Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update (add quic)

Browse Source
This commit is contained in:
Hakase
2020-07-12 19:52:18 +09:00
parent 3a6d64bb68
commit e85ee33eee
501 changed files with 19166 additions and 10232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
providers/implementations/asymciphers/rsa_enc.c
+13 -11
View File
@@ -38,13 +38,12 @@ static OSSL_OP_asym_cipher_set_ctx_params_fn rsa_set_ctx_params;
static OSSL_OP_asym_cipher_settable_ctx_params_fn rsa_settable_ctx_params;
static OSSL_ITEM padding_item[] = {
{ RSA_PKCS1_PADDING, "pkcs1" },
{ RSA_SSLV23_PADDING, "sslv23" },
{ RSA_NO_PADDING, "none" },
{ RSA_PKCS1_OAEP_PADDING, "oaep" }, /* Correct spelling first */
{ RSA_PKCS1_PADDING, OSSL_PKEY_RSA_PAD_MODE_PKCSV15 },
{ RSA_SSLV23_PADDING, OSSL_PKEY_RSA_PAD_MODE_SSLV23 },
{ RSA_NO_PADDING, OSSL_PKEY_RSA_PAD_MODE_NONE },
{ RSA_PKCS1_OAEP_PADDING, OSSL_PKEY_RSA_PAD_MODE_OAEP }, /* Correct spelling first */
{ RSA_PKCS1_OAEP_PADDING, "oeap" },
{ RSA_X931_PADDING, "x931" },
{ RSA_PKCS1_PSS_PADDING, "pss" },
{ RSA_X931_PADDING, OSSL_PKEY_RSA_PAD_MODE_X931 },
{ 0, NULL }
};
@@ -133,11 +132,13 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen,
PROVerr(0, ERR_R_INTERNAL_ERROR);
return 0;
}
ret = RSA_padding_add_PKCS1_OAEP_mgf1(tbuf, rsasize, in, inlen,
prsactx->oaep_label,
prsactx->oaep_labellen,
prsactx->oaep_md,
prsactx->mgf1_md);
ret =
rsa_padding_add_PKCS1_OAEP_mgf1_with_libctx(prsactx->libctx, tbuf,
rsasize, in, inlen,
prsactx->oaep_label,
prsactx->oaep_labellen,
prsactx->oaep_md,
prsactx->mgf1_md);
if (!ret) {
OPENSSL_free(tbuf);
@@ -252,6 +253,7 @@ static void rsa_freectx(void *vprsactx)
EVP_MD_free(prsactx->oaep_md);
EVP_MD_free(prsactx->mgf1_md);
OPENSSL_free(prsactx->oaep_label);
OPENSSL_free(prsactx);
}
providers/implementations/kdfs/hkdf.c
+1 -1
View File
@@ -29,7 +29,7 @@
#include "prov/provider_util.h"
#include "e_os.h"
#define HKDF_MAXBUF 1024
#define HKDF_MAXBUF 2048
static OSSL_OP_kdf_newctx_fn kdf_hkdf_new;
static OSSL_OP_kdf_freectx_fn kdf_hkdf_free;
providers/implementations/kdfs/kbkdf.c
+7 -7
View File
@@ -123,7 +123,7 @@ static void kbkdf_reset(void *vctx)
{
KBKDF *ctx = (KBKDF *)vctx;
EVP_MAC_CTX_free(ctx->ctx_init);
EVP_MAC_free_ctx(ctx->ctx_init);
OPENSSL_clear_free(ctx->context, ctx->context_len);
OPENSSL_clear_free(ctx->label, ctx->label_len);
OPENSSL_clear_free(ctx->ki, ctx->ki_len);
@@ -151,7 +151,7 @@ static int derive(EVP_MAC_CTX *ctx_init, kbkdf_mode mode, unsigned char *iv,
for (counter = 1; written < ko_len; counter++) {
i = be32(counter);
ctx = EVP_MAC_CTX_dup(ctx_init);
ctx = EVP_MAC_dup_ctx(ctx_init);
if (ctx == NULL)
goto done;
@@ -172,13 +172,13 @@ static int derive(EVP_MAC_CTX *ctx_init, kbkdf_mode mode, unsigned char *iv,
written += h;
k_i_len = h;
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
ctx = NULL;
}
ret = 1;
done:
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
return ret;
