMAC() function for HMAC-SHA1

Use the EVP HMAC() function that we use for SHA2 HMACs for SHA1 as
well.

  Commit: f79f773e3c29c4da06ab364f72e40767101eea28
      https://github.com/heimdal/heimdal/commit/f79f773e3c29c4da06ab364f72e40767101eea28
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Use iovecs throughout krb5_create_checksum_iov

Rather than flattening the iovecs supplied to
krb5_create_checksum_iov into a malloc()'d memory block, refactor
the function so that they can be passed straight through to the
backend hash functions.

  Commit: 067080918c67ee50adb096b6ead7b12b187246ad
      https://github.com/heimdal/heimdal/commit/067080918c67ee50adb096b6ead7b12b187246ad
  Author: Simon Wilkinson <sxw at your-file-system.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Reorder checks in _key_schedule

_krb5_find_enctype is a moderately expensive operation, as it
does a linear search of the enctype lists. Avoid calling it
in _key_schedule when we already have a key schedule in place.

This change makes the most common check the first in the function.

  Commit: f3f668537391734fe6a3ed26ed6bcf91bc21674d
      https://github.com/heimdal/heimdal/commit/f3f668537391734fe6a3ed26ed6bcf91bc21674d
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Implement krb5_verify_checksum_iov with iovecs

Instead of flattening the iovecs passed into
krb5_verify_checksum_iov, create a new internal verify_checksum_iov
function which passes iovecs down onto the individual ->verify or
->checksum functions.

  Commit: 9901c19a67324f0bf29c400078f2971ad14e0378
      https://github.com/heimdal/heimdal/commit/9901c19a67324f0bf29c400078f2971ad14e0378
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-aes-sha1.c
    M lib/krb5/crypto-aes-sha2.c
    M lib/krb5/crypto-arcfour.c
    M lib/krb5/crypto-des-common.c
    M lib/krb5/crypto-des.c
    M lib/krb5/crypto-des3.c
    M lib/krb5/crypto-evp.c
    M lib/krb5/crypto-null.c
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h
    M lib/krb5/pac.c
    M lib/krb5/test_rfc3961.c

  Log Message:
  -----------
  krb5: Store a digest context in the crypto structure

Creating and destroying an EVP_CTX_MD structure with every hash
operation is very expensive. Speed things up by caching one within
the krb5_crypto structure. krb5_crypto can already only be safely
used by one thread at a time - adding a message digest context here
shouldn't introduce any further threading risks.

Users of the stashed context must be careful to ensure that they
call no other hash functions whilst they are in the middle of using
the context.

  Commit: 18518752c5303dc494b3dd163853817ce873ce3a
      https://github.com/heimdal/heimdal/commit/18518752c5303dc494b3dd163853817ce873ce3a
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-aes-sha2.c
    M lib/krb5/crypto-evp.c
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h

  Log Message:
  -----------
  krb5: Stash the HMAC context in the krb5_crypto object

Store the EVP HMAC context in the krb5_crypto object so that we
don't have to allocate it for every hashing operating we perform.

  Commit: 1c874031a75c81425609c88816b444c3943f87b2
      https://github.com/heimdal/heimdal/commit/1c874031a75c81425609c88816b444c3943f87b2
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/hcrypto/hmac.c

  Log Message:
  -----------
  hcrypto: Make more buffers persist across HMAC operations

If we don't change MD algorithm across two calls to HMAC_Init_ex
using the same context, don't bother reallocating all of our buffers.

  Commit: d88ae98368e62a4da64cf7559d20d900ab310ac1
      https://github.com/heimdal/heimdal/commit/d88ae98368e62a4da64cf7559d20d900ab310ac1
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h

  Log Message:
  -----------
  krb5: Expand list of vector types that are hashed

So that we can eventually use iovec hashes with encrypt, as well
as sign operations, add CRYPTO_TYPE_HEADER and CRYPTO_TYPE_PADDING
to the list of iovecs which will be hashed.

  Commit: 639849411ac31bbabbd8a9fab852e31b2014b3f1
      https://github.com/heimdal/heimdal/commit/639849411ac31bbabbd8a9fab852e31b2014b3f1
  Author: Simon Wilkinson <sxw at your-file-system.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Actually 0 padding

When we decide we need to zero the padding iovec, do so with 0, not
with the length that we've determined.

This had no effect because we zero the padding properly later, but it
should be fixed, so that things still work when the later memset() goes
away.

  Commit: 40596182d93d9fcdc133f1650361c430a57c46c4
      https://github.com/heimdal/heimdal/commit/40596182d93d9fcdc133f1650361c430a57c46c4
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Use iovec checksum in krb5_encrypt_iov_ivec

Use the iovec checksum routines in krb5_encrypt_iov_ivec. This
still marshalls all of the iovecs together to perform the encryption
operation, but this change halves the amount of time spent on
data marshalling in this function.

  Commit: 6d4ea847b08aa16a01daf45c4ba6d104aaa64c88
      https://github.com/heimdal/heimdal/commit/6d4ea847b08aa16a01daf45c4ba6d104aaa64c88
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-aes-sha1.c
    M lib/krb5/crypto-aes-sha2.c
    M lib/krb5/crypto-arcfour.c
    M lib/krb5/crypto-des.c
    M lib/krb5/crypto-des3.c
    M lib/krb5/crypto-null.c
    M lib/krb5/crypto.c
    M lib/krb5/crypto.h

  Log Message:
  -----------
  krb5: Add an optional encrypt_iov function to encryption types

Add a encrypt_iov function pointer to all of our encryption types
which can be used to implement an iovec based encryption routine.

Modify krb5_encrypt_iov so that it calls the iovec based routine
if it is available.

  Commit: 6642d049ee33541438a0121d1c0b69c5737dfbf6
      https://github.com/heimdal/heimdal/commit/6642d049ee33541438a0121d1c0b69c5737dfbf6
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-aes-sha1.c
    M lib/krb5/crypto-des3.c
    M lib/krb5/crypto-evp.c

  Log Message:
  -----------
  krb5: Add EVP iovec encryption routines

Add iovec routines for both padded CBC, and CTS EVP based encryption.

These routines go to great lengths to minimise the number of times
we call EVP_Cipher. With some EVP implementations (such as OpenSSL's
AES-NI) there is a significant entrance and exit overhead from this
routine, due to the use of SIMD vectors for the ivec.

  Commit: 23c41b70822c1bec6d8f43f39eb27d3d66482920
      https://github.com/heimdal/heimdal/commit/23c41b70822c1bec6d8f43f39eb27d3d66482920
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto-aes-sha1.c
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Add a verify mode for the HMAC_SHA1 checksum

Add a verify operation for this checksum. If a verify operation isn't
defined, then the verify_checksum code has to dynamically allocate and
free a block of memory for the computed checksum, which can be a
significant overhead when performing bulk data encryption.

  Commit: c6d2bb8793604cd62d92be022c8097f39317dd18
      https://github.com/heimdal/heimdal/commit/c6d2bb8793604cd62d92be022c8097f39317dd18
  Author: Simon Wilkinson <sxw at auristor.com>
  Date:   2018-05-15 (Tue, 15 May 2018)

  Changed paths:
    M lib/krb5/crypto.c

  Log Message:
  -----------
  krb5: Use iovecs for krb5_decrypt_iov_ivec

When we have an underlying iovec encryption function, use iovecs for
checksum-then-encrypt alogrithms in decrypt_iov_ivec, rather than
coalescing iovecs into a single memory buffer.

Compare: https://github.com/heimdal/heimdal/compare/4dff725c5924...c6d2bb879360
      **NOTE:** This service been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.