mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-11 14:22:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix DSA EVP_PKEY_param_check() when defaults are used for param generation.

Browse Source 
Fixes #14480

An internal flag that is set during param gen was not being tested, so
the wrong type was used to select the dsa domain param validation method.

In the default provider - if no gen_type is set then by default the fips186_4 gentype
will be selected when pbits >=2048 otherwise it selects fips186_2.
The fips provider ignores the gen_type and always uses fips186_4.

Before this change dsa used fips186_2 by default in the default
provider.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14508)
This commit is contained in:
Shane Lontis 2021-03-11 13:36:27 +10:00
parent 91bd45eb9a
commit 3a37ddde91
5 changed files with 38 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
crypto/ffc/ffc_params_validate.c
View File

@ -152,8 +152,12 @@ int ossl_ffc_params_full_validate(OSSL_LIB_CTX *libctx, const FFC_PARAMS *params
res, NULL);
#else
if (params->seed != NULL) {
return ossl_ffc_params_FIPS186_4_validate(libctx, params, paramstype,
res, NULL);
if (params->flags & FFC_PARAM_FLAG_VALIDATE_LEGACY)
return ossl_ffc_params_FIPS186_2_validate(libctx, params, paramstype,
res, NULL);
else
return ossl_ffc_params_FIPS186_4_validate(libctx, params, paramstype,
res, NULL);
} else {
int ret = 0;

6
doc/man7/EVP_PKEY-FFC.pod
View File

@ -100,7 +100,7 @@ Sets the type of parameter generation. The shared valid values are:
=item "fips186_4"
The current standard. This is the default value.
The current standard.
=item "fips186_2"
@ -108,8 +108,8 @@ The old standard that should only be used for legacy purposes.
=item "default"
This is an alias to use the latest implemented standard.
It is currently set to "fips186_4".
This can choose one of "fips186_4" or "fips186_2" depending on other
parameters set for parameter generation.
=back

1
include/crypto/dsa.h
View File

@ -17,6 +17,7 @@
#define DSA_PARAMGEN_TYPE_FIPS_186_4 0 /* Use FIPS186-4 standard */
#define DSA_PARAMGEN_TYPE_FIPS_186_2 1 /* Use legacy FIPS186-2 standard */
#define DSA_PARAMGEN_TYPE_FIPS_DEFAULT 2
DSA *ossl_dsa_new(OSSL_LIB_CTX *libctx);
void ossl_dsa_set0_libctx(DSA *d, OSSL_LIB_CTX *libctx);

8
providers/implementations/keymgmt/dsa_kmgmt.c
View File

@ -78,7 +78,7 @@ static const DSA_GENTYPE_NAME2ID dsatype2id[]=
#ifdef FIPS_MODULE
{ "default", DSA_PARAMGEN_TYPE_FIPS_186_4 },
#else
{ "default", DSA_PARAMGEN_TYPE_FIPS_186_2 },
{ "default", DSA_PARAMGEN_TYPE_FIPS_DEFAULT },
#endif
{ "fips186_4", DSA_PARAMGEN_TYPE_FIPS_186_4 },
{ "fips186_2", DSA_PARAMGEN_TYPE_FIPS_186_2 },
@ -382,7 +382,7 @@ static void *dsa_gen_init(void *provctx, int selection,
#ifdef FIPS_MODULE
gctx->gen_type = DSA_PARAMGEN_TYPE_FIPS_186_4;
#else
gctx->gen_type = DSA_PARAMGEN_TYPE_FIPS_186_2;
gctx->gen_type = DSA_PARAMGEN_TYPE_FIPS_DEFAULT;
#endif
gctx->gindex = -1;
gctx->pcounter = -1;
@ -527,6 +527,10 @@ static void *dsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
if (dsa == NULL)
return NULL;
if (gctx->gen_type == DSA_PARAMGEN_TYPE_FIPS_DEFAULT)
gctx->gen_type = (gctx->pbits >= 2048 ? DSA_PARAMGEN_TYPE_FIPS_186_4 :
DSA_PARAMGEN_TYPE_FIPS_186_2);
gctx->cb = osslcb;
gctx->cbarg = cbarg;
gencb = BN_GENCB_new();

22
test/dsatest.c
View File

@ -302,6 +302,27 @@ end:
return ret;
}
static int test_dsa_default_paramgen_validate(int i)
{
int ret;
EVP_PKEY_CTX *gen_ctx = NULL;
EVP_PKEY_CTX *check_ctx = NULL;
EVP_PKEY *params = NULL;
ret = TEST_ptr(gen_ctx = EVP_PKEY_CTX_new_from_name(NULL, "DSA", NULL))
&& TEST_int_gt(EVP_PKEY_paramgen_init(gen_ctx), 0)
&& (i == 0
|| TEST_true(EVP_PKEY_CTX_set_dsa_paramgen_bits(gen_ctx, 512)))
&& TEST_int_gt(EVP_PKEY_gen(gen_ctx, &params), 0)
&& TEST_ptr(check_ctx = EVP_PKEY_CTX_new_from_pkey(NULL, params, NULL))
&& TEST_int_gt(EVP_PKEY_param_check(check_ctx), 0);
EVP_PKEY_free(params);
EVP_PKEY_CTX_free(check_ctx);
EVP_PKEY_CTX_free(gen_ctx);
return ret;
}
#endif /* OPENSSL_NO_DSA */
int setup_tests(void)
@ -309,6 +330,7 @@ int setup_tests(void)
#ifndef OPENSSL_NO_DSA
ADD_TEST(dsa_test);
ADD_TEST(dsa_keygen_test);
ADD_ALL_TESTS(test_dsa_default_paramgen_validate, 2);
#endif
return 1;
}