}
@@ -247,9 +247,9 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
NULL, NULL, libctx))
return 0;
else if (ctx->ctx_init != NULL
&& !EVP_MAC_is_a(EVP_MAC_CTX_mac(ctx->ctx_init),
&& !EVP_MAC_is_a(EVP_MAC_get_ctx_mac(ctx->ctx_init),
OSSL_MAC_NAME_HMAC)
&& !EVP_MAC_is_a(EVP_MAC_CTX_mac(ctx->ctx_init),
&& !EVP_MAC_is_a(EVP_MAC_get_ctx_mac(ctx->ctx_init),
OSSL_MAC_NAME_CMAC)) {
ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MAC);
return 0;
@@ -288,7 +288,7 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
ctx->ki, ctx->ki_len);
mparams[1] = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx->ctx_init, mparams)
if (!EVP_MAC_set_ctx_params(ctx->ctx_init, mparams)
|| !EVP_MAC_init(ctx->ctx_init))
return 0;
}
providers/implementations/kdfs/sskdf.c
+8 -8
View File
@@ -168,7 +168,7 @@ static int kmac_init(EVP_MAC_CTX *ctx, const unsigned char *custom,
(void *)custom, custom_len);
params[1] = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx, params))
if (!EVP_MAC_set_ctx_params(ctx, params))
return 0;
/* By default only do one iteration if kmac_out_len is not specified */
@@ -186,7 +186,7 @@ static int kmac_init(EVP_MAC_CTX *ctx, const unsigned char *custom,
params[0] = OSSL_PARAM_construct_size_t(OSSL_MAC_PARAM_SIZE,
&kmac_out_len);
if (EVP_MAC_CTX_set_params(ctx, params) <= 0)
if (EVP_MAC_set_ctx_params(ctx, params) <= 0)
return 0;
/*
@@ -233,7 +233,7 @@ static int SSKDF_mac_kdm(EVP_MAC_CTX *ctx_init,
(void *)salt, salt_len);
*p = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx_init, params))
if (!EVP_MAC_set_ctx_params(ctx_init, params))
goto end;
if (!kmac_init(ctx_init, kmac_custom, kmac_custom_len, kmac_out_len,
@@ -256,7 +256,7 @@ static int SSKDF_mac_kdm(EVP_MAC_CTX *ctx_init,
c[2] = (unsigned char)((counter >> 8) & 0xff);
c[3] = (unsigned char)(counter & 0xff);
ctx = EVP_MAC_CTX_dup(ctx_init);
ctx = EVP_MAC_dup_ctx(ctx_init);
if (!(ctx != NULL
&& EVP_MAC_update(ctx, c, sizeof(c))
&& EVP_MAC_update(ctx, z, z_len)
@@ -275,7 +275,7 @@ static int SSKDF_mac_kdm(EVP_MAC_CTX *ctx_init,
memcpy(out, mac, len);
break;
}
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
ctx = NULL;
}
ret = 1;
@@ -285,7 +285,7 @@ end:
else
OPENSSL_cleanse(mac_buf, sizeof(mac_buf));
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
return ret;
}
@@ -303,7 +303,7 @@ static void sskdf_reset(void *vctx)
{
KDF_SSKDF *ctx = (KDF_SSKDF *)vctx;
EVP_MAC_CTX_free(ctx->macctx);
EVP_MAC_free_ctx(ctx->macctx);
ossl_prov_digest_reset(&ctx->digest);
OPENSSL_clear_free(ctx->secret, ctx->secret_len);
OPENSSL_clear_free(ctx->info, ctx->info_len);
@@ -360,7 +360,7 @@ static int sskdf_derive(void *vctx, unsigned char *key, size_t keylen)
const unsigned char *custom = NULL;
size_t custom_len = 0;
int default_salt_len;
EVP_MAC *mac = EVP_MAC_CTX_mac(ctx->macctx);
EVP_MAC *mac = EVP_MAC_get_ctx_mac(ctx->macctx);
/*
* TODO(3.0) investigate the necessity to have all these controls.
