Change-Id: Ic57625964b6d40d63acade476a0f99c00d598267
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171681


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

This helps debugging protocol violations by the client

Change-Id: I8e5486b49515b719bbe3de44daa489fb7434875a
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171680


Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: Ie1f58e00982568382e09d8f1dd12bf8a1dc1a9ed
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171679


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: I6d0f3396f06871286e3d48ec5af38770663dbed2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171678


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: I9cb821827b16d60b0a8c4fff9caec78748f3a495
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171677


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

The new name readCipherPacket/writeCipherPacket disambiguates method
calls from packetConn.{read,write}Packet, which has a different
signature, and is called in different layers of the stack.

Change-Id: I02ca83e28f74f0a347a1cde665efdfb78f3f51bb
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171657


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: I734bf1f709a259889eeb9243079edb90d6751f67
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170677


Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

To fix broken builds like:
https://build.golang.org/log/4c3d8463f5c2b2478dc2315f6c685b2f77bfcdd1

Change-Id: I4c4866e5928a73856ca8a411ed97588e6f66e490
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170623


Reviewed-by: Michael Munday <mike.munday@ibm.com>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Before, we emitted N single-move sequences on a cursor move. For
example, "move 4 left" would emit "^[[D^[[D^[[D^[[D". With this change,
it would emit "^[[4D".

Using variable move sequences when possible reduces the amount of
rendering output that the terminal implementation produces. This can
have some low-level performance benefits, but also helps consumers
reason through the produced output.

Includes a test with a couple of cases.

Note: The old implementation used ^[[D instead of ^[D which is also
valid. This is true in several unrelated places, so this implementation
continues to use ^[[D for consistency.

Change-Id: If38eaaed8fb4075499fdda54c06681dc34c3ad70
GitHub-Last-Rev: 92ef2538d33a9493f3df09984c277dfd8bf0abf4
GitHub-Pull-Request: golang/crypto#82
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/169077


Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Fixes golang/go#30965

Change-Id: I83a804d555c048e0124c35f95c9e611b2c5bdb01
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/436856


Reviewed-by: Adam Langley <agl@google.com>
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/168406


Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

This diff extends the curve25519 test suite with some test vectors
generated from BoringSSL.

Updates golang/go#30095

Change-Id: I4e871378c77b46167d162e9eec75fc412596ff7c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/161277


Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

This CL adds the poly1305.MAC type which implements a
subset of the hash.Hash interface. With MAC it is possible
to compute an authentication tag of data without copying
it into a single byte slice.

This commit modifies the reference/generic and the
AMD64 assembler but not the ARM/s390x implementation
to support an io.Writer interface.

Updates golang/go#25219

Change-Id: I7ee5a9eadd43387cf3cd887d734c625575eee47d
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/111335


Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>

Use the recently added CPU feature detection API rather than custom
assembly. This will need to be updated to use 'internal/cpu' when
the package is revendored into std.

Change-Id: Icf0f28236ca0c351c88035f36e5b9c29d4bc2ba7
Reviewed-on: https://go-review.googlesource.com/c/164383


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Use the recently added CPU feature detection API rather than custom
assembly. This will need to be updated to use 'internal/cpu' when
the package is revendored into std.

Change-Id: Ia99c51c7409fe4fabcd88fdf5ff19772c1ca2257
Reviewed-on: https://go-review.googlesource.com/c/164382


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Use the recently added CPU feature detection API rather than custom
assembly.

While we are here also make vet happy by renaming params in the asm
file to chain to match the go function declaration.

Change-Id: Ide0171793c9fa5ef6671b394e97a27f2c6e44a9f
Reviewed-on: https://go-review.googlesource.com/c/164381


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Return window size instead of buffer size.

Fixes golang/go#27743

Change-Id: Ib1cd249f5680d86d505032e51d9102c2718ddf6f
Reviewed-on: https://go-review.googlesource.com/c/163538


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

This change adds a go.mod and go.sum file to this repo, following the
requirements stated in bcmills's comment here:
https://golang.org/issue/28136#issuecomment-462971974. It's
important to note that we will not be
adding versions to the repo for now.

