kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
68e7124ddf
boringssl/ssl/ssl_rsa.c

811 lines
25 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.] */
Toss file-related convenience bits of ssl/ into a corner. Quite a lot of consumers of the SSL stack will never need to touch files from the SSL stack, but enough do that we can't just ditch them. Toss that all into their own file so a static linker can drop it. Change-Id: Ia07de939889eb09e3ab16aebcc1b6869ca8b75a0 Reviewed-on: https://boringssl-review.googlesource.com/5820 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 20:05:05 +01:00
#include <openssl/ssl.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
#include <limits.h>
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
#include <openssl/ec.h>
#include <openssl/ec_key.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/mem.h>
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
#include <openssl/type_check.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/x509.h>
Revise server-side ECDSA certificate checks. This is in preparation for simplifying tls1_check_group_id, called by tls1_check_ec_cert, which, in turn, is in preparation for moving the peer group list to SSL_HANDSHAKE. It also helps with bug #55. Move the key usage check to the certificate configuration sanity check. There's no sense in doing it late. Also remove the ECDSA peer curve check as we configure certificates externally. With only one certificate, there's no sense in trying to remove it. BUG=55 Change-Id: I8c116337770d96cc9cfd4b4f0ca7939a4f05a1a9 Reviewed-on: https://boringssl-review.googlesource.com/11524 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-07 05:21:35 +01:00
#include <openssl/x509v3.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Rename ssl_locl.h to internal.h Match the other internal headers. Change-Id: Iff7e2dd06a1a7bf993053d0464cc15638ace3aaa Reviewed-on: https://boringssl-review.googlesource.com/4280 Reviewed-by: Adam Langley <agl@google.com>
2015-04-08 03:38:30 +01:00
#include "internal.h"
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Toss file-related convenience bits of ssl/ into a corner. Quite a lot of consumers of the SSL stack will never need to touch files from the SSL stack, but enough do that we can't just ditch them. Toss that all into their own file so a static linker can drop it. Change-Id: Ia07de939889eb09e3ab16aebcc1b6869ca8b75a0 Reviewed-on: https://boringssl-review.googlesource.com/5820 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 20:05:05 +01:00
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
static int ssl_set_cert(CERT *c, X509 *x509);
static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
static int is_key_type_supported(int key_type) {
return key_type == EVP_PKEY_RSA || key_type == EVP_PKEY_EC;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
int SSL_use_certificate(SSL *ssl, X509 *x) {
if (x == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
return ssl_set_cert(ssl->cert, x);
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int SSL_use_certificate_ASN1(SSL *ssl, const uint8_t *der, size_t der_len) {
if (der_len > LONG_MAX) {
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return 0;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
const uint8_t *p = der;
X509 *x509 = d2i_X509(NULL, &p, (long)der_len);
if (x509 == NULL || p != der + der_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
X509_free(x509);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int ret = SSL_use_certificate(ssl, x509);
X509_free(x509);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return ret;
}
int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) {
EVP_PKEY *pkey;
int ret;
if (rsa == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
pkey = EVP_PKEY_new();
if (pkey == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_EVP_LIB);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
RSA_up_ref(rsa);
EVP_PKEY_assign_RSA(pkey, rsa);
ret = ssl_set_pkey(ssl->cert, pkey);
EVP_PKEY_free(pkey);
return ret;
}
static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) {
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
if (!is_key_type_supported(pkey->type)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
Rename X.509 members in |SSL_SESSION| and |CERT|. This change renames |peer| to |x509_peer| and |cert_chain| to |x509_chain| in |SSL_SESSION|. It also renames |x509| to |x509_leaf| and |chain| to |x509_chain| in |CERT|. (All with an eye to maybe making them lazily initialised in the future). This a) catches anyone who might be accessing these members directly and b) makes space for |CRYPTO_BUFFER|-based values to take the unprefixed names. Change-Id: I10573304fb7d6f1ea03f9e645f7fc0acdaf71ac2 Reviewed-on: https://boringssl-review.googlesource.com/12162 Reviewed-by: David Benjamin <davidben@google.com>
2016-11-07 20:02:35 +00:00
X509 *x509_leaf = c->x509_leaf;
if (x509_leaf != NULL) {
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* Sanity-check that the private key and the certificate match, unless the
* key is opaque (in case of, say, a smartcard). */
if (!EVP_PKEY_is_opaque(pkey) &&
Rename X.509 members in |SSL_SESSION| and |CERT|. This change renames |peer| to |x509_peer| and |cert_chain| to |x509_chain| in |SSL_SESSION|. It also renames |x509| to |x509_leaf| and |chain| to |x509_chain| in |CERT|. (All with an eye to maybe making them lazily initialised in the future). This a) catches anyone who might be accessing these members directly and b) makes space for |CRYPTO_BUFFER|-based values to take the unprefixed names. Change-Id: I10573304fb7d6f1ea03f9e645f7fc0acdaf71ac2 Reviewed-on: https://boringssl-review.googlesource.com/12162 Reviewed-by: David Benjamin <davidben@google.com>
2016-11-07 20:02:35 +00:00
!X509_check_private_key(x509_leaf, pkey)) {
X509_free(c->x509_leaf);
c->x509_leaf = NULL;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
}
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
EVP_PKEY_free(c->privatekey);
Change |EVP_PKEY_up_ref| to return int. Upstream have added |EVP_PKEY_up_ref|, but their version returns an int. Having this function with a different signature like that is dangerous so this change aligns BoringSSL with upstream. Users of this function in Chromium and internally should already have been updated. Change-Id: I0a7aeaf1a1ca3b0f0c635e2ee3826aa100b18157 Reviewed-on: https://boringssl-review.googlesource.com/8736 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-12 18:39:20 +01:00
EVP_PKEY_up_ref(pkey);
c->privatekey = pkey;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 1;
}
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
2015-06-27 19:56:25 +01:00
int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const uint8_t *der, size_t der_len) {
RSA *rsa = RSA_private_key_from_bytes(der, der_len);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
if (rsa == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
2015-06-27 19:56:25 +01:00
int ret = SSL_use_RSAPrivateKey(ssl, rsa);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
RSA_free(rsa);
return ret;
}
int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) {
int ret;
if (pkey == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
ret = ssl_set_pkey(ssl->cert, pkey);
return ret;
