GO-2024-3167: Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl

The highest tagged major version is v2.

openssl

package

v0.0.0-...-724e32b Latest Latest Go to latest Published: Jun 5, 2023 License: MIT Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/golang-fips/openssl

Documentation ¶

Rendered for

Overview ¶

package openssl provides access to OpenSSL implementation functions.

Index ¶

Constants
func CheckLeaks()
func DecryptRSANoPadding(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error)
func DecryptRSAOAEP(h hash.Hash, priv *PrivateKeyRSA, ciphertext, label []byte) ([]byte, error)
func DecryptRSAPKCS1(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error)
func ECDH(priv *PrivateKeyECDH, pub *PublicKeyECDH) ([]byte, error)
func Enabled() bool
func EncryptRSANoPadding(pub *PublicKeyRSA, msg []byte) ([]byte, error)
func EncryptRSAOAEP(h hash.Hash, pub *PublicKeyRSA, msg, label []byte) ([]byte, error)
func EncryptRSAPKCS1(pub *PublicKeyRSA, msg []byte) ([]byte, error)
func ExecutingTest() bool
func ExpandHKDF(h func() hash.Hash, pseudorandomKey, info []byte) (io.Reader, error)
func ExtractHKDF(h func() hash.Hash, secret, salt []byte) ([]byte, error)
func HashSignECDSA(priv *PrivateKeyECDSA, hash []byte, h crypto.Hash) (*big.Int, *big.Int, error)
func HashVerifyECDSA(pub *PublicKeyECDSA, msg []byte, r, s *big.Int, h crypto.Hash) bool
func IsStrictFips() bool
func NewAESCipher(key []byte) (cipher.Block, error)
func NewGCMTLS(c cipher.Block) (cipher.AEAD, error)
func NewHMAC(h func() hash.Hash, key []byte) hash.Hash
func NewOpenSSLError(msg string) error
func NewSHA1() hash.Hash
func NewSHA224() hash.Hash
func NewSHA256() hash.Hash
func NewSHA384() hash.Hash
func NewSHA512() hash.Hash
func PanicIfStrictFIPS(msg string)
func RandStubbed() bool
func RestoreOpenSSLRand()
func SHA1(p []byte) (sum [20]byte)
func SHA224(p []byte) (sum [28]byte)
func SHA256(p []byte) (sum [32]byte)
func SHA384(p []byte) (sum [48]byte)
func SHA512(p []byte) (sum [64]byte)
func SignMarshalECDSA(priv *PrivateKeyECDSA, hash []byte) ([]byte, error)
func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed bool) ([]byte, error)
func SignRSAPSS(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, saltLen int) ([]byte, error)
func StubOpenSSLRand()
func SupportsHKDF() bool
func Unreachable()
func UnreachableExceptTests()
func VerifyECDSA(pub *PublicKeyECDSA, hash []byte, sig []byte) bool
func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, msg, sig []byte, msgIsHashed bool) error
func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen int) error
type BigInt
- func GenerateKeyECDSA(curve string) (X, Y, D BigInt, err error)
- func GenerateKeyRSA(bits int) (N, E, D, P, Q, Dp, Dq, Qinv BigInt, err error)
type PrivateKeyECDH
- func GenerateKeyECDH(curve string) (*PrivateKeyECDH, []byte, error)
- func NewPrivateKeyECDH(curve string, bytes []byte) (*PrivateKeyECDH, error)
- func (k *PrivateKeyECDH) PublicKey() (*PublicKeyECDH, error)
type PrivateKeyECDSA
- func NewPrivateKeyECDSA(curve string, X, Y BigInt, D BigInt) (*PrivateKeyECDSA, error)
type PrivateKeyRSA
- func NewPrivateKeyRSA(N, E, D, P, Q, Dp, Dq, Qinv BigInt) (*PrivateKeyRSA, error)
type PublicKeyECDH
- func NewPublicKeyECDH(curve string, bytes []byte) (*PublicKeyECDH, error)
- func (k *PublicKeyECDH) Bytes() []byte
type PublicKeyECDSA
- func NewPublicKeyECDSA(curve string, X, Y BigInt) (*PublicKeyECDSA, error)
type PublicKeyRSA
- func NewPublicKeyRSA(N, E BigInt) (*PublicKeyRSA, error)