The change was generated by running "go mod init" and "go mod tidy" using Go
1.11.5 in the top-level directory of the repository.

Updates golang/go#28136

Change-Id: I17b2ac9eaae028a172a5adc260cffba5e0997619
Reviewed-on: https://go-review.googlesource.com/c/162911


Run-TryBot: Michael Matloob <matloob@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Andrew Bonventre <andybons@golang.org>

Previously empty SSH requests would cause a panic.

Change-Id: I8443fee50891b3d2b3b62ac01fb0b9e96244241f
GitHub-Last-Rev: 64f00d2bf2ee722f53e68b6bd4f70c722d7694bd
GitHub-Pull-Request: golang/crypto#58
Reviewed-on: https://go-review.googlesource.com/c/140237


Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>

The call to k2.Encrypt causes tweak to escape to the heap, resulting
in a 16-byte allocation for each call to Encrypt/Decrypt. Moving
tweak into the Cipher struct would allow it to be reused, but this
is ruled out by the Cipher docstring, which states that it is safe
for concurrent use. Instead, manage tweak arrays with a sync.Pool.
Benchmarks indicate that this amortizes allocation cost without
impacting performance.

benchmark          old ns/op     new ns/op     delta
BenchmarkXTS-4     234           245           +4.70%

benchmark          old allocs    new allocs    delta
BenchmarkXTS-4     2             0             -100.00%

benchmark          old bytes     new bytes     delta
BenchmarkXTS-4     32            0             -100.00%

Change-Id: I5e0dd8c2e1a1078a151bbeb1d0760936b6b56216
GitHub-Last-Rev: 14d81f589f3ada2b19511d592000657af3410a51
GitHub-Pull-Request: golang/crypto#51
Reviewed-on: https://go-review.googlesource.com/c/118535


Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Previously, when g.p == nil, String() crashed. In other method like Add(),
a point with g.p == nil is treated as an identity element.

Besides, the following code is the only way to get an identity element
outside the library: g := bn256.G1{}. In this situation, g.p == nil.

For example, the following code will crash:

package main

import (
	"fmt"
	"golang.org/x/crypto/bn256"
)

func main() {
	g := bn256.G1{}
	fmt.Println(g.String())
}

Change-Id: Ied6f7c8197e7b79b0913c000a9cf1cf68f8188a9
GitHub-Last-Rev: 23246486a982ea54d6023726e048c74f02089f25
GitHub-Pull-Request: golang/crypto#75
Reviewed-on: https://go-review.googlesource.com/c/163118


TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>

Fixes golang/go#30141

Change-Id: I76f8eae31cfd6d106440114685cc0d9abba374f8
Reviewed-on: https://go-review.googlesource.com/c/163537


Reviewed-by: Adam Langley <agl@golang.org>

The change should reduce resource quota consumed by the client overall.

Instead of sending HEAD to an ACME resource URL to get a new nonce,
the Client will now try to fetch it from the Directory URL first
and only then from the ACME resource URL if the former fails.

This builds up on an abandoned https://golang.org/cl/34623,
only this time with a fallback to the original behaviour.

Change-Id: I6e75c0e524c4bc751f3a651b290c0ac2493e0628
Reviewed-on: https://go-review.googlesource.com/c/162057


Run-TryBot: Alex Vaghin <ddos@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Inspired by Vectorization of ChaCha Stream Cipher
https://eprint.iacr.org/2013/759.pdf