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const uint8_t *der,
size_t der_len) {
if (der_len > LONG_MAX) {
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return 0;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
const uint8_t *p = der;
EVP_PKEY *pkey = d2i_PrivateKey(type, NULL, &p, (long)der_len);
if (pkey == NULL || p != der + der_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
EVP_PKEY_free(pkey);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int ret = SSL_use_PrivateKey(ssl, pkey);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
EVP_PKEY_free(pkey);
return ret;
}
int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) {
if (x == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
return ssl_set_cert(ctx->cert, x);
}
static int ssl_set_cert(CERT *c, X509 *x) {
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
EVP_PKEY *pkey = X509_get_pubkey(x);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
if (pkey == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_X509_LIB);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
if (!is_key_type_supported(pkey->type)) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
EVP_PKEY_free(pkey);
return 0;
}
Revise server-side ECDSA certificate checks. This is in preparation for simplifying tls1_check_group_id, called by tls1_check_ec_cert, which, in turn, is in preparation for moving the peer group list to SSL_HANDSHAKE. It also helps with bug #55. Move the key usage check to the certificate configuration sanity check. There's no sense in doing it late. Also remove the ECDSA peer curve check as we configure certificates externally. With only one certificate, there's no sense in trying to remove it. BUG=55 Change-Id: I8c116337770d96cc9cfd4b4f0ca7939a4f05a1a9 Reviewed-on: https://boringssl-review.googlesource.com/11524 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-07 05:21:35 +01:00
/* An ECC certificate may be usable for ECDH or ECDSA. We only support ECDSA
* certificates, so sanity-check the key usage extension. */
if (pkey->type == EVP_PKEY_EC) {
/* This call populates extension flags (ex_flags). */
X509_check_purpose(x, -1, 0);
if ((x->ex_flags & EXFLAG_KUSAGE) &&
!(x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE)) {
OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
EVP_PKEY_free(pkey);
return 0;
}
}
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
if (c->privatekey != NULL) {
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* Sanity-check that the private key and the certificate match, unless the
* key is opaque (in case of, say, a smartcard). */
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
if (!EVP_PKEY_is_opaque(c->privatekey) &&
!X509_check_private_key(x, c->privatekey)) {
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* don't fail for a cert/key mismatch, just free current private key
* (when switching to a different cert & key, first this function should
* be used, then ssl_set_pkey */
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
EVP_PKEY_free(c->privatekey);
c->privatekey = NULL;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* clear error queue */
ERR_clear_error();
}
}
EVP_PKEY_free(pkey);
Rename X.509 members in |SSL_SESSION| and |CERT|. This change renames |peer| to |x509_peer| and |cert_chain| to |x509_chain| in |SSL_SESSION|. It also renames |x509| to |x509_leaf| and |chain| to |x509_chain| in |CERT|. (All with an eye to maybe making them lazily initialised in the future). This a) catches anyone who might be accessing these members directly and b) makes space for |CRYPTO_BUFFER|-based values to take the unprefixed names. Change-Id: I10573304fb7d6f1ea03f9e645f7fc0acdaf71ac2 Reviewed-on: https://boringssl-review.googlesource.com/12162 Reviewed-by: David Benjamin <davidben@google.com>
2016-11-07 20:02:35 +00:00
X509_free(c->x509_leaf);
Finish aligning up_ref functions with OpenSSL 1.1.0. All external callers should be resolved now. BUG=89 Change-Id: I6055450e8202c59cca49e4a824be3ec11c32a15a Reviewed-on: https://boringssl-review.googlesource.com/10285 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-11 17:14:47 +01:00
X509_up_ref(x);
Rename X.509 members in |SSL_SESSION| and |CERT|. This change renames |peer| to |x509_peer| and |cert_chain| to |x509_chain| in |SSL_SESSION|. It also renames |x509| to |x509_leaf| and |chain| to |x509_chain| in |CERT|. (All with an eye to maybe making them lazily initialised in the future). This a) catches anyone who might be accessing these members directly and b) makes space for |CRYPTO_BUFFER|-based values to take the unprefixed names. Change-Id: I10573304fb7d6f1ea03f9e645f7fc0acdaf71ac2 Reviewed-on: https://boringssl-review.googlesource.com/12162 Reviewed-by: David Benjamin <davidben@google.com>
2016-11-07 20:02:35 +00:00
c->x509_leaf = x;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 1;
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, size_t der_len,
const uint8_t *der) {
if (der_len > LONG_MAX) {
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return 0;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
const uint8_t *p = der;
X509 *x509 = d2i_X509(NULL, &p, (long)der_len);
if (x509 == NULL || p != der + der_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
X509_free(x509);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int ret = SSL_CTX_use_certificate(ctx, x509);
X509_free(x509);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return ret;
}
int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) {
int ret;
EVP_PKEY *pkey;
if (rsa == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
pkey = EVP_PKEY_new();
if (pkey == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_EVP_LIB);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
RSA_up_ref(rsa);
EVP_PKEY_assign_RSA(pkey, rsa);
ret = ssl_set_pkey(ctx->cert, pkey);
EVP_PKEY_free(pkey);
return ret;
}
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
2015-06-27 19:56:25 +01:00
int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const uint8_t *der,
size_t der_len) {
RSA *rsa = RSA_private_key_from_bytes(der, der_len);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
if (rsa == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
Parse RSAPrivateKey with CBS. This removes the version field from RSA and instead handles versioning as part of parsing. (As a bonus, we now correctly limit multi-prime RSA to version 1 keys.) Most consumers are also converted. old_rsa_priv_{de,en}code are left alone for now. Those hooks are passed in parameters which match the old d2i/i2d pattern (they're only used in d2i_PrivateKey and i2d_PrivateKey). Include a test which, among other things, checks that public keys being serialized as private keys are handled properly. BUG=499653 Change-Id: Icdd5f0382c4a84f9c8867024f29756e1a306ba08 Reviewed-on: https://boringssl-review.googlesource.com/5273 Reviewed-by: Adam Langley <agl@google.com>
2015-06-27 19:56:25 +01:00
int ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
RSA_free(rsa);
return ret;
}
int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) {
if (pkey == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
return ssl_set_pkey(ctx->cert, pkey);
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const uint8_t *der,
size_t der_len) {
if (der_len > LONG_MAX) {
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return 0;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
const uint8_t *p = der;
EVP_PKEY *pkey = d2i_PrivateKey(type, NULL, &p, (long)der_len);
if (pkey == NULL || p != der + der_len) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
EVP_PKEY_free(pkey);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return 0;
}
size_t SSL*_use_*_ASN1. So long as we're not getting rid of them (the certificate variants may be useful when we decouple from crypto/x509 anyway), get the types and bounds checks right. Also reject trailing data and require the input be a single element. Note: this is a slight compatibility risk, but we did it for SSL*_use_RSAPrivateKey_ASN1 previously and I think it's probably worth seeing if anything breaks here. Change-Id: I64fa3fc6249021ccf59584d68e56ff424a190082 Reviewed-on: https://boringssl-review.googlesource.com/6490 Reviewed-by: Adam Langley <agl@google.com>
2015-11-12 17:25:30 +00:00
int ret = SSL_CTX_use_PrivateKey(ctx, pkey);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
EVP_PKEY_free(pkey);
return ret;
}
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
void SSL_set_private_key_method(SSL *ssl,
const SSL_PRIVATE_KEY_METHOD *key_method) {
ssl->cert->key_method = key_method;
Add |SSL_CTX_set_private_key_method| to parallel |SSL_set_private_key_method| This change adds a |SSL_CTX_set_private_key_method| method that sets key_method on a SSL_CTX's cert. It allows the private key method to be set once and inherited. A copy of key_method (from SSL_CTX's cert to SSL's cert) is added in |ssl_cert_dup|. Change-Id: Icb62e9055e689cfe2d5caa3a638797120634b63f Reviewed-on: https://boringssl-review.googlesource.com/7340 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-06 09:38:38 +00:00
}
void SSL_CTX_set_private_key_method(SSL_CTX *ctx,
const SSL_PRIVATE_KEY_METHOD *key_method) {
ctx->cert->key_method = key_method;
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
static int set_signing_algorithm_prefs(CERT *cert, const uint16_t *prefs,
size_t num_prefs) {
Fix memory leak in set_signing_algorithm_prefs. If SSL_CTX_set_signing_algorithm_prefs or SSL_set_signing_algorithm_prefs are called multiple times for the same cert, the previous cert->sigalgs will leak. Free the existing sigalgs before setting a new one. Change-Id: I73cdb366a8f47d8cc0baae986fd0aa80b60300e2 Reviewed-on: https://boringssl-review.googlesource.com/11640 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-10-18 14:31:02 +01:00
OPENSSL_free(cert->sigalgs);
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
cert->num_sigalgs = 0;
cert->sigalgs = BUF_memdup(prefs, num_prefs * sizeof(prefs[0]));
if (cert->sigalgs == NULL) {
Add SSL_set_signing_algorithm_prefs. This gives us a sigalg-based API for configuring signing algorithms. Change-Id: Ib746a56ebd1061eadd2620cdb140d5171b59bc02 Reviewed-on: https://boringssl-review.googlesource.com/8784 Reviewed-by: Adam Langley <agl@google.com>
2016-07-14 17:51:01 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
return 0;
}
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
cert->num_sigalgs = num_prefs;
Add SSL_set_signing_algorithm_prefs. This gives us a sigalg-based API for configuring signing algorithms. Change-Id: Ib746a56ebd1061eadd2620cdb140d5171b59bc02 Reviewed-on: https://boringssl-review.googlesource.com/8784 Reviewed-by: Adam Langley <agl@google.com>
2016-07-14 17:51:01 +01:00
return 1;
}
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
int SSL_CTX_set_signing_algorithm_prefs(SSL_CTX *ctx, const uint16_t *prefs,
size_t num_prefs) {
return set_signing_algorithm_prefs(ctx->cert, prefs, num_prefs);
}
int SSL_set_signing_algorithm_prefs(SSL *ssl, const uint16_t *prefs,
size_t num_prefs) {
return set_signing_algorithm_prefs(ssl->cert, prefs, num_prefs);
}
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
OPENSSL_COMPILE_ASSERT(sizeof(int) >= 2 * sizeof(uint16_t),
digest_list_conversion_cannot_overflow);
Adding more options for signing digest fallback. Allow configuring digest preferences for the private key. Some smartcards have limited support for signing digests, notably Windows CAPI keys and old Estonian smartcards. Chromium used the supports_digest hook in SSL_PRIVATE_KEY_METHOD to limit such keys to SHA1. However, detecting those keys was a heuristic, so some SHA256-capable keys authenticating to SHA256-only servers regressed in the switch to BoringSSL. Replace this mechanism with an API to configure digest preference order. This way heuristically-detected SHA1-only keys may be configured by Chromium as SHA1-preferring rather than SHA1-requiring. In doing so, clean up the shared_sigalgs machinery somewhat. BUG=468076 Change-Id: I996a2df213ae4d8b4062f0ab85b15262ca26f3c6 Reviewed-on: https://boringssl-review.googlesource.com/5755 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 17:41:04 +01:00
int SSL_set_private_key_digest_prefs(SSL *ssl, const int *digest_nids,
size_t num_digests) {
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
OPENSSL_free(ssl->cert->sigalgs);
Adding more options for signing digest fallback. Allow configuring digest preferences for the private key. Some smartcards have limited support for signing digests, notably Windows CAPI keys and old Estonian smartcards. Chromium used the supports_digest hook in SSL_PRIVATE_KEY_METHOD to limit such keys to SHA1. However, detecting those keys was a heuristic, so some SHA256-capable keys authenticating to SHA256-only servers regressed in the switch to BoringSSL. Replace this mechanism with an API to configure digest preference order. This way heuristically-detected SHA1-only keys may be configured by Chromium as SHA1-preferring rather than SHA1-requiring. In doing so, clean up the shared_sigalgs machinery somewhat. BUG=468076 Change-Id: I996a2df213ae4d8b4062f0ab85b15262ca26f3c6 Reviewed-on: https://boringssl-review.googlesource.com/5755 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 17:41:04 +01:00
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->num_sigalgs = 0;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
ssl->cert->sigalgs = OPENSSL_malloc(sizeof(uint16_t) * 2 * num_digests);
if (ssl->cert->sigalgs == NULL) {
Adding more options for signing digest fallback. Allow configuring digest preferences for the private key. Some smartcards have limited support for signing digests, notably Windows CAPI keys and old Estonian smartcards. Chromium used the supports_digest hook in SSL_PRIVATE_KEY_METHOD to limit such keys to SHA1. However, detecting those keys was a heuristic, so some SHA256-capable keys authenticating to SHA256-only servers regressed in the switch to BoringSSL. Replace this mechanism with an API to configure digest preference order. This way heuristically-detected SHA1-only keys may be configured by Chromium as SHA1-preferring rather than SHA1-requiring. In doing so, clean up the shared_sigalgs machinery somewhat. BUG=468076 Change-Id: I996a2df213ae4d8b4062f0ab85b15262ca26f3c6 Reviewed-on: https://boringssl-review.googlesource.com/5755 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 17:41:04 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
return 0;
}
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
/* Convert the digest list to a signature algorithms list.
*
* TODO(davidben): Replace this API with one that can express RSA-PSS, etc. */
for (size_t i = 0; i < num_digests; i++) {
switch (digest_nids[i]) {
case NID_sha1:
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA1;
ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] = SSL_SIGN_ECDSA_SHA1;
ssl->cert->num_sigalgs += 2;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
break;
case NID_sha256:
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA256;
ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] =
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
SSL_SIGN_ECDSA_SECP256R1_SHA256;
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->num_sigalgs += 2;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
break;
case NID_sha384:
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA384;
ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] =
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
SSL_SIGN_ECDSA_SECP384R1_SHA384;
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->num_sigalgs += 2;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
break;
case NID_sha512:
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->sigalgs[ssl->cert->num_sigalgs] = SSL_SIGN_RSA_PKCS1_SHA512;
ssl->cert->sigalgs[ssl->cert->num_sigalgs + 1] =
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
SSL_SIGN_ECDSA_SECP521R1_SHA512;
Fix a number of sigalg scope issues. peer_sigalgs should live on SSL_HANDSHAKE. This both releases a little bit of memory after the handshake is over and also avoids the bug where the sigalgs get dropped if SSL_set_SSL_CTX is called at a bad time. See also upstream's 14e14bf6964965d02ce89805d9de867f000095aa. This only affects consumers using the old SNI callback and not select_certificate_cb. Add a test that the SNI callback works as expected. In doing so, add an SSL_CTX version of the signing preferences API. This is a property of the cert/key pair (really just the key) and should be tied to that. This makes it a bit easier to have the regression test work with TLS 1.2 too. I thought we'd fixed this already, but apparently not... :-/ BUG=95 Change-Id: I75b02fad4059e6aa46c3b05183a07d72880711b3 Reviewed-on: https://boringssl-review.googlesource.com/10445 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-17 20:29:46 +01:00
ssl->cert->num_sigalgs += 2;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
break;
}
}
Adding more options for signing digest fallback. Allow configuring digest preferences for the private key. Some smartcards have limited support for signing digests, notably Windows CAPI keys and old Estonian smartcards. Chromium used the supports_digest hook in SSL_PRIVATE_KEY_METHOD to limit such keys to SHA1. However, detecting those keys was a heuristic, so some SHA256-capable keys authenticating to SHA256-only servers regressed in the switch to BoringSSL. Replace this mechanism with an API to configure digest preference order. This way heuristically-detected SHA1-only keys may be configured by Chromium as SHA1-preferring rather than SHA1-requiring. In doing so, clean up the shared_sigalgs machinery somewhat. BUG=468076 Change-Id: I996a2df213ae4d8b4062f0ab85b15262ca26f3c6 Reviewed-on: https://boringssl-review.googlesource.com/5755 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 17:41:04 +01:00
return 1;
}
Tidy up a few certificate-related utility functions. These will all want to be shared with the TLS 1.3 handshake. Change-Id: I4e50dc0ed2295d43c7ae800015d71c1406311801 Reviewed-on: https://boringssl-review.googlesource.com/8776 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-14 03:03:11 +01:00
int ssl_has_private_key(const SSL *ssl) {
Add server-side support for asynchronous signing. The RSA key exchange needs decryption and is still unsupported. Change-Id: I8c13b74e25a5424356afbe6e97b5f700a56de41f Reviewed-on: https://boringssl-review.googlesource.com/5467 Reviewed-by: Adam Langley <agl@google.com>
2015-07-24 17:31:31 +01:00
return ssl->cert->privatekey != NULL || ssl->cert->key_method != NULL;
}
Widen SSL_PRIVATE_KEY_METHOD types to include the curve name. This makes custom private keys and EVP_PKEYs symmetric again. There is no longer a requirement that the caller pre-filter the configured signing prefs. Also switch EVP_PKEY_RSA to NID_rsaEncryption. These are identical, but if some key types are to be NIDs, we should make them all NIDs. Change-Id: I82ea41c27a3c57f4c4401ffe1ccad406783e4c64 Reviewed-on: https://boringssl-review.googlesource.com/8785 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 18:47:55 +01:00
int ssl_is_ecdsa_key_type(int type) {
switch (type) {
/* TODO(davidben): Remove support for |EVP_PKEY_EC| key types. */
case EVP_PKEY_EC:
case NID_X9_62_prime256v1:
case NID_secp384r1:
case NID_secp521r1:
return 1;
default:
return 0;
}
}
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
int ssl_private_key_type(SSL *ssl) {
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
if (ssl->cert->key_method != NULL) {
return ssl->cert->key_method->type(ssl);
}
Widen SSL_PRIVATE_KEY_METHOD types to include the curve name. This makes custom private keys and EVP_PKEYs symmetric again. There is no longer a requirement that the caller pre-filter the configured signing prefs. Also switch EVP_PKEY_RSA to NID_rsaEncryption. These are identical, but if some key types are to be NIDs, we should make them all NIDs. Change-Id: I82ea41c27a3c57f4c4401ffe1ccad406783e4c64 Reviewed-on: https://boringssl-review.googlesource.com/8785 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 18:47:55 +01:00
switch (EVP_PKEY_id(ssl->cert->privatekey)) {
case EVP_PKEY_RSA:
return NID_rsaEncryption;
case EVP_PKEY_EC:
return EC_GROUP_get_curve_name(
EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(ssl->cert->privatekey)));
default:
return NID_undef;
}
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
size_t ssl_private_key_max_signature_len(SSL *ssl) {
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
if (ssl->cert->key_method != NULL) {
return ssl->cert->key_method->max_signature_len(ssl);
}
Fold away certificate slots mechanism. This allows us to remove the confusing EVP_PKEY argument to the SSL_PRIVATE_KEY_METHOD wrapper functions. It also simplifies some of the book-keeping around the CERT structure, as well as the API for configuring certificates themselves. The current one is a little odd as some functions automatically route to the slot while others affect the most recently touched slot. Others still (extra_certs) apply to all slots, making them not terribly useful. Consumers with complex needs should use cert_cb or the early callback (select_certificate_cb) to configure whatever they like based on the ClientHello. BUG=486295 Change-Id: Ice29ffeb867fa4959898b70dfc50fc00137f01f3 Reviewed-on: https://boringssl-review.googlesource.com/5351 Reviewed-by: Adam Langley <agl@google.com>
2015-07-05 16:54:09 +01:00
return EVP_PKEY_size(ssl->cert->privatekey);
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
/* TODO(davidben): Forbid RSA-PKCS1 in TLS 1.3. For now we allow it because NSS
* has yet to start doing RSA-PSS, so enforcing it would complicate interop
* testing. */
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
static int is_rsa_pkcs1(const EVP_MD **out_md, uint16_t sigalg) {
switch (sigalg) {
case SSL_SIGN_RSA_PKCS1_MD5_SHA1:
*out_md = EVP_md5_sha1();
return 1;
case SSL_SIGN_RSA_PKCS1_SHA1:
*out_md = EVP_sha1();
return 1;
case SSL_SIGN_RSA_PKCS1_SHA256:
*out_md = EVP_sha256();
return 1;
case SSL_SIGN_RSA_PKCS1_SHA384:
*out_md = EVP_sha384();
return 1;
case SSL_SIGN_RSA_PKCS1_SHA512:
*out_md = EVP_sha512();
return 1;
default:
return 0;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
}
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
static int ssl_sign_rsa_pkcs1(SSL *ssl, uint8_t *out, size_t *out_len,
size_t max_out, const EVP_MD *md,
const uint8_t *in, size_t in_len) {
EVP_MD_CTX ctx;
EVP_MD_CTX_init(&ctx);
*out_len = max_out;
int ret = EVP_DigestSignInit(&ctx, NULL, md, NULL, ssl->cert->privatekey) &&
EVP_DigestSignUpdate(&ctx, in, in_len) &&
EVP_DigestSignFinal(&ctx, out, out_len);
EVP_MD_CTX_cleanup(&ctx);
return ret;
}
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
static int ssl_verify_rsa_pkcs1(SSL *ssl, const uint8_t *signature,
size_t signature_len, const EVP_MD *md,
EVP_PKEY *pkey, const uint8_t *in,
size_t in_len) {
Move the key type check from tls12_check_peer_sigalg to ssl_verify_*. ssl_verify_* already ought to be checking this, so there's only a need to check against the configured preferences. Change-Id: I79bc771969c57f953278e622084641e6e20108e3 Reviewed-on: https://boringssl-review.googlesource.com/8698 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 00:15:32 +01:00
if (pkey->type != EVP_PKEY_RSA) {
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
EVP_MD_CTX md_ctx;
EVP_MD_CTX_init(&md_ctx);
int ret = EVP_DigestVerifyInit(&md_ctx, NULL, md, NULL, pkey) &&
EVP_DigestVerifyUpdate(&md_ctx, in, in_len) &&
EVP_DigestVerifyFinal(&md_ctx, signature, signature_len);
EVP_MD_CTX_cleanup(&md_ctx);
return ret;
}
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
static int is_ecdsa(int *out_curve, const EVP_MD **out_md, uint16_t sigalg) {
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
switch (sigalg) {
case SSL_SIGN_ECDSA_SHA1:
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
*out_curve = NID_undef;
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
*out_md = EVP_sha1();
return 1;
case SSL_SIGN_ECDSA_SECP256R1_SHA256:
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
*out_curve = NID_X9_62_prime256v1;
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
*out_md = EVP_sha256();
return 1;
case SSL_SIGN_ECDSA_SECP384R1_SHA384:
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
*out_curve = NID_secp384r1;
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
*out_md = EVP_sha384();
return 1;
case SSL_SIGN_ECDSA_SECP521R1_SHA512:
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
*out_curve = NID_secp521r1;
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
*out_md = EVP_sha512();
return 1;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
default:
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
return 0;
Don't decompose sigalgs in key preferences. Instead, in SSL_set_private_key_digest_prefs, convert the NID list to a sigalgs list. We'll need to add a new API later when custom key callers are ready to start advertising RSA-PSS. This removes all callers of tls12_get_hash except inside the signing and verifying functions. Change-Id: Ie534f3b736c6ac6ebeb0d7770d489f72e3321865 Reviewed-on: https://boringssl-review.googlesource.com/8693 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:07:02 +01:00
}
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
static int ssl_sign_ecdsa(SSL *ssl, uint8_t *out, size_t *out_len,
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
size_t max_out, int curve, const EVP_MD *md,
const uint8_t *in, size_t in_len) {
EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(ssl->cert->privatekey);
if (ec_key == NULL) {
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
/* In TLS 1.3, the curve is also specified by the signature algorithm. */
if (ssl3_protocol_version(ssl) >= TLS1_3_VERSION &&
(curve == NID_undef ||
EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) != curve)) {
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
EVP_MD_CTX ctx;
EVP_MD_CTX_init(&ctx);
*out_len = max_out;
int ret = EVP_DigestSignInit(&ctx, NULL, md, NULL, ssl->cert->privatekey) &&
EVP_DigestSignUpdate(&ctx, in, in_len) &&
EVP_DigestSignFinal(&ctx, out, out_len);
EVP_MD_CTX_cleanup(&ctx);
return ret;
}
static int ssl_verify_ecdsa(SSL *ssl, const uint8_t *signature,
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
size_t signature_len, int curve, const EVP_MD *md,
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
EVP_PKEY *pkey, const uint8_t *in, size_t in_len) {
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
if (ec_key == NULL) {
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
/* In TLS 1.3, the curve is also specified by the signature algorithm. */
if (ssl3_protocol_version(ssl) >= TLS1_3_VERSION &&
(curve == NID_undef ||
EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) != curve)) {
Move the key type check from tls12_check_peer_sigalg to ssl_verify_*. ssl_verify_* already ought to be checking this, so there's only a need to check against the configured preferences. Change-Id: I79bc771969c57f953278e622084641e6e20108e3 Reviewed-on: https://boringssl-review.googlesource.com/8698 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 00:15:32 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
EVP_MD_CTX md_ctx;
EVP_MD_CTX_init(&md_ctx);
int ret = EVP_DigestVerifyInit(&md_ctx, NULL, md, NULL, pkey) &&
EVP_DigestVerifyUpdate(&md_ctx, in, in_len) &&
EVP_DigestVerifyFinal(&md_ctx, signature, signature_len);
EVP_MD_CTX_cleanup(&md_ctx);
return ret;
}
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
static int is_rsa_pss(const EVP_MD **out_md, uint16_t sigalg) {
switch (sigalg) {
case SSL_SIGN_RSA_PSS_SHA256:
*out_md = EVP_sha256();
return 1;
case SSL_SIGN_RSA_PSS_SHA384:
*out_md = EVP_sha384();
return 1;
case SSL_SIGN_RSA_PSS_SHA512:
*out_md = EVP_sha512();
return 1;
default:
return 0;
}
}
static int ssl_sign_rsa_pss(SSL *ssl, uint8_t *out, size_t *out_len,
size_t max_out, const EVP_MD *md,
const uint8_t *in, size_t in_len) {
EVP_MD_CTX ctx;
EVP_MD_CTX_init(&ctx);
*out_len = max_out;
EVP_PKEY_CTX *pctx;
int ret =
EVP_DigestSignInit(&ctx, &pctx, md, NULL, ssl->cert->privatekey) &&
EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) &&
EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1 /* salt len = hash len */) &&
EVP_DigestSignUpdate(&ctx, in, in_len) &&
EVP_DigestSignFinal(&ctx, out, out_len);
EVP_MD_CTX_cleanup(&ctx);
return ret;
}
static int ssl_verify_rsa_pss(SSL *ssl, const uint8_t *signature,
size_t signature_len, const EVP_MD *md,
EVP_PKEY *pkey, const uint8_t *in,
size_t in_len) {
if (pkey->type != EVP_PKEY_RSA) {
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
}
EVP_MD_CTX md_ctx;
EVP_MD_CTX_init(&md_ctx);
EVP_PKEY_CTX *pctx;
int ret =
EVP_DigestVerifyInit(&md_ctx, &pctx, md, NULL, pkey) &&
EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) &&
EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1 /* salt len = hash len */) &&
EVP_DigestVerifyUpdate(&md_ctx, in, in_len) &&
EVP_DigestVerifyFinal(&md_ctx, signature, signature_len);
EVP_MD_CTX_cleanup(&md_ctx);
return ret;
}
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
enum ssl_private_key_result_t ssl_private_key_sign(
Cleaning up internal use of Signature Algorithms. The signing logic itself still depends on pre-hashed messages and will be fixed in later commits. Change-Id: I901b0d99917c311653d44efa34a044bbb9f11e57 Reviewed-on: https://boringssl-review.googlesource.com/8545 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-29 18:16:27 +01:00
SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out,
uint16_t signature_algorithm, const uint8_t *in, size_t in_len) {
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
if (ssl->cert->key_method != NULL) {
Give SSL_PRIVATE_KEY_METHOD a message-based API. This allows us to implement custom RSA-PSS-based keys, so the async TLS 1.3 tests can proceed. For now, both sign and sign_digest exist, so downstreams only need to manage a small change atomically. We'll remove sign_digest separately. In doing so, fold all the *_complete hooks into a single complete hook as no one who implemented two operations ever used different function pointers for them. While I'm here, I've bumped BORINGSSL_API_VERSION. I do not believe we have any SSL_PRIVATE_KEY_METHOD versions who cannot update atomically, but save a round-trip in case we do. It's free. Change-Id: I7f031aabfb3343805deee429b9e244aed5d76aed Reviewed-on: https://boringssl-review.googlesource.com/8786 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-14 19:52:41 +01:00
if (ssl->cert->key_method->sign != NULL) {
return ssl->cert->key_method->sign(ssl, out, out_len, max_out,
signature_algorithm, in, in_len);
}
/* TODO(davidben): Remove support for |sign_digest|-only
* |SSL_PRIVATE_KEY_METHOD|s. */
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
const EVP_MD *md;
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
int curve;
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
if (!is_rsa_pkcs1(&md, signature_algorithm) &&
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
!is_ecdsa(&curve, &md, signature_algorithm)) {
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL_FOR_CUSTOM_KEY);
return ssl_private_key_failure;
}
Move the Digest/Sign split for SignatureAlgorithms to a lower level. In order to delay the digest of the handshake transcript and unify around message-based signing callbacks, a copy of the transcript is kept around until we are sure there is no certificate authentication. This removes support for SSL_PRIVATE_KEY_METHOD as a client in SSL 3.0. Change-Id: If8999a19ca021b4ff439319ab91e2cd2103caa64 Reviewed-on: https://boringssl-review.googlesource.com/8561 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-30 18:27:23 +01:00
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
uint8_t hash[EVP_MAX_MD_SIZE];
unsigned hash_len;
if (!EVP_Digest(in, in_len, hash, &hash_len, md, NULL)) {
return ssl_private_key_failure;
}
Move the Digest/Sign split for SignatureAlgorithms to a lower level. In order to delay the digest of the handshake transcript and unify around message-based signing callbacks, a copy of the transcript is kept around until we are sure there is no certificate authentication. This removes support for SSL_PRIVATE_KEY_METHOD as a client in SSL 3.0. Change-Id: If8999a19ca021b4ff439319ab91e2cd2103caa64 Reviewed-on: https://boringssl-review.googlesource.com/8561 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-30 18:27:23 +01:00
Give SSL_PRIVATE_KEY_METHOD a message-based API. This allows us to implement custom RSA-PSS-based keys, so the async TLS 1.3 tests can proceed. For now, both sign and sign_digest exist, so downstreams only need to manage a small change atomically. We'll remove sign_digest separately. In doing so, fold all the *_complete hooks into a single complete hook as no one who implemented two operations ever used different function pointers for them. While I'm here, I've bumped BORINGSSL_API_VERSION. I do not believe we have any SSL_PRIVATE_KEY_METHOD versions who cannot update atomically, but save a round-trip in case we do. It's free. Change-Id: I7f031aabfb3343805deee429b9e244aed5d76aed Reviewed-on: https://boringssl-review.googlesource.com/8786 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-14 19:52:41 +01:00
return ssl->cert->key_method->sign_digest(ssl, out, out_len, max_out, md,
hash, hash_len);
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
const EVP_MD *md;
Forbid PKCS1 in TLS 1.3. BUG=84 Change-Id: Ie5eaefddd161488996033de28c0ebd1064bb793d Reviewed-on: https://boringssl-review.googlesource.com/10484 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-08-18 19:03:49 +01:00
if (is_rsa_pkcs1(&md, signature_algorithm) &&
ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
return ssl_sign_rsa_pkcs1(ssl, out, out_len, max_out, md, in, in_len)
? ssl_private_key_success
: ssl_private_key_failure;
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
int curve;
if (is_ecdsa(&curve, &md, signature_algorithm)) {
return ssl_sign_ecdsa(ssl, out, out_len, max_out, curve, md, in, in_len)
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
? ssl_private_key_success
: ssl_private_key_failure;
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
RSA-PSS should work in TLS 1.2. However, for now, we will only enable it if TLS 1.3 is offered. BUG=85 Change-Id: I958ae0adeafee553dbffb966a6fa41f8a81cef96 Reviewed-on: https://boringssl-review.googlesource.com/10342 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-14 02:08:56 +01:00
if (is_rsa_pss(&md, signature_algorithm)) {
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
return ssl_sign_rsa_pss(ssl, out, out_len, max_out, md, in, in_len)
? ssl_private_key_success
: ssl_private_key_failure;
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return ssl_private_key_failure;
Implement asynchronous private key operations for client auth. This adds a new API, SSL_set_private_key_method, which allows the consumer to customize private key operations. For simplicity, it is incompatible with the multiple slots feature (which will hopefully go away) but does not, for now, break it. The new method is only routed up for the client for now. The server will require a decrypt hook as well for the plain RSA key exchange. BUG=347404 Change-Id: I35d69095c29134c34c2af88c613ad557d6957614 Reviewed-on: https://boringssl-review.googlesource.com/5049 Reviewed-by: Adam Langley <agl@google.com>
2015-05-29 22:11:21 +01:00
}
Move the Digest/Sign split for SignatureAlgorithms to a lower level. In order to delay the digest of the handshake transcript and unify around message-based signing callbacks, a copy of the transcript is kept around until we are sure there is no certificate authentication. This removes support for SSL_PRIVATE_KEY_METHOD as a client in SSL 3.0. Change-Id: If8999a19ca021b4ff439319ab91e2cd2103caa64 Reviewed-on: https://boringssl-review.googlesource.com/8561 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-30 18:27:23 +01:00
int ssl_public_key_verify(SSL *ssl, const uint8_t *signature,
size_t signature_len, uint16_t signature_algorithm,
EVP_PKEY *pkey, const uint8_t *in, size_t in_len) {
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
const EVP_MD *md;
Forbid PKCS1 in TLS 1.3. BUG=84 Change-Id: Ie5eaefddd161488996033de28c0ebd1064bb793d Reviewed-on: https://boringssl-review.googlesource.com/10484 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-08-18 19:03:49 +01:00
if (is_rsa_pkcs1(&md, signature_algorithm) &&
ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
return ssl_verify_rsa_pkcs1(ssl, signature, signature_len, md, pkey, in,
in_len);
}
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
int curve;
if (is_ecdsa(&curve, &md, signature_algorithm)) {
return ssl_verify_ecdsa(ssl, signature, signature_len, curve, md, pkey, in,
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
in_len);
Move the Digest/Sign split for SignatureAlgorithms to a lower level. In order to delay the digest of the handshake transcript and unify around message-based signing callbacks, a copy of the transcript is kept around until we are sure there is no certificate authentication. This removes support for SSL_PRIVATE_KEY_METHOD as a client in SSL 3.0. Change-Id: If8999a19ca021b4ff439319ab91e2cd2103caa64 Reviewed-on: https://boringssl-review.googlesource.com/8561 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-30 18:27:23 +01:00
}
RSA-PSS should work in TLS 1.2. However, for now, we will only enable it if TLS 1.3 is offered. BUG=85 Change-Id: I958ae0adeafee553dbffb966a6fa41f8a81cef96 Reviewed-on: https://boringssl-review.googlesource.com/10342 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-14 02:08:56 +01:00
if (is_rsa_pss(&md, signature_algorithm)) {
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
return ssl_verify_rsa_pss(ssl, signature, signature_len, md, pkey, in,
in_len);
}
Don't decompose signature algorithms in ssl_rsa.c. This is a lot more verbose and looks the same between RSA and ECDSA for now, but it gives us room to implement the various algorithm-specific checks. ECDSA algorithms must match the curve, PKCS#1 is forbidden in TLS 1.3, etc. Change-Id: I348cfae664d7b08195a2ab1190820b410e74c5e9 Reviewed-on: https://boringssl-review.googlesource.com/8694 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 23:42:16 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
return 0;
Move the Digest/Sign split for SignatureAlgorithms to a lower level. In order to delay the digest of the handshake transcript and unify around message-based signing callbacks, a copy of the transcript is kept around until we are sure there is no certificate authentication. This removes support for SSL_PRIVATE_KEY_METHOD as a client in SSL 3.0. Change-Id: If8999a19ca021b4ff439319ab91e2cd2103caa64 Reviewed-on: https://boringssl-review.googlesource.com/8561 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-30 18:27:23 +01:00
}
Add server-side support for asynchronous RSA decryption. Change-Id: I6df623f3e9bc88acc52043f16b34649b7af67663 Reviewed-on: https://boringssl-review.googlesource.com/5531 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-08-07 22:07:52 +01:00
enum ssl_private_key_result_t ssl_private_key_decrypt(
SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out,
const uint8_t *in, size_t in_len) {
if (ssl->cert->key_method != NULL) {
return ssl->cert->key_method->decrypt(ssl, out, out_len, max_out, in,
in_len);
}
Add get0 getters for EVP_PKEY. Right now your options are: - Bounce on a reference and deal with cleanup needlessly. - Manually check the type tag and peek into the union. We probably have no hope of opaquifying this struct, but for new code, let's recommend using this function rather than the more error-prone thing. Change-Id: I9b39ff95fe4264a3f7d1e0d2894db337aa968f6c Reviewed-on: https://boringssl-review.googlesource.com/6551 Reviewed-by: Adam Langley <agl@google.com>
2015-11-20 22:47:25 +00:00
RSA *rsa = EVP_PKEY_get0_RSA(ssl->cert->privatekey);
if (rsa == NULL) {
Add server-side support for asynchronous RSA decryption. Change-Id: I6df623f3e9bc88acc52043f16b34649b7af67663 Reviewed-on: https://boringssl-review.googlesource.com/5531 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-08-07 22:07:52 +01:00