Constants ¶

View Source

const (
	OPENSSL_VERSION_1_1_0 = uint64(C.ulong(0x10100000))
	OPENSSL_VERSION_1_1_1 = uint64(C.ulong(0x10101000))
	OPENSSL_VERSION_3_0_0 = uint64(C.ulong(0x30000000))
)

View Source

const GoStrictFipsEnv = "GOLANG_STRICT_FIPS"

View Source

const RandReader = randReader(0)

Variables ¶

This section is empty.

Functions ¶

func CheckLeaks ¶

func CheckLeaks()

func DecryptRSANoPadding ¶

func DecryptRSANoPadding(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error)

func DecryptRSAOAEP ¶

func DecryptRSAOAEP(h hash.Hash, priv *PrivateKeyRSA, ciphertext, label []byte) ([]byte, error)

func DecryptRSAPKCS1 ¶

func DecryptRSAPKCS1(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error)

func ECDH ¶

func ECDH(priv *PrivateKeyECDH, pub *PublicKeyECDH) ([]byte, error)

func Enabled ¶

func Enabled() bool

Enabled returns whether or not the boring package is enabled. When the boring package is enabled that means FIPS mode is enabled.

func EncryptRSANoPadding ¶

func EncryptRSANoPadding(pub *PublicKeyRSA, msg []byte) ([]byte, error)

func EncryptRSAOAEP ¶

func EncryptRSAOAEP(h hash.Hash, pub *PublicKeyRSA, msg, label []byte) ([]byte, error)

func EncryptRSAPKCS1 ¶

func EncryptRSAPKCS1(pub *PublicKeyRSA, msg []byte) ([]byte, error)

func ExecutingTest ¶

func ExecutingTest() bool

ExecutingTest returns a boolean indicating if we're executing under a test binary or not.

func ExpandHKDF ¶

func ExpandHKDF(h func() hash.Hash, pseudorandomKey, info []byte) (io.Reader, error)

func ExtractHKDF ¶

func ExtractHKDF(h func() hash.Hash, secret, salt []byte) ([]byte, error)

func HashSignECDSA ¶

func HashSignECDSA(priv *PrivateKeyECDSA, hash []byte, h crypto.Hash) (*big.Int, *big.Int, error)

func HashVerifyECDSA ¶

func HashVerifyECDSA(pub *PublicKeyECDSA, msg []byte, r, s *big.Int, h crypto.Hash) bool

func IsStrictFips ¶

func IsStrictFips() bool

func NewAESCipher ¶

func NewAESCipher(key []byte) (cipher.Block, error)

func NewGCMTLS ¶

func NewGCMTLS(c cipher.Block) (cipher.AEAD, error)

NewGCMTLS returns a GCM cipher specific to TLS and should not be used for non-TLS purposes.

func NewHMAC ¶

func NewHMAC(h func() hash.Hash, key []byte) hash.Hash

NewHMAC returns a new HMAC using BoringCrypto. The function h must return a hash implemented by BoringCrypto (for example, h could be boring.NewSHA256). If h is not recognized, NewHMAC returns nil.

func NewOpenSSLError ¶

func NewOpenSSLError(msg string) error

func NewSHA1 ¶

func NewSHA1() hash.Hash

NewSHA1 returns a new SHA1 hash.

func NewSHA224 ¶

func NewSHA224() hash.Hash

NewSHA224 returns a new SHA224 hash.

func NewSHA256 ¶

func NewSHA256() hash.Hash

NewSHA256 returns a new SHA256 hash.

func NewSHA384 ¶

func NewSHA384() hash.Hash

NewSHA384 returns a new SHA384 hash.

func NewSHA512 ¶

func NewSHA512() hash.Hash

NewSHA512 returns a new SHA512 hash.