providers/implementations/kdfs/tls1_prf.c
+11 -11
View File
@@ -116,8 +116,8 @@ static void kdf_tls1_prf_reset(void *vctx)
{
TLS1_PRF *ctx = (TLS1_PRF *)vctx;
EVP_MAC_CTX_free(ctx->P_hash);
EVP_MAC_CTX_free(ctx->P_sha1);
EVP_MAC_free_ctx(ctx->P_hash);
EVP_MAC_free_ctx(ctx->P_sha1);
OPENSSL_clear_free(ctx->sec, ctx->seclen);
OPENSSL_cleanse(ctx->seed, ctx->seedlen);
memset(ctx, 0, sizeof(*ctx));
@@ -163,7 +163,7 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
NULL, SN_sha1, libctx))
return 0;
} else {
EVP_MAC_CTX_free(ctx->P_sha1);
EVP_MAC_free_ctx(ctx->P_sha1);
if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
OSSL_MAC_NAME_HMAC,
NULL, NULL, libctx))
@@ -280,7 +280,7 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
*p++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY,
(void *)sec, sec_len);
*p = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx_init, params))
if (!EVP_MAC_set_ctx_params(ctx_init, params))
goto err;
if (!EVP_MAC_init(ctx_init))
goto err;
@@ -288,7 +288,7 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
if (chunk == 0)
goto err;
/* A(0) = seed */
ctx_Ai = EVP_MAC_CTX_dup(ctx_init);
ctx_Ai = EVP_MAC_dup_ctx(ctx_init);
if (ctx_Ai == NULL)
goto err;
if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
@@ -298,18 +298,18 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
/* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len, sizeof(Ai)))
goto err;
EVP_MAC_CTX_free(ctx_Ai);
EVP_MAC_free_ctx(ctx_Ai);
ctx_Ai = NULL;
/* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
ctx = EVP_MAC_CTX_dup(ctx_init);
ctx = EVP_MAC_dup_ctx(ctx_init);
if (ctx == NULL)
goto err;
if (!EVP_MAC_update(ctx, Ai, Ai_len))
goto err;
/* save state for calculating next A(i) value */
if (olen > chunk) {
ctx_Ai = EVP_MAC_CTX_dup(ctx);
ctx_Ai = EVP_MAC_dup_ctx(ctx);
if (ctx_Ai == NULL)
goto err;
}
@@ -324,15 +324,15 @@ static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
}
if (!EVP_MAC_final(ctx, out, NULL, olen))
goto err;
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
ctx = NULL;
out += chunk;
olen -= chunk;
}
ret = 1;
err:
EVP_MAC_CTX_free(ctx);
EVP_MAC_CTX_free(ctx_Ai);
EVP_MAC_free_ctx(ctx);
EVP_MAC_free_ctx(ctx_Ai);
OPENSSL_cleanse(Ai, sizeof(Ai));
return ret;
}
providers/implementations/keymgmt/dh_kmgmt.c
+45 -7
View File
@@ -36,6 +36,8 @@ static OSSL_OP_keymgmt_gen_fn dh_gen;
static OSSL_OP_keymgmt_gen_cleanup_fn dh_gen_cleanup;
static OSSL_OP_keymgmt_get_params_fn dh_get_params;
static OSSL_OP_keymgmt_gettable_params_fn dh_gettable_params;
static OSSL_OP_keymgmt_set_params_fn dh_set_params;
static OSSL_OP_keymgmt_settable_params_fn dh_settable_params;
static OSSL_OP_keymgmt_has_fn dh_has;
static OSSL_OP_keymgmt_match_fn dh_match;
static OSSL_OP_keymgmt_validate_fn dh_validate;
@@ -235,8 +237,8 @@ err:
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GINDEX, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_H, NULL), \
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_GROUP, NULL, 0), \
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0)
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0), \
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_DH_GROUP, NULL, 0)
# define DH_IMEXPORTABLE_PUBLIC_KEY \
OSSL_PARAM_BN(OSSL_PKEY_PARAM_PUB_KEY, NULL, 0)
# define DH_IMEXPORTABLE_PRIVATE_KEY \
@@ -298,6 +300,15 @@ static ossl_inline int dh_get_params(void *key, OSSL_PARAM params[])
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MAX_SIZE)) != NULL
&& !OSSL_PARAM_set_int(p, DH_size(dh)))
return 0;
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL) {
if (p->data_type != OSSL_PARAM_OCTET_STRING)
return 0;
p->return_size = dh_key2buf(dh, (unsigned char **)&p->data,
p->data_size, 0);
if (p->return_size == 0)
return 0;
}
return ffc_params_todata(dh_get0_params(dh), NULL, params)
&& dh_key_todata(dh, NULL, params);
}
@@ -306,6 +317,7 @@ static const OSSL_PARAM dh_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
DH_IMEXPORTABLE_PARAMETERS,
DH_IMEXPORTABLE_PUBLIC_KEY,
