mirror of
https://github.com/openssl/openssl.git
synced 2024-12-09 05:51:54 +08:00
899e25643d
The low level DH API has two functions for checking parameters: DH_check_ex() and DH_check_params_ex(). The former does a "full" check, while the latter does a "quick" check. Most importantly it skips the check for a safe prime. We're ok without using safe primes here because we're doing ephemeral DH. Now that libssl is fully using the EVP API, we need a way to specify that we want a quick check instead of a full check. Therefore we introduce EVP_PKEY_param_check_quick() and use it. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14146)
196 lines
5.1 KiB
C
196 lines
5.1 KiB
C
/*
|
|
* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
|
*
|
|
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
* in the file LICENSE in the source distribution or at
|
|
* https://www.openssl.org/source/license.html
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include "internal/cryptlib.h"
|
|
#include <openssl/objects.h>
|
|
#include <openssl/evp.h>
|
|
#include "crypto/bn.h"
|
|
#include "crypto/asn1.h"
|
|
#include "crypto/evp.h"
|
|
#include "evp_local.h"
|
|
|
|
/*
|
|
* Returns:
|
|
* 1 True
|
|
* 0 False
|
|
* -1 Unsupported (use legacy path)
|
|
*/
|
|
static int try_provided_check(EVP_PKEY_CTX *ctx, int selection, int checktype)
|
|
{
|
|
EVP_KEYMGMT *keymgmt;
|
|
void *keydata;
|
|
|
|
if (evp_pkey_ctx_is_legacy(ctx))
|
|
return -1;
|
|
|
|
keymgmt = ctx->keymgmt;
|
|
keydata = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx,
|
|
&keymgmt, ctx->propquery);
|
|
if (keydata == NULL) {
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
|
|
return 0;
|
|
}
|
|
|
|
return evp_keymgmt_validate(keymgmt, keydata, selection, checktype);
|
|
}
|
|
|
|
int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
|
|
{
|
|
EVP_PKEY *pkey = ctx->pkey;
|
|
int ok;
|
|
|
|
if (pkey == NULL) {
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
|
|
return 0;
|
|
}
|
|
|
|
if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
|
|
OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
|
|
return ok;
|
|
|
|
if (pkey->type == EVP_PKEY_NONE)
|
|
goto not_supported;
|
|
|
|
#ifndef FIPS_MODULE
|
|
/* legacy */
|
|
/* call customized public key check function first */
|
|
if (ctx->pmeth->public_check != NULL)
|
|
return ctx->pmeth->public_check(pkey);
|
|
|
|
/* use default public key check function in ameth */
|
|
if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL)
|
|
goto not_supported;
|
|
|
|
return pkey->ameth->pkey_public_check(pkey);
|
|
#endif
|
|
not_supported:
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
|
return -2;
|
|
}
|
|
|
|
static int evp_pkey_param_check_combined(EVP_PKEY_CTX *ctx, int checktype)
|
|
{
|
|
EVP_PKEY *pkey = ctx->pkey;
|
|
int ok;
|
|
|
|
if (pkey == NULL) {
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
|
|
return 0;
|
|
}
|
|
|
|
if ((ok = try_provided_check(ctx,
|
|
OSSL_KEYMGMT_SELECT_ALL_PARAMETERS,
|
|
checktype)) != -1)
|
|
return ok;
|
|
|
|
if (pkey->type == EVP_PKEY_NONE)
|
|
goto not_supported;
|
|
|
|
#ifndef FIPS_MODULE
|
|
/* legacy */
|
|
/* call customized param check function first */
|
|
if (ctx->pmeth->param_check != NULL)
|
|
return ctx->pmeth->param_check(pkey);
|
|
|
|
/* use default param check function in ameth */
|
|
if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL)
|
|
goto not_supported;
|
|
|
|
return pkey->ameth->pkey_param_check(pkey);
|
|
#endif
|
|
not_supported:
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
|
return -2;
|
|
}
|
|
|
|
int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
|
|
{
|
|
return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_FULL_CHECK);
|
|
}
|
|
|
|
int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx)
|
|
{
|
|
return evp_pkey_param_check_combined(ctx, OSSL_KEYMGMT_VALIDATE_QUICK_CHECK);
|
|
}
|
|
|
|
int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx)
|
|
{
|
|
EVP_PKEY *pkey = ctx->pkey;
|
|
int ok;
|
|
|
|
if (pkey == NULL) {
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
|
|
return 0;
|
|
}
|
|
|
|
if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_PRIVATE_KEY,
|
|
OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
|
|
return ok;
|
|
|
|
/* not supported for legacy keys */
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
|
return -2;
|
|
}
|
|
|
|
int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx)
|
|
{
|
|
EVP_PKEY *pkey = ctx->pkey;
|
|
int ok;
|
|
|
|
if (pkey == NULL) {
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
|
|
return 0;
|
|
}
|
|
|
|
if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_KEYPAIR,
|
|
OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
|
|
return ok;
|
|
|
|
/* not supported for legacy keys */
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
|
return -2;
|
|
}
|
|
|
|
int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
|
|
{
|
|
EVP_PKEY *pkey = ctx->pkey;
|
|
int ok;
|
|
|
|
if (pkey == NULL) {
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_NO_KEY_SET);
|
|
return 0;
|
|
}
|
|
|
|
if ((ok = try_provided_check(ctx, OSSL_KEYMGMT_SELECT_KEYPAIR,
|
|
OSSL_KEYMGMT_VALIDATE_FULL_CHECK)) != -1)
|
|
return ok;
|
|
|
|
if (pkey->type == EVP_PKEY_NONE)
|
|
goto not_supported;
|
|
|
|
#ifndef FIPS_MODULE
|
|
/* legacy */
|
|
/* call customized check function first */
|
|
if (ctx->pmeth->check != NULL)
|
|
return ctx->pmeth->check(pkey);
|
|
|
|
/* use default check function in ameth */
|
|
if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL)
|
|
goto not_supported;
|
|
|
|
return pkey->ameth->pkey_check(pkey);
|
|
#endif
|
|
not_supported:
|
|
ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
|
return -2;
|
|
}
|
|
|