From 5f1f6f7470f89fda84971d1095544ec52fc554f6 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 16 Aug 2017 17:54:53 +0200 Subject: [PATCH 1/6] THANKS += PIA --- THANKS | 1 + 1 file changed, 1 insertion(+) diff --git a/THANKS b/THANKS index 26cf3709..b55bc063 100644 --- a/THANKS +++ b/THANKS @@ -87,3 +87,4 @@ Also thanks to: - Coverity, Inc. to provide static analysis. - FSF France for providing access to their compilation servers. +- Private Internet Access for having sponsored a complete security audit. From 901c49203d7ab4e4e32e3440799e5b52da5d6a47 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 16 Aug 2017 18:54:48 +0200 Subject: [PATCH 2/6] + crypto_secretstream_*() --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index b3e331d2..518aa23c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,8 @@ store keys to. `crypto_pwhash_str_alg()` function. - Due to popular demand, base64 encoding (`sodium_bin2base64()`) and decoding (`sodium_base642bin()`) have been implemented. + - A new crypto_secretstream_*() API was added to safely encrypt files and +multi-part messages. * Version 1.0.13 - Javascript: the sumo builds now include all symbols. They were From c654261477ea07835d0ab5c74461b9971ebc06c6 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 16 Aug 2017 20:16:19 +0200 Subject: [PATCH 3/6] Explain that sodium_misuse() still aborts by default --- ChangeLog | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 518aa23c..f3e45828 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,10 +6,11 @@ - Internal consistency checks failing and primitives used with dangerous/out-of-bounds/invalid parameters used to call abort(3). Now, a custom handler *that doesn't return* can be set with the -`set_sodium_misuse()` function. This is not a replacement for -non-fatal, expected runtime errors. This handler will be only -called in unexpected situations due to potential bugs in the -library or in language bindings. +`set_sodium_misuse()` function. It still aborts by default or if +the handler ever returns. This is not a replacement for non-fatal, +expected runtime errors. This handler will be only called in +unexpected situations due to potential bugs in the library or in +language bindings. - `*_MESSAGEBYTES_MAX` macros (and the corresponding `_messagebytes_max()` symbols) have been added to represent the maximum message size that can be safely handled by a primitive. From 914ff87576239a7f19d3f49da9d70b97fc03a97f Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 16 Aug 2017 20:21:31 +0200 Subject: [PATCH 4/6] Format paragraphs --- ChangeLog | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index f3e45828..054b392b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,21 +6,21 @@ - Internal consistency checks failing and primitives used with dangerous/out-of-bounds/invalid parameters used to call abort(3). Now, a custom handler *that doesn't return* can be set with the -`set_sodium_misuse()` function. It still aborts by default or if -the handler ever returns. This is not a replacement for non-fatal, +`set_sodium_misuse()` function. It still aborts by default or if the +handler ever returns. This is not a replacement for non-fatal, expected runtime errors. This handler will be only called in unexpected situations due to potential bugs in the library or in language bindings. - `*_MESSAGEBYTES_MAX` macros (and the corresponding `_messagebytes_max()` symbols) have been added to represent the maximum message size that can be safely handled by a primitive. -Language bindings are encouraged to check user inputs against -these maximum lengths. +Language bindings are encouraged to check user inputs against these +maximum lengths. - The test suite has been extended to cover more edge cases. - crypto_sign_ed25519_pk_to_curve25519() now rejects points that are not on the curve, or not in the main subgroup. - - Further changes to ensure that smart compilers will not optimize -out code that we don't want to be optimized. + - Further changes to ensure that smart compilers will not optimize out +code that we don't want to be optimized. - Visual Studio solutions are now included in distribution tarballs. - The `sodium_runtime_has_*` symbols for CPU features detection are now defined as weak symbols, i.e. they can be replaced with an @@ -33,8 +33,8 @@ store keys to. `crypto_pwhash_str_alg()` function. - Due to popular demand, base64 encoding (`sodium_bin2base64()`) and decoding (`sodium_base642bin()`) have been implemented. - - A new crypto_secretstream_*() API was added to safely encrypt files and -multi-part messages. + - A new crypto_secretstream_*() API was added to safely encrypt files +and multi-part messages. * Version 1.0.13 - Javascript: the sumo builds now include all symbols. They were From 80296be9477da0576e4709bd68e2d492ca3d9a6a Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 16 Aug 2017 20:58:22 +0200 Subject: [PATCH 5/6] Some notes about RtlGenRandom --- .../randombytes/sysrandom/randombytes_sysrandom.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c b/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c index e78e52eb..725df3d2 100644 --- a/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c +++ b/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c @@ -36,6 +36,15 @@ * memory overhead if this API is not being used for other purposes * - `RtlGenRandom` is thus called directly instead. A detailed explanation * can be found here: https://blogs.msdn.microsoft.com/michael_howard/2005/01/14/cryptographically-secure-random-number-on-windows-without-using-cryptoapi/ + * + * In spite of the disclaimer on the `RtlGenRandom` documentation page that was + * written back in the Windows XP days, this function is here to stay. The CRT + * function `rand_s()` directly depends on it, so touching it would break many + * applications released since Windows XP. + * + * Also note that Rust and BoringSSL (thus, Google Chrome and everything based + * on Chromium) also depend on it, and that libsodium allows the RNG to be + * replaced without patching nor recompiling the library. */ # include # define RtlGenRandom SystemFunction036 From c3b315ec769e492430ebcd8e24bf6adfc261230f Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Wed, 16 Aug 2017 21:12:48 +0200 Subject: [PATCH 6/6] + Firefox --- src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c b/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c index 725df3d2..ae805a27 100644 --- a/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c +++ b/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c @@ -42,8 +42,8 @@ * function `rand_s()` directly depends on it, so touching it would break many * applications released since Windows XP. * - * Also note that Rust and BoringSSL (thus, Google Chrome and everything based - * on Chromium) also depend on it, and that libsodium allows the RNG to be + * Also note that Rust, Firefox and BoringSSL (thus, Google Chrome and everything + * based on Chromium) also depend on it, and that libsodium allows the RNG to be * replaced without patching nor recompiling the library. */ # include