name            old time/op    new time/op    delta
ChaCha20/32        690ns ± 0%     872ns ± 0%   +26.38%  (p=0.000 n=10+10)
ChaCha20/63        750ns ± 0%     987ns ± 0%   +31.53%  (p=0.000 n=10+10)
ChaCha20/64        674ns ± 0%     879ns ± 0%   +30.42%  (p=0.000 n=8+10)
ChaCha20/256      2.28µs ± 0%    0.82µs ± 0%   -64.13%  (p=0.000 n=10+10)
ChaCha20/1024     8.64µs ± 0%    2.92µs ± 0%   -66.15%  (p=0.000 n=9+9)
ChaCha20/1350     11.9µs ± 0%     4.5µs ± 0%   -62.51%  (p=0.000 n=10+8)
ChaCha20/65536     554µs ± 0%     181µs ± 0%   -67.33%  (p=0.000 n=10+10)

name            old speed      new speed      delta
ChaCha20/32     46.3MB/s ± 0%  36.7MB/s ± 0%   -20.87%  (p=0.000 n=10+9)
ChaCha20/63     83.9MB/s ± 0%  63.8MB/s ± 0%   -23.97%  (p=0.000 n=10+10)
ChaCha20/64     94.9MB/s ± 0%  72.8MB/s ± 0%   -23.31%  (p=0.000 n=10+10)
ChaCha20/256     112MB/s ± 0%   312MB/s ± 0%  +178.74%  (p=0.000 n=10+10)
ChaCha20/1024    119MB/s ± 0%   350MB/s ± 0%  +195.31%  (p=0.000 n=10+9)
ChaCha20/1350    114MB/s ± 0%   303MB/s ± 0%  +166.73%  (p=0.000 n=8+8)
ChaCha20/65536   118MB/s ± 0%   362MB/s ± 0%  +206.12%  (p=0.000 n=10+10)

Updates golang/go#22809
Change-Id: I487487faa2ae4ff29de6fd8eb1317740c2939c10
Reviewed-on: https://go-review.googlesource.com/c/107628


Reviewed-by: Filippo Valsorda <filippo@golang.org>

Comparison against BoringSSL-generated test vectors showed mismatches
with the pure Go implementation of curve25519. The problem was narrowed
down to a missing mask in feFromBytes(). This diff adds the mask,
bringing this back in line with the reference implementation and
RFC 7748:

    When receiving such an array, implementations of X25519 (but not
    X448) MUST mask the most significant bit in the final byte.  This is
    done to preserve compatibility with point formats that reserve the
    sign bit for use in other protocols and to increase resistance to
    implementation fingerprinting.

Fixes golang/go#30095

Change-Id: If7efc0e2acd6efb761d6e3cb89cec359d7d81cb1
Reviewed-on: https://go-review.googlesource.com/c/161257


Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>

audited using ineffassign tool from
github.com/gordonklaus/ineffassign
go generate does not generate any changes

Change-Id: Iabbec9ec1aae39081289d503d79fd7b4caadf17b
GitHub-Last-Rev: acd17cce410e9c68ce3c87b5546261be9153e3ea
GitHub-Pull-Request: golang/crypto#70
Reviewed-on: https://go-review.googlesource.com/c/155942


Reviewed-by: Filippo Valsorda <filippo@golang.org>

Updates golang/go#14015

Change-Id: Iffe73540c5d74e4b3d0664035a1bdce5b47663ee
Reviewed-on: https://go-review.googlesource.com/c/160258


Reviewed-by: Bryan C. Mills <bcmills@google.com>

This change extends the Client to allow users request
certificate issuance for IP addresses.

See the ACME spec extension for details about IP address
identifiers: https://tools.ietf.org/html/draft-ietf-acme-ip.

Change-Id: I92a8d8fae048487168906c14892c6dd33af10c07
Reviewed-on: https://go-review.googlesource.com/c/160197


Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: Ia4d87b816f176194cd9e37efb42e273d678a84b7
Reviewed-on: https://go-review.googlesource.com/c/160259


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

This reverts commit bf88e3f4.

Reason for revert: https://go-review.googlesource.com/c/crypto/+/105876/12#message-0dad31af2b487e895ee6926ded82f85ac81c74f8

Updates golang/go#14015

Change-Id: I8eb3ed73f78ac11841ad73435bba00a330d59b58
Reviewed-on: https://go-review.googlesource.com/c/160257


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Addition of a DecodeAll function as it was mentioned in #14015.