DH_IMEXPORTABLE_PRIVATE_KEY,
@@ -317,6 +329,30 @@ static const OSSL_PARAM *dh_gettable_params(void)
return dh_params;
}
static const OSSL_PARAM dh_known_settable_params[] = {
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
OSSL_PARAM_END
};
static const OSSL_PARAM *dh_settable_params(void)
{
return dh_known_settable_params;
}
static int dh_set_params(void *key, const OSSL_PARAM params[])
{
DH *dh = key;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
if (p != NULL
&& (p->data_type != OSSL_PARAM_OCTET_STRING
|| !dh_buf2key(dh, p->data, p->data_size)))
return 0;
return 1;
}
static int dh_validate_public(DH *dh)
{
const BIGNUM *pub_key = NULL;
@@ -427,7 +463,7 @@ static int dh_gen_set_params(void *genctx, const OSSL_PARAM params[])
return 0;
}
}
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_FFC_GROUP);
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_DH_GROUP);
if (p != NULL) {
if (p->data_type != OSSL_PARAM_UTF8_STRING
|| ((gctx->group_nid = ffc_named_group_to_uid(p->data)) == NID_undef)) {
@@ -436,7 +472,7 @@ static int dh_gen_set_params(void *genctx, const OSSL_PARAM params[])
}
gctx->gen_type = DH_PARAMGEN_TYPE_GROUP;
}
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_FFC_GENERATOR);
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_DH_GENERATOR);
if (p != NULL && !OSSL_PARAM_get_int(p, &gctx->generator))
return 0;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_FFC_GINDEX);
@@ -486,7 +522,9 @@ static int dh_gen_set_params(void *genctx, const OSSL_PARAM params[])
static const OSSL_PARAM *dh_gen_settable_params(void *provctx)
{
static OSSL_PARAM settable[] = {
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_GROUP, NULL, 0),
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_DH_GROUP, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_DH_PRIV_LEN, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_DH_GENERATOR, NULL),
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_TYPE, NULL, 0),
OSSL_PARAM_size_t(OSSL_PKEY_PARAM_FFC_PBITS, NULL),
OSSL_PARAM_size_t(OSSL_PKEY_PARAM_FFC_QBITS, NULL),
@@ -494,10 +532,8 @@ static const OSSL_PARAM *dh_gen_settable_params(void *provctx)
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_DIGEST_PROPS, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GINDEX, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GENERATOR, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_H, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_DH_PRIV_LEN, NULL),
OSSL_PARAM_END
};
return settable;
@@ -621,6 +657,8 @@ const OSSL_DISPATCH dh_keymgmt_functions[] = {
{ OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))dh_freedata },
{ OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*) (void))dh_get_params },
{ OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))dh_gettable_params },
{ OSSL_FUNC_KEYMGMT_SET_PARAMS, (void (*) (void))dh_set_params },
{ OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (void (*) (void))dh_settable_params },
{ OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))dh_has },
{ OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))dh_match },
{ OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))dh_validate },
providers/implementations/keymgmt/dsa_kmgmt.c
-1
View File
@@ -213,7 +213,6 @@ err:
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_GINDEX, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_PCOUNTER, NULL), \
OSSL_PARAM_int(OSSL_PKEY_PARAM_FFC_H, NULL), \
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_FFC_GROUP, NULL, 0), \
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_FFC_SEED, NULL, 0)
# define DSA_IMEXPORTABLE_PUBLIC_KEY \
OSSL_PARAM_BN(OSSL_PKEY_PARAM_PUB_KEY, NULL, 0)
providers/implementations/keymgmt/ec_kmgmt.c
+42 -6
View File
@@ -504,6 +504,20 @@ int ec_get_params(void *key, OSSL_PARAM params[])
if (!OSSL_PARAM_set_int(p, ecdh_cofactor_mode))
return 0;
}
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL) {
BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(key));
if (ctx == NULL)
return 0;
p->return_size = EC_POINT_point2oct(EC_KEY_get0_group(key),
EC_KEY_get0_public_key(key),
POINT_CONVERSION_UNCOMPRESSED,
p->data, p->return_size, ctx);
BN_CTX_free(ctx);
if (p->return_size == 0)
return 0;
}
ret = domparams_to_params(eck, NULL, params)
&& key_to_params(eck, NULL, params, 1, &pub_key)
&& otherparams_to_params(eck, NULL, params);
@@ -515,6 +529,7 @@ static const OSSL_PARAM ec_known_gettable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
EC_IMEXPORTABLE_DOM_PARAMETERS,
EC_IMEXPORTABLE_PUBLIC_KEY,
EC_IMEXPORTABLE_PRIVATE_KEY,
@@ -530,6 +545,7 @@ const OSSL_PARAM *ec_gettable_params(void)
static const OSSL_PARAM ec_known_settable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
OSSL_PARAM_END
};
@@ -545,11 +561,21 @@ int ec_set_params(void *key, const OSSL_PARAM params[])
EC_KEY *eck = key;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_USE_COFACTOR_ECDH);
if (p != NULL && !ec_set_param_ecdh_cofactor_mode(eck, p))
return 0;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
if (p != NULL) {
BN_CTX *ctx = BN_CTX_new_ex(ec_key_get_libctx(key));
int ret = 1;
return 1;
if (ctx == NULL
|| p->data_type != OSSL_PARAM_OCTET_STRING
|| !EC_KEY_oct2key(key, p->data, p->data_size, ctx))
ret = 0;
BN_CTX_free(ctx);
if (!ret)
return 0;
}
return ec_key_otherparams_fromdata(eck, params);
}
static
@@ -583,9 +609,9 @@ int ec_validate(void *keydata, int selection)
struct ec_gen_ctx {
OPENSSL_CTX *libctx;
EC_GROUP *gen_group;
int selection;
int ecdh_mode;
};
static void *ec_gen_init(void *provctx, int selection)
@@ -600,6 +626,7 @@ static void *ec_gen_init(void *provctx, int selection)
gctx->libctx = libctx;
gctx->gen_group = NULL;
gctx->selection = selection;
gctx->ecdh_mode = 0;
}
return gctx;
}
@@ -636,6 +663,11 @@ static int ec_gen_set_params(void *genctx, const OSSL_PARAM params[])
struct ec_gen_ctx *gctx = genctx;
const OSSL_PARAM *p;
if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_USE_COFACTOR_ECDH))
!= NULL) {
if (!OSSL_PARAM_get_int(p, &gctx->ecdh_mode))
return 0;
}
if ((p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_NAME))
!= NULL) {
const char *curve_name = NULL;
@@ -670,7 +702,8 @@ static int ec_gen_set_params(void *genctx, const OSSL_PARAM params[])
static const OSSL_PARAM *ec_gen_settable_params(void *provctx)
{
static OSSL_PARAM settable[] = {
{ OSSL_PKEY_PARAM_EC_NAME, OSSL_PARAM_UTF8_STRING, NULL, 0, 0 },
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_NAME, NULL, 0),
OSSL_PARAM_int(OSSL_PKEY_PARAM_USE_COFACTOR_ECDH, NULL),
OSSL_PARAM_END
};
@@ -705,6 +738,9 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0)
ret = ret && EC_KEY_generate_key(ec);
if (gctx->ecdh_mode != -1)
ret = ret && ec_set_ecdh_cofactor_mode(ec, gctx->ecdh_mode);
if (ret)
return ec;
providers/implementations/keymgmt/ecx_kmgmt.c
+99 -8
View File
@@ -46,6 +46,14 @@ static OSSL_OP_keymgmt_gettable_params_fn x25519_gettable_params;
static OSSL_OP_keymgmt_gettable_params_fn x448_gettable_params;
static OSSL_OP_keymgmt_gettable_params_fn ed25519_gettable_params;
static OSSL_OP_keymgmt_gettable_params_fn ed448_gettable_params;
static OSSL_OP_keymgmt_set_params_fn x25519_set_params;
static OSSL_OP_keymgmt_set_params_fn x448_set_params;
static OSSL_OP_keymgmt_set_params_fn ed25519_set_params;
static OSSL_OP_keymgmt_set_params_fn ed448_set_params;
static OSSL_OP_keymgmt_settable_params_fn x25519_settable_params;
static OSSL_OP_keymgmt_settable_params_fn x448_settable_params;
static OSSL_OP_keymgmt_settable_params_fn ed25519_settable_params;
static OSSL_OP_keymgmt_settable_params_fn ed448_settable_params;
static OSSL_OP_keymgmt_has_fn ecx_has;
static OSSL_OP_keymgmt_match_fn ecx_match;
static OSSL_OP_keymgmt_import_fn ecx_import;
@@ -93,8 +101,11 @@ static int ecx_has(void *keydata, int selection)
int ok = 0;
if (key != NULL) {
if ((selection & ECX_POSSIBLE_SELECTIONS) != 0)
ok = 1;
/*
* ECX keys always have all the parameters they need (i.e. none).
* Therefore we always return with 1, if asked about parameters.
*/
ok = 1;
if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)
ok = ok && key->haspubkey;
@@ -233,6 +244,13 @@ static int ecx_get_params(void *key, OSSL_PARAM params[], int bits, int secbits,
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MAX_SIZE)) != NULL
&& !OSSL_PARAM_set_int(p, size))
return 0;
if ((p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT)) != NULL
&& (ecx->type == ECX_KEY_TYPE_X25519
|| ecx->type == ECX_KEY_TYPE_X448)) {
if (!OSSL_PARAM_set_octet_string(p, ecx->pubkey, ecx->keylen))
return 0;
}
return key_to_params(ecx, NULL, params);
}
@@ -273,16 +291,17 @@ static int ed448_get_params(void *key, OSSL_PARAM params[])
&& ed_get_params(key, params);
}
static const OSSL_PARAM ecx_params[] = {
static const OSSL_PARAM ecx_gettable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_MANDATORY_DIGEST, NULL, 0),
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
ECX_KEY_TYPES(),
OSSL_PARAM_END
};
static const OSSL_PARAM ed_params[] = {
static const OSSL_PARAM ed_gettable_params[] = {
OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
@@ -292,22 +311,92 @@ static const OSSL_PARAM ed_params[] = {
static const OSSL_PARAM *x25519_gettable_params(void)
{
return ecx_params;
return ecx_gettable_params;
}
static const OSSL_PARAM *x448_gettable_params(void)
{
return ecx_params;
return ecx_gettable_params;
}
static const OSSL_PARAM *ed25519_gettable_params(void)
{
return ed_params;
return ed_gettable_params;
}
static const OSSL_PARAM *ed448_gettable_params(void)
{
return ed_params;
return ed_gettable_params;
}
static int ecx_set_params(void *key, const OSSL_PARAM params[])
{
ECX_KEY *ecxkey = key;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_TLS_ENCODED_PT);
if (p != NULL) {
void *buf = ecxkey->pubkey;
if (p->data_size != ecxkey->keylen
|| !OSSL_PARAM_get_octet_string(p, &buf, sizeof(ecxkey->pubkey),
NULL))
return 0;
OPENSSL_clear_free(ecxkey->privkey, ecxkey->keylen);
ecxkey->privkey = NULL;
ecxkey->haspubkey = 1;
}
return 1;
}
static int x25519_set_params(void *key, const OSSL_PARAM params[])
{
return ecx_set_params(key, params);
}
static int x448_set_params(void *key, const OSSL_PARAM params[])
{
return ecx_set_params(key, params);
}
static int ed25519_set_params(void *key, const OSSL_PARAM params[])
{
return 1;
}
static int ed448_set_params(void *key, const OSSL_PARAM params[])
{
return 1;
}
static const OSSL_PARAM ecx_settable_params[] = {
OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_TLS_ENCODED_PT, NULL, 0),
OSSL_PARAM_END
};
static const OSSL_PARAM ed_settable_params[] = {
OSSL_PARAM_END
};
static const OSSL_PARAM *x25519_settable_params(void)
{
return ecx_settable_params;
}
static const OSSL_PARAM *x448_settable_params(void)
{
return ecx_settable_params;
}
static const OSSL_PARAM *ed25519_settable_params(void)
{
return ed_settable_params;
}
static const OSSL_PARAM *ed448_settable_params(void)
{
return ed_settable_params;
}
static void *ecx_gen_init(void *provctx, int selection, ECX_KEY_TYPE type)
@@ -450,6 +539,8 @@ static void ecx_gen_cleanup(void *genctx)
{ OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))ecx_key_free }, \
{ OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*) (void))alg##_get_params }, \
{ OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))alg##_gettable_params }, \
{ OSSL_FUNC_KEYMGMT_SET_PARAMS, (void (*) (void))alg##_set_params }, \
{ OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (void (*) (void))alg##_settable_params }, \
{ OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))ecx_has }, \
{ OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))ecx_match }, \
{ OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))ecx_import }, \
providers/implementations/keymgmt/rsa_kmgmt.c
+5 -3
View File
@@ -405,8 +405,8 @@ static void *gen_init(void *provctx, int selection, int rsa_type)
} else {
gctx->nbits = 2048;
gctx->primes = RSA_DEFAULT_PRIME_NUM;
