1. 25 Oct, 2018 2 commits
  2. 08 Aug, 2018 1 commit
  3. 19 Jul, 2018 1 commit
  4. 29 May, 2018 1 commit
    • Ondřej Surý's avatar
      Change isc_random() to be just PRNG, and add isc_nonce_buf() that uses CSPRNG · 99ba29bc
      Ondřej Surý authored
      This commit reverts the previous change to use system provided
      entropy, as (SYS_)getrandom is very slow on Linux because it is
      a syscall.
      
      The change introduced in this commit adds a new call isc_nonce_buf
      that uses CSPRNG from cryptographic library provider to generate
      secure data that can be and must be used for generating nonces.
      Example usage would be DNS cookies.
      
      The isc_random() API has been changed to use fast PRNG that is not
      cryptographically secure, but runs entirely in user space.  Two
      contestants have been considered xoroshiro family of the functions
      by Villa&Blackman and PCG by O'Neill.  After a consideration the
      xoshiro128starstar function has been used as uint32_t random number
      provider because it is very fast and has good enough properties
      for our usage pattern.
      
      The other change introduced in the commit is the more extensive usage
      of isc_random_uniform in places where the usage pattern was
      isc_random() % n to prevent modulo bias.  For usage patterns where
      only 16 or 8 bits are needed (DNS Message ID), the isc_random()
      functions has been renamed to isc_random32(), and isc_random16() and
      isc_random8() functions have been introduced by &-ing the
      isc_random32() output with 0xffff and 0xff.  Please note that the
      functions that uses stripped down bit count doesn't pass our
      NIST SP 800-22 based random test.
      99ba29bc
  5. 16 May, 2018 1 commit
    • Ondřej Surý's avatar
      Replace all random functions with isc_random, isc_random_buf and isc_random_uniform API. · 3a4f820d
      Ondřej Surý authored
      The three functions has been modeled after the arc4random family of
      functions, and they will always return random bytes.
      
      The isc_random family of functions internally use these CSPRNG (if available):
      
      1. getrandom() libc call (might be available on Linux and Solaris)
      2. SYS_getrandom syscall (might be available on Linux, detected at runtime)
      3. arc4random(), arc4random_buf() and arc4random_uniform() (available on BSDs and Mac OS X)
      4. crypto library function:
      4a. RAND_bytes in case OpenSSL
      4b. pkcs_C_GenerateRandom() in case PKCS#11 library
      3a4f820d
  6. 11 May, 2018 1 commit
  7. 16 Mar, 2018 1 commit
  8. 23 Feb, 2018 1 commit
  9. 30 Jan, 2018 1 commit
  10. 17 Jan, 2018 2 commits
  11. 19 Sep, 2017 2 commits
  12. 18 Aug, 2016 1 commit
  13. 27 Jun, 2016 1 commit
  14. 18 Aug, 2015 1 commit
    • Evan Hunt's avatar
      [master] timing safe memory comparisons · 420a43c8
      Evan Hunt authored
      4183.	[cleanup]	Use timing-safe memory comparisons in cryptographic
      			code. Also, the timing-safe comparison functions have
      			been renamed to avoid possible confusion with
      			memcmp(). [RT #40148]
      420a43c8
  15. 07 Aug, 2015 2 commits
  16. 31 Jan, 2014 1 commit
  17. 14 Jan, 2014 1 commit
    • Evan Hunt's avatar
      [master] native PKCS#11 support · ba751492
      Evan Hunt authored
      3705.	[func]		"configure --enable-native-pkcs11" enables BIND
      			to use the PKCS#11 API for all cryptographic
      			functions, so that it can drive a hardware service
      			module directly without the need to use a modified
      			OpenSSL as intermediary (so long as the HSM's vendor
      			provides a complete-enough implementation of the
      			PKCS#11 interface). This has been tested successfully
      			with the Thales nShield HSM and with SoftHSMv2 from
      			the OpenDNSSEC project. [RT #29031]
      ba751492
  18. 09 Jan, 2014 2 commits
  19. 09 Jul, 2013 2 commits
  20. 15 Jun, 2012 1 commit
  21. 14 Jun, 2012 1 commit
  22. 11 Jan, 2011 1 commit
  23. 10 Jan, 2011 1 commit
  24. 07 Jan, 2010 2 commits
  25. 24 Oct, 2009 1 commit
  26. 09 Oct, 2009 1 commit
  27. 03 Sep, 2009 2 commits
  28. 01 Apr, 2008 1 commit
  29. 31 Mar, 2008 1 commit
  30. 28 Aug, 2007 1 commit
  31. 19 Jun, 2007 1 commit
  32. 18 Jun, 2007 1 commit