func PanicIfStrictFIPS ¶

func PanicIfStrictFIPS(msg string)

func RandStubbed ¶

func RandStubbed() bool

func RestoreOpenSSLRand ¶

func RestoreOpenSSLRand()

func SHA1 ¶

func SHA1(p []byte) (sum [20]byte)

func SHA224 ¶

func SHA224(p []byte) (sum [28]byte)

func SHA256 ¶

func SHA256(p []byte) (sum [32]byte)

func SHA384 ¶

func SHA384(p []byte) (sum [48]byte)

func SHA512 ¶

func SHA512(p []byte) (sum [64]byte)

func SignMarshalECDSA ¶

func SignMarshalECDSA(priv *PrivateKeyECDSA, hash []byte) ([]byte, error)

func SignRSAPKCS1v15 ¶

func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed bool) ([]byte, error)

func SignRSAPSS ¶

func SignRSAPSS(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, saltLen int) ([]byte, error)

func StubOpenSSLRand ¶

func StubOpenSSLRand()

func SupportsHKDF ¶

func SupportsHKDF() bool

func Unreachable ¶

func Unreachable()

Unreachable marks code that should be unreachable when FIPS mode. It panics only when the system is in FIPS mode.

func UnreachableExceptTests ¶

func UnreachableExceptTests()

UnreachableExceptTests marks code that should be unreachable when FIPS mode is active. It panics only when the system is in FIPS mode and not executing under tests.

func VerifyECDSA ¶

func VerifyECDSA(pub *PublicKeyECDSA, hash []byte, sig []byte) bool

func VerifyRSAPKCS1v15 ¶

func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, msg, sig []byte, msgIsHashed bool) error

func VerifyRSAPSS ¶

func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen int) error

Types ¶

type BigInt ¶

type BigInt []uint

A BigInt is the raw words from a BigInt. This definition allows us to avoid importing math/big. Conversion between BigInt and *big.Int is in crypto/internal/boring/bbig.

func GenerateKeyECDSA ¶

func GenerateKeyECDSA(curve string) (X, Y, D BigInt, err error)

func GenerateKeyRSA ¶

func GenerateKeyRSA(bits int) (N, E, D, P, Q, Dp, Dq, Qinv BigInt, err error)

type PrivateKeyECDH ¶

type PrivateKeyECDH struct {
	// contains filtered or unexported fields
}

func GenerateKeyECDH ¶

func GenerateKeyECDH(curve string) (*PrivateKeyECDH, []byte, error)

func NewPrivateKeyECDH ¶

func NewPrivateKeyECDH(curve string, bytes []byte) (*PrivateKeyECDH, error)

func (*PrivateKeyECDH) PublicKey ¶

func (k *PrivateKeyECDH) PublicKey() (*PublicKeyECDH, error)

type PrivateKeyECDSA ¶

type PrivateKeyECDSA struct {
	// contains filtered or unexported fields
}

func NewPrivateKeyECDSA ¶

func NewPrivateKeyECDSA(curve string, X, Y BigInt, D BigInt) (*PrivateKeyECDSA, error)

type PrivateKeyRSA ¶

type PrivateKeyRSA struct {
	// contains filtered or unexported fields
}

func NewPrivateKeyRSA ¶

func NewPrivateKeyRSA(N, E, D, P, Q, Dp, Dq, Qinv BigInt) (*PrivateKeyRSA, error)

type PublicKeyECDH ¶

type PublicKeyECDH struct {
	// contains filtered or unexported fields
}

func NewPublicKeyECDH ¶

func NewPublicKeyECDH(curve string, bytes []byte) (*PublicKeyECDH, error)

func (*PublicKeyECDH) Bytes ¶

func (k *PublicKeyECDH) Bytes() []byte

type PublicKeyECDSA ¶

type PublicKeyECDSA struct {
	// contains filtered or unexported fields
}

func NewPublicKeyECDSA ¶

func NewPublicKeyECDSA(curve string, X, Y BigInt) (*PublicKeyECDSA, error)

type PublicKeyRSA ¶

type PublicKeyRSA struct {
	// contains filtered or unexported fields
}

func NewPublicKeyRSA ¶

func NewPublicKeyRSA(N, E BigInt) (*PublicKeyRSA, error)

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
bbig

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL