kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
55db667c62
boringssl/crypto/evp/p_ec.c

288 lines
8.0 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 2006.
*/
/* ====================================================================
* Copyright (c) 2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#include <openssl/evp.h>
Remove string.h from base.h. Including string.h in base.h causes any file that includes a BoringSSL header to include string.h. Generally this wouldn't be a problem, although string.h might slow down the compile if it wasn't otherwise needed. However, it also causes problems for ipsec-tools in Android because OpenSSL didn't have this behaviour. This change removes string.h from base.h and, instead, adds it to each .c file that requires it. Change-Id: I5968e50b0e230fd3adf9b72dd2836e6f52d6fb37 Reviewed-on: https://boringssl-review.googlesource.com/3200 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-31 01:08:37 +00:00
#include <string.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/bn.h>
#include <openssl/buf.h>
#include <openssl/digest.h>
#include <openssl/ec.h>
#include <openssl/ec_key.h>
#include <openssl/ecdh.h>
#include <openssl/ecdsa.h>
#include <openssl/err.h>
#include <openssl/mem.h>
Remove some easy obj.h dependencies. A lot of consumers of obj.h only want the NID values. Others didn't need it at all. This also removes some OBJ_nid2sn and OBJ_nid2ln calls in EVP error paths which isn't worth pulling a large table in for. BUG=chromium:499653 Change-Id: Id6dff578f993012e35b740a13b8e4f9c2edc0744 Reviewed-on: https://boringssl-review.googlesource.com/7563 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-25 22:07:11 +00:00
#include <openssl/nid.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include "internal.h"
Move ec/ and ecdsa/ into fipsmodule/ The names in the P-224 code collided with the P-256 code and thus many of the functions and constants in the P-224 code have been prefixed. Change-Id: I6bcd304640c539d0483d129d5eaf1702894929a8 Reviewed-on: https://boringssl-review.googlesource.com/15847 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-05-02 22:25:39 +01:00
#include "../fipsmodule/ec/internal.h"
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
#include "../internal.h"
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
typedef struct {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// message digest
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
const EVP_MD *md;
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
EC_GROUP *gen_group;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
} EC_PKEY_CTX;
static int pkey_ec_init(EVP_PKEY_CTX *ctx) {
EC_PKEY_CTX *dctx;
dctx = OPENSSL_malloc(sizeof(EC_PKEY_CTX));
if (!dctx) {
return 0;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(dctx, 0, sizeof(EC_PKEY_CTX));
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
ctx->data = dctx;
return 1;
}
static int pkey_ec_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) {
EC_PKEY_CTX *dctx, *sctx;
if (!pkey_ec_init(dst)) {
return 0;
}
sctx = src->data;
dctx = dst->data;
dctx->md = sctx->md;
return 1;
}
static void pkey_ec_cleanup(EVP_PKEY_CTX *ctx) {
EC_PKEY_CTX *dctx = ctx->data;
if (!dctx) {
return;
}
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
EC_GROUP_free(dctx->gen_group);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
OPENSSL_free(dctx);
}
static int pkey_ec_sign(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *siglen,
const uint8_t *tbs, size_t tbslen) {
unsigned int sltmp;
EC_KEY *ec = ctx->pkey->pkey.ec;
if (!sig) {
*siglen = ECDSA_size(ec);
return 1;
} else if (*siglen < (size_t)ECDSA_size(ec)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Remove superfluous SHA-1 dependency from EVP ECDSA code. The documentation for |ECDSA_sign| and |ECDSA_verify| says that the |type| parameter should be zero. Change-Id: I875d3405455c5443f5a5a5c2960a9a9f486ca5bb Reviewed-on: https://boringssl-review.googlesource.com/5832 Reviewed-by: Adam Langley <agl@google.com>
2015-09-11 00:20:18 +01:00
if (!ECDSA_sign(0, tbs, tbslen, sig, &sltmp, ec)) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
*siglen = (size_t)sltmp;
return 1;
}
static int pkey_ec_verify(EVP_PKEY_CTX *ctx, const uint8_t *sig, size_t siglen,
const uint8_t *tbs, size_t tbslen) {
Remove superfluous SHA-1 dependency from EVP ECDSA code. The documentation for |ECDSA_sign| and |ECDSA_verify| says that the |type| parameter should be zero. Change-Id: I875d3405455c5443f5a5a5c2960a9a9f486ca5bb Reviewed-on: https://boringssl-review.googlesource.com/5832 Reviewed-by: Adam Langley <agl@google.com>
2015-09-11 00:20:18 +01:00
return ECDSA_verify(0, tbs, tbslen, sig, siglen, ctx->pkey->pkey.ec);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
static int pkey_ec_derive(EVP_PKEY_CTX *ctx, uint8_t *key,
size_t *keylen) {
int ret;
size_t outlen;
const EC_POINT *pubkey = NULL;
EC_KEY *eckey;
if (!ctx->pkey || !ctx->peerkey) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_KEYS_NOT_SET);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Remove ECDH_KDF_X9_62 and associated EVP glue. Removes a bit of unused code. This effectively reverts upstream's 25af7a5dbc05c7359d1d7f472d50d65a9d876b7e. It's new with OpenSSL 1.0.2 so nothing can be using it yet. We can restore it with tests if we end up wanting it later. (Also I think it might be misnamed. The KDF seems to be defined in X9.63, not X9.62.) Change-Id: I482daf681e0cf5c3bbdc72c57793f91448deaee8 Reviewed-on: https://boringssl-review.googlesource.com/2846 Reviewed-by: Adam Langley <agl@google.com>
2014-12-30 11:46:52 +00:00
eckey = ctx->pkey->pkey.ec;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (!key) {
const EC_GROUP *group;
group = EC_KEY_get0_group(eckey);
*keylen = (EC_GROUP_get_degree(group) + 7) / 8;
return 1;
}
pubkey = EC_KEY_get0_public_key(ctx->peerkey->pkey.ec);
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// NB: unlike PKCS#3 DH, if *outlen is less than maximum size this is
// not an error, the result is truncated.
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
outlen = *keylen;
ret = ECDH_compute_key(key, outlen, pubkey, eckey, 0);
if (ret < 0) {
Align EVP return values with BoringSSL convention. Where possible, functions should return one for success and zero for error. The use of additional negative values to indicate an error is, itself, error prone. This change fixes many EVP functions to remove the possibility of negative return values. Existing code that is testing for <= 0 will continue to function, although there is the possibility that some code was differentiating between negative values (error) and zero (invalid signature) for the verify functions and will now show the wrong error message. Change-Id: I982512596bb18a82df65861394dbd7487783bd3d Reviewed-on: https://boringssl-review.googlesource.com/1333 Reviewed-by: Adam Langley <agl@google.com>
2014-07-25 18:06:44 +01:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
*keylen = ret;
return 1;
}
static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
EC_PKEY_CTX *dctx = ctx->data;
switch (type) {
case EVP_PKEY_CTRL_MD:
if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
EVP_MD_type((const EVP_MD *)p2) != NID_ecdsa_with_SHA1 &&
EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
EVP_MD_type((const EVP_MD *)p2) != NID_sha256 &&
EVP_MD_type((const EVP_MD *)p2) != NID_sha384 &&
EVP_MD_type((const EVP_MD *)p2) != NID_sha512) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_DIGEST_TYPE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
dctx->md = p2;
return 1;
case EVP_PKEY_CTRL_GET_MD:
*(const EVP_MD **)p2 = dctx->md;
return 1;
case EVP_PKEY_CTRL_PEER_KEY:
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Default behaviour is OK
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 1;
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
case EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID: {
EC_GROUP *group = EC_GROUP_new_by_curve_name(p1);
if (group == NULL) {
return 0;
}
EC_GROUP_free(dctx->gen_group);
dctx->gen_group = group;
return 1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
default:
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED);
Normalize all EVP_PKEY_CTX_ctrl return values. No code within BoringSSL or Google (grep for EVP_PKEY_CTX_(ctrl|get|set)) is sensitive to the various failure cases. Normalize it all to 0/1 for simplicity. This does carry a slight risk: any new ctrl hooks we import from upstream that, like EVP_PKEY_CTX_get_rsa_oaep_md, return something other than success/failure cannot be called directly via EVP_PKEY_CTX_ctrl. They instead need to internally be routed through a struct like CBS and only called through the wrappers. To that end, unexport EVP_PKEY_CTX_ctrl and require that callers use the wrappers. No code in Google uses it directly and, if need be, switching to the wrapper would be an incredibly upstreamable patch. Change-Id: I3fd4e5a1a0f3d4d1c4122c52d4c74a5105b99cd5 Reviewed-on: https://boringssl-review.googlesource.com/3874 Reviewed-by: Adam Langley <agl@google.com>
2015-03-10 21:10:22 +00:00
return 0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
static int pkey_ec_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) {
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
EC_PKEY_CTX *dctx = ctx->data;
const EC_GROUP *group = dctx->gen_group;
if (group == NULL) {
if (ctx->pkey == NULL) {
OPENSSL_PUT_ERROR(EVP, EVP_R_NO_PARAMETERS_SET);
return 0;
}
group = EC_KEY_get0_group(ctx->pkey->pkey.ec);
}
EC_KEY *ec = EC_KEY_new();
if (ec == NULL ||
!EC_KEY_set_group(ec, group) ||
!EC_KEY_generate_key(ec)) {
EC_KEY_free(ec);
return 0;
}
EVP_PKEY_assign_EC_KEY(pkey, ec);
return 1;
}
static int pkey_ec_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey) {
EC_PKEY_CTX *dctx = ctx->data;
if (dctx->gen_group == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(EVP, EVP_R_NO_PARAMETERS_SET);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
Remove EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID. This is never exposed. Change-Id: I332bc45f724eb42d68a0839e72b21593d01005ee Reviewed-on: https://boringssl-review.googlesource.com/6847 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 02:05:19 +00:00
EC_KEY *ec = EC_KEY_new();
Implement pkey_ec_keygen with EC_KEY APIs. This removes the last caller of EVP_PKEY_copy_parameters within the library. Change-Id: I6af138d364973b18f52baf55c36c50a24a56bd44 Reviewed-on: https://boringssl-review.googlesource.com/6848 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 02:07:32 +00:00
if (ec == NULL ||
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
!EC_KEY_set_group(ec, dctx->gen_group)) {
Implement pkey_ec_keygen with EC_KEY APIs. This removes the last caller of EVP_PKEY_copy_parameters within the library. Change-Id: I6af138d364973b18f52baf55c36c50a24a56bd44 Reviewed-on: https://boringssl-review.googlesource.com/6848 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 02:07:32 +00:00
EC_KEY_free(ec);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 0;
}
EVP_PKEY_assign_EC_KEY(pkey, ec);
Implement pkey_ec_keygen with EC_KEY APIs. This removes the last caller of EVP_PKEY_copy_parameters within the library. Change-Id: I6af138d364973b18f52baf55c36c50a24a56bd44 Reviewed-on: https://boringssl-review.googlesource.com/6848 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 02:07:32 +00:00
return 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
const EVP_PKEY_METHOD ec_pkey_meth = {
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
EVP_PKEY_EC,
pkey_ec_init,
pkey_ec_copy,
pkey_ec_cleanup,
pkey_ec_keygen,
pkey_ec_sign,
Support EVP_PKEY_{sign,verify}_message with Ed25519. It's amazing how short p_ed25519.c is. BUG=187 Change-Id: Ib2a5fa7a4acf2087ece954506f81e91a1ed483e1 Reviewed-on: https://boringssl-review.googlesource.com/14449 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-28 21:24:11 +01:00
NULL /* sign_message */,
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
pkey_ec_verify,
Support EVP_PKEY_{sign,verify}_message with Ed25519. It's amazing how short p_ed25519.c is. BUG=187 Change-Id: Ib2a5fa7a4acf2087ece954506f81e91a1ed483e1 Reviewed-on: https://boringssl-review.googlesource.com/14449 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-03-28 21:24:11 +01:00
NULL /* verify_message */,
NULL /* verify_recover */,
NULL /* encrypt */,
NULL /* decrypt */,
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
pkey_ec_derive,
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
pkey_ec_paramgen,
Tweaks for node.js node.js is, effectively, another bindings library. However, it's better written than most and, with these changes, only a couple of tiny fixes are needed in node.js. Some of these changes are a little depressing however so we'll need to push node.js to use APIs where possible. Changes: ∙ Support verify_recover. This is very obscure and the motivation appears to be https://github.com/nodejs/node/issues/477 – where it's not clear that anyone understands what it means :( ∙ Add a few, no-op #defines ∙ Add some members to |SSL_CTX| and |SSL| – node.js needs to not reach into these structs in the future. ∙ Add EC_get_builtin_curves. ∙ Add EVP_[CIPHER|MD]_do_all_sorted – these functions are limited to decrepit. Change-Id: I9a3566054260d6c4db9d430beb7c46cc970a9d46 Reviewed-on: https://boringssl-review.googlesource.com/6952 Reviewed-by: Adam Langley <agl@google.com>
2016-01-24 23:58:39 +00:00
pkey_ec_ctrl,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
};
Add a very roundabout EC keygen API. OpenSSL's EVP-level EC API involves a separate "paramgen" operation, which is ultimately just a roundabout way to go from a NID to an EC_GROUP. But Node uses this, and it's the pattern used within OpenSSL these days, so this appears to be the official upstream recommendation. Also add a #define for OPENSSL_EC_EXPLICIT_CURVE, because Node uses it, but fail attempts to use it. Explicit curve encodings are forbidden by RFC 5480 and generally a bad idea. (Parsing such keys back into OpenSSL will cause it to lose the optimized path.) Change-Id: I5e97080e77cf90fc149f6cf6f2cc4900f573fc64 Reviewed-on: https://boringssl-review.googlesource.com/c/34565 Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2019-01-25 22:36:28 +00:00
int EVP_PKEY_CTX_set_ec_paramgen_curve_nid(EVP_PKEY_CTX *ctx, int nid) {
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_EC, EVP_PKEY_OP_TYPE_GEN,
EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID, nid, NULL);
}
int EVP_PKEY_CTX_set_ec_param_enc(EVP_PKEY_CTX *ctx, int encoding) {
// BoringSSL only supports named curve syntax.
if (encoding != OPENSSL_EC_NAMED_CURVE) {
OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PARAMETERS);
return 0;
}
return 1;
}
Reference in New Issue Copy Permalink