gctx->rsa_type = rsa_type;
}
gctx->rsa_type = rsa_type;
}
return gctx;
}
@@ -490,6 +490,9 @@ static void *rsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
RSA *rsa = NULL, *rsa_tmp = NULL;
BN_GENCB *gencb = NULL;
if (gctx == NULL)
return NULL;
switch (gctx->rsa_type) {
case RSA_FLAG_TYPE_RSA:
/* For plain RSA keys, PSS parameters must not be set */
@@ -507,8 +510,7 @@ static void *rsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
return NULL;
}
if (gctx == NULL
|| (rsa_tmp = rsa_new_with_ctx(gctx->libctx)) == NULL)
if ((rsa_tmp = rsa_new_with_ctx(gctx->libctx)) == NULL)
return NULL;
gctx->cb = osslcb;
providers/implementations/serializers/serializer_rsa.c
+2 -2
View File
@@ -209,9 +209,9 @@ int ossl_prov_prepare_rsa_params(const void *rsa, int nid,
break;
}
if (!DER_w_RSASSA_PSS_params(&pkt, -1, pss)
|| !WPACKET_finish(&pkt))
|| !WPACKET_finish(&pkt)
|| !WPACKET_get_total_written(&pkt, &str_sz))
goto err;
WPACKET_get_total_written(&pkt, &str_sz);
WPACKET_cleanup(&pkt);
/*
providers/implementations/signature/dsa.c
+3 -1
View File
@@ -177,7 +177,8 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,
*/
ctx->aid_len = 0;
if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
&& DER_w_algorithmIdentifier_DSA_with(&pkt, -1, ctx->dsa, md_nid)
&& DER_w_algorithmIdentifier_DSA_with_MD(&pkt, -1, ctx->dsa,
md_nid)
&& WPACKET_finish(&pkt)) {
WPACKET_get_total_written(&pkt, &ctx->aid_len);
ctx->aid = WPACKET_get_curr(&pkt);
@@ -445,6 +446,7 @@ static int dsa_set_ctx_params(void *vpdsactx, const OSSL_PARAM params[])
static const OSSL_PARAM known_settable_ctx_params[] = {
OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0),
OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PROPERTIES, NULL, 0),
OSSL_PARAM_END
};
providers/implementations/signature/ecdsa.c
+1 -1
View File
@@ -238,7 +238,7 @@ static int ecdsa_digest_signverify_init(void *vctx, const char *mdname,
*/
ctx->aid_len = 0;
if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
&& DER_w_algorithmIdentifier_ECDSA_with(&pkt, -1, ctx->ec, md_nid)
&& DER_w_algorithmIdentifier_ECDSA_with_MD(&pkt, -1, ctx->ec, md_nid)
&& WPACKET_finish(&pkt)) {
WPACKET_get_total_written(&pkt, &ctx->aid_len);
ctx->aid = WPACKET_get_curr(&pkt);
providers/implementations/signature/eddsa.c
+1 -1
View File
@@ -56,7 +56,7 @@ static int eddsa_digest_signverify_init(void *vpeddsactx, const char *mdname,
PROV_EDDSA_CTX *peddsactx = (PROV_EDDSA_CTX *)vpeddsactx;
ECX_KEY *edkey = (ECX_KEY *)vedkey;
if (mdname != NULL) {
if (mdname != NULL && mdname[0] != '\0') {
PROVerr(0, PROV_R_INVALID_DIGEST);
return 0;
}
providers/implementations/signature/rsa.c
+56 -26
View File
@@ -55,13 +55,11 @@ static OSSL_OP_signature_set_ctx_md_params_fn rsa_set_ctx_md_params;
static OSSL_OP_signature_settable_ctx_md_params_fn rsa_settable_ctx_md_params;
static OSSL_ITEM padding_item[] = {
{ RSA_PKCS1_PADDING, "pkcs1" },
{ RSA_SSLV23_PADDING, "sslv23" },
{ RSA_NO_PADDING, "none" },
{ RSA_PKCS1_OAEP_PADDING, "oaep" }, /* Correct spelling first */
{ RSA_PKCS1_OAEP_PADDING, "oeap" },
{ RSA_X931_PADDING, "x931" },
{ RSA_PKCS1_PSS_PADDING, "pss" },
{ RSA_PKCS1_PADDING, OSSL_PKEY_RSA_PAD_MODE_PKCSV15 },
{ RSA_SSLV23_PADDING, OSSL_PKEY_RSA_PAD_MODE_SSLV23 },
{ RSA_NO_PADDING, OSSL_PKEY_RSA_PAD_MODE_NONE },
{ RSA_X931_PADDING, OSSL_PKEY_RSA_PAD_MODE_X931 },
{ RSA_PKCS1_PSS_PADDING, OSSL_PKEY_RSA_PAD_MODE_PSS },
{ 0, NULL }
};
@@ -227,17 +225,22 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
int md_nid = rsa_get_md_nid(md);
WPACKET pkt;
size_t mdname_len = strlen(mdname);
if (md == NULL
|| md_nid == NID_undef
|| !rsa_check_padding(md_nid, ctx->pad_mode)
|| !rsa_check_parameters(md, ctx)) {
|| !rsa_check_parameters(md, ctx)
|| mdname_len >= sizeof(ctx->mdname)) {
if (md == NULL)
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"%s could not be fetched", mdname);
if (md_nid == NID_undef)
ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