This solves a need many people seem to have, where there is no effective
way loading PKCS12 files that contain more than one certificate and one
private key.

The utility functions used by Decode are all internal, which makes
implementing this on the user-side tedious, hence the suggestion of
providing a more liberal version of the function: DecodeAll.

Fixes golang/go#14015

Change-Id: I03c541553b6cb488c2c59d39575342a43136e592
GitHub-Last-Rev: 05f6847ff80ca34c92a01a688c7b81e874af3009
GitHub-Pull-Request: golang/crypto#38
Reviewed-on: https://go-review.googlesource.com/c/105876


Reviewed-by: Adam Shannon <adamkshannon@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>

This makes it possible to navigate the history without leaving
the home row on the keyboard.

Change-Id: Id24c43f8eb6090520ab37bf8126264901b70c489
Reviewed-on: https://go-review.googlesource.com/c/33618


Run-TryBot: Matt Layher <mdlayher@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: I03e9cf1ee82b38f15232a48992bae0234bd51f1a
GitHub-Last-Rev: fd7b92d97c7b52ae00821bad099cf45ff9836cd1
GitHub-Pull-Request: golang/crypto#71
Reviewed-on: https://go-review.googlesource.com/c/156878


Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Change-Id: Idacdbf5ee847be6e21ecce0c9d41818e643c4835
GitHub-Last-Rev: bf1a719b62167d294319f23576302ef567894cc3
GitHub-Pull-Request: golang/crypto#73
Reviewed-on: https://go-review.googlesource.com/c/158837


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Keccak uses a different domain separation byte as the NIST-
standardized SHA-3 hashing function. A previous commit to
this package added support for Keccak-256, but did not do
so for Keccak-512. The reasoning was to support use cases
like Ethereum, however Ethereum also uses Keccak-512 for
the Ethash PoW, so this second method is also needed.

Prev CL: https://go-review.googlesource.com/c/crypto/+/106462

Fixes golang/go#29533

Change-Id: I9d92b1f121657f631c157e5e309771db1cd91c82
Reviewed-on: https://go-review.googlesource.com/c/125795


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Previously MulScalar was ignoring the first parameter, which was inconsistent with gfp6 and gfp2.

Change-Id: I4f4a4ca2f07a25176ab159be684a02696f1580ba
GitHub-Last-Rev: ec40c0403614ed56cf329102eb274dc776fa3be8
GitHub-Pull-Request: golang/crypto#67
Reviewed-on: https://go-review.googlesource.com/c/154457


Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

SHA384 is a natural hashing choice for P-384 ECDSA. The only thing
needed to make it usable, is adding it to the list of candidates.

Change-Id: I61f66f371774f95dfc1de30d10fab66f92c21b6b
Reviewed-on: https://go-review.googlesource.com/c/137956


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Enable the tests on aix after support was added in CL 151077.

Change-Id: I2dcdaaa54d7c27b7697224e0f3cfab3cf0b52b6a
Reviewed-on: https://go-review.googlesource.com/c/151437


Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Clément Chigot <clement.chigot@atos.net>
Reviewed-by: Ian Lance Taylor <iant@golang.org>

Go documentation style for boolean funcs is to say:

    // Foo reports whether ...
    func Foo() bool

(rather than "returns true if")

Change-Id: I6972d123ba99bbf3dbf95e876b45b2ecd98dd07c
Reviewed-on: https://go-review.googlesource.com/c/151257


Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: I03178eca962c29ad03fd9b2fb57ad35c53c99860
GitHub-Last-Rev: 21a7a751920a5d3e650d1f91d17177f33e477ff1
GitHub-Pull-Request: golang/crypto#66
Reviewed-on: https://go-review.googlesource.com/c/151277


Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

This commit adds AIX operation system to ssh/terminal package.

Change-Id: I31ccec5512dbf476eaf22ff79951b5fab434d5fd
Reviewed-on: https://go-review.googlesource.com/c/151077


Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>