From 3456770a4219bdf8e97ef8d4b5c2afa05d715bf1 Mon Sep 17 00:00:00 2001 From: Jun Aruga Date: Fri, 2 Jun 2023 23:14:28 +0200 Subject: [PATCH 1/2] CI: Upgrade OpenSSL and LibreSSL versions. --- .github/workflows/test.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 350c9517c..a137877d3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -64,20 +64,24 @@ jobs: os: [ ubuntu-latest ] ruby: [ "3.0" ] openssl: + # https://www.openssl.org/source/ - openssl-1.0.2u # EOL - openssl-1.1.0l # EOL - - openssl-1.1.1t - - openssl-3.0.8 + - openssl-1.1.1u + - openssl-3.0.9 + - openssl-3.1.1 + # http://www.libressl.org/releases.html - libressl-3.1.5 # EOL - libressl-3.2.7 # EOL - libressl-3.3.6 # EOL - libressl-3.4.3 # EOL - - libressl-3.5.3 - - libressl-3.6.1 - - libressl-3.7.0 # Development release + - libressl-3.5.3 # EOL + - libressl-3.6.3 + - libressl-3.7.3 + - libressl-3.8.0 # Development release fips-enabled: [ false ] include: - - { os: ubuntu-latest, ruby: "3.0", openssl: openssl-3.0.8, fips-enabled: true, append-configure: 'enable-fips', name-extra: 'fips' } + - { os: ubuntu-latest, ruby: "3.0", openssl: openssl-3.0.9, fips-enabled: true, append-configure: 'enable-fips', name-extra: 'fips' } steps: - name: repo checkout uses: actions/checkout@v3 From 93548ae9597ba40d3f8b564f6a948ce55b432e30 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 19:43:49 +0200 Subject: [PATCH 2/2] Fix modular square root test with LibreSSL >= 3.8 If x is a modular square root of a (mod p) then so is (p - x). Both answers are valid. In particular, both 2 and 3 are valid square roots of 4 (mod 5). Do not assume that a particular square root is chosen by the algorithm. Indeed, the algorithm in OpenSSL and LibreSSL <= 3.7 returns a non-deterministic answer in many cases. LibreSSL 3.8 and later will always return the smaller of the two possible answers. This breaks the current test case. Instead of checking for a particular square root, check that the square of the claimed square root is the given value. This is always true. Add the simplest test case where the answer is indeed non-deterministic. --- test/openssl/test_bn.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/openssl/test_bn.rb b/test/openssl/test_bn.rb index 77af14091..ea88ff06c 100644 --- a/test/openssl/test_bn.rb +++ b/test/openssl/test_bn.rb @@ -175,7 +175,9 @@ def test_mod_sqr end def test_mod_sqrt - assert_equal(3, 4.to_bn.mod_sqrt(5)) + assert_equal(4, 4.to_bn.mod_sqrt(5).mod_sqr(5)) + # One of 189484 or 326277 is returned as a square root of 2 (mod 515761). + assert_equal(2, 2.to_bn.mod_sqrt(515761).mod_sqr(515761)) assert_equal(0, 5.to_bn.mod_sqrt(5)) assert_raise(OpenSSL::BNError) { 3.to_bn.mod_sqrt(5) } end