"digest=%s", mdname);
if (mdname_len >= sizeof(ctx->mdname))
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"%s exceeds name buffer length", mdname);
EVP_MD_free(md);
return 0;
}
@@ -254,7 +257,8 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
*/
ctx->aid_len = 0;
if (WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf))
&& DER_w_algorithmIdentifier_RSA_with(&pkt, -1, ctx->rsa, md_nid)
&& DER_w_algorithmIdentifier_MDWithRSAEncryption(&pkt, -1, ctx->rsa,
md_nid)
&& WPACKET_finish(&pkt)) {
WPACKET_get_total_written(&pkt, &ctx->aid_len);
ctx->aid = WPACKET_get_curr(&pkt);
@@ -273,6 +277,8 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
static int rsa_setup_mgf1_md(PROV_RSA_CTX *ctx, const char *mdname,
const char *mdprops)
{
size_t len;
if (mdprops == NULL)
mdprops = ctx->propq;
@@ -284,7 +290,12 @@ static int rsa_setup_mgf1_md(PROV_RSA_CTX *ctx, const char *mdname,
"%s could not be fetched", mdname);
return 0;
}
OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname));
len = OPENSSL_strlcpy(ctx->mgf1_mdname, mdname, sizeof(ctx->mgf1_mdname));
if (len >= sizeof(ctx->mgf1_mdname)) {
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"%s exceeds name buffer length", mdname);
return 0;
}
return 1;
}
@@ -320,6 +331,7 @@ static int rsa_signature_init(void *vprsactx, void *vrsa, int operation)
int mgf1md_nid = rsa_pss_params_30_maskgenhashalg(pss);
int min_saltlen = rsa_pss_params_30_saltlen(pss);
const char *mdname, *mgf1mdname;
size_t len;
mdname = rsa_oaeppss_nid2name(md_nid);
mgf1mdname = rsa_oaeppss_nid2name(mgf1md_nid);
@@ -336,9 +348,20 @@ static int rsa_signature_init(void *vprsactx, void *vrsa, int operation)
return 0;
}
strncpy(prsactx->mdname, mdname, sizeof(prsactx->mdname));
strncpy(prsactx->mgf1_mdname, mgf1mdname,
sizeof(prsactx->mgf1_mdname));
len = OPENSSL_strlcpy(prsactx->mdname, mdname,
sizeof(prsactx->mdname));
if (len >= sizeof(prsactx->mdname)) {
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"hash algorithm name too long");
return 0;
}
len = OPENSSL_strlcpy(prsactx->mgf1_mdname, mgf1mdname,
sizeof(prsactx->mgf1_mdname));
if (len >= sizeof(prsactx->mgf1_mdname)) {
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
"MGF1 hash algorithm name too long");
return 0;
}
prsactx->saltlen = min_saltlen;
return rsa_setup_md(prsactx, mdname, prsactx->propq)
@@ -914,25 +937,32 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params)
if (!OSSL_PARAM_set_int(p, prsactx->saltlen))
return 0;
} else if (p->data_type == OSSL_PARAM_UTF8_STRING) {
const char *value = NULL;
switch (prsactx->saltlen) {
case RSA_PSS_SALTLEN_DIGEST:
if (!OSSL_PARAM_set_utf8_string(p, "digest"))
return 0;
value = OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST;
break;
case RSA_PSS_SALTLEN_MAX:
if (!OSSL_PARAM_set_utf8_string(p, "max"))
return 0;
value = OSSL_PKEY_RSA_PSS_SALT_LEN_MAX;
break;
case RSA_PSS_SALTLEN_AUTO:
if (!OSSL_PARAM_set_utf8_string(p, "auto"))
return 0;
value = OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO;
break;
default:
if (BIO_snprintf(p->data, p->data_size, "%d", prsactx->saltlen)
<= 0)
return 0;
break;
{
int len = BIO_snprintf(p->data, p->data_size, "%d",
prsactx->saltlen);
if (len <= 0)
return 0;
p->return_size = len;
break;
}
}
if (value != NULL
&& !OSSL_PARAM_set_utf8_string(p, value))
return 0;
}
}
@@ -1092,11 +1122,11 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
return 0;
break;
case OSSL_PARAM_UTF8_STRING:
if (strcmp(p->data, "digest") == 0)
if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_DIGEST) == 0)
saltlen = RSA_PSS_SALTLEN_DIGEST;
else if (strcmp(p->data, "max") == 0)
else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_MAX) == 0)
saltlen = RSA_PSS_SALTLEN_MAX;
else if (strcmp(p->data, "auto") == 0)
else if (strcmp(p->data, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO) == 0)
saltlen = RSA_PSS_SALTLEN_AUTO;
else
saltlen = atoi(p->data);