/* Decrypt operations are only supported for RSA keys. */
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
return ssl_private_key_failure;
}
/* Decrypt with no padding. PKCS#1 padding will be removed as part
* of the timing-sensitive code by the caller. */
Add get0 getters for EVP_PKEY. Right now your options are: - Bounce on a reference and deal with cleanup needlessly. - Manually check the type tag and peek into the union. We probably have no hope of opaquifying this struct, but for new code, let's recommend using this function rather than the more error-prone thing. Change-Id: I9b39ff95fe4264a3f7d1e0d2894db337aa968f6c Reviewed-on: https://boringssl-review.googlesource.com/6551 Reviewed-by: Adam Langley <agl@google.com>
2015-11-20 22:47:25 +00:00
if (!RSA_decrypt(rsa, out_len, out, max_out, in, in_len, RSA_NO_PADDING)) {
return ssl_private_key_failure;
Add server-side support for asynchronous RSA decryption. Change-Id: I6df623f3e9bc88acc52043f16b34649b7af67663 Reviewed-on: https://boringssl-review.googlesource.com/5531 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-08-07 22:07:52 +01:00
}
Add get0 getters for EVP_PKEY. Right now your options are: - Bounce on a reference and deal with cleanup needlessly. - Manually check the type tag and peek into the union. We probably have no hope of opaquifying this struct, but for new code, let's recommend using this function rather than the more error-prone thing. Change-Id: I9b39ff95fe4264a3f7d1e0d2894db337aa968f6c Reviewed-on: https://boringssl-review.googlesource.com/6551 Reviewed-by: Adam Langley <agl@google.com>
2015-11-20 22:47:25 +00:00
return ssl_private_key_success;
Add server-side support for asynchronous RSA decryption. Change-Id: I6df623f3e9bc88acc52043f16b34649b7af67663 Reviewed-on: https://boringssl-review.googlesource.com/5531 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-08-07 22:07:52 +01:00
}
Give SSL_PRIVATE_KEY_METHOD a message-based API. This allows us to implement custom RSA-PSS-based keys, so the async TLS 1.3 tests can proceed. For now, both sign and sign_digest exist, so downstreams only need to manage a small change atomically. We'll remove sign_digest separately. In doing so, fold all the *_complete hooks into a single complete hook as no one who implemented two operations ever used different function pointers for them. While I'm here, I've bumped BORINGSSL_API_VERSION. I do not believe we have any SSL_PRIVATE_KEY_METHOD versions who cannot update atomically, but save a round-trip in case we do. It's free. Change-Id: I7f031aabfb3343805deee429b9e244aed5d76aed Reviewed-on: https://boringssl-review.googlesource.com/8786 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-14 19:52:41 +01:00
enum ssl_private_key_result_t ssl_private_key_complete(SSL *ssl, uint8_t *out,
size_t *out_len,
size_t max_out) {
Add server-side support for asynchronous RSA decryption. Change-Id: I6df623f3e9bc88acc52043f16b34649b7af67663 Reviewed-on: https://boringssl-review.googlesource.com/5531 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-08-07 22:07:52 +01:00
/* Only custom keys may be asynchronous. */
Give SSL_PRIVATE_KEY_METHOD a message-based API. This allows us to implement custom RSA-PSS-based keys, so the async TLS 1.3 tests can proceed. For now, both sign and sign_digest exist, so downstreams only need to manage a small change atomically. We'll remove sign_digest separately. In doing so, fold all the *_complete hooks into a single complete hook as no one who implemented two operations ever used different function pointers for them. While I'm here, I've bumped BORINGSSL_API_VERSION. I do not believe we have any SSL_PRIVATE_KEY_METHOD versions who cannot update atomically, but save a round-trip in case we do. It's free. Change-Id: I7f031aabfb3343805deee429b9e244aed5d76aed Reviewed-on: https://boringssl-review.googlesource.com/8786 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-14 19:52:41 +01:00
return ssl->cert->key_method->complete(ssl, out, out_len, max_out);
Add server-side support for asynchronous RSA decryption. Change-Id: I6df623f3e9bc88acc52043f16b34649b7af67663 Reviewed-on: https://boringssl-review.googlesource.com/5531 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-08-07 22:07:52 +01:00
}
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
int ssl_private_key_supports_signature_algorithm(SSL *ssl,
uint16_t signature_algorithm) {
const EVP_MD *md;
Forbid PKCS1 in TLS 1.3. BUG=84 Change-Id: Ie5eaefddd161488996033de28c0ebd1064bb793d Reviewed-on: https://boringssl-review.googlesource.com/10484 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-08-18 19:03:49 +01:00
if (is_rsa_pkcs1(&md, signature_algorithm) &&
ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
Widen SSL_PRIVATE_KEY_METHOD types to include the curve name. This makes custom private keys and EVP_PKEYs symmetric again. There is no longer a requirement that the caller pre-filter the configured signing prefs. Also switch EVP_PKEY_RSA to NID_rsaEncryption. These are identical, but if some key types are to be NIDs, we should make them all NIDs. Change-Id: I82ea41c27a3c57f4c4401ffe1ccad406783e4c64 Reviewed-on: https://boringssl-review.googlesource.com/8785 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 18:47:55 +01:00
return ssl_private_key_type(ssl) == NID_rsaEncryption;
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
}
int curve;
if (is_ecdsa(&curve, &md, signature_algorithm)) {
Widen SSL_PRIVATE_KEY_METHOD types to include the curve name. This makes custom private keys and EVP_PKEYs symmetric again. There is no longer a requirement that the caller pre-filter the configured signing prefs. Also switch EVP_PKEY_RSA to NID_rsaEncryption. These are identical, but if some key types are to be NIDs, we should make them all NIDs. Change-Id: I82ea41c27a3c57f4c4401ffe1ccad406783e4c64 Reviewed-on: https://boringssl-review.googlesource.com/8785 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 18:47:55 +01:00
int type = ssl_private_key_type(ssl);
if (!ssl_is_ecdsa_key_type(type)) {
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
return 0;
}
Widen SSL_PRIVATE_KEY_METHOD types to include the curve name. This makes custom private keys and EVP_PKEYs symmetric again. There is no longer a requirement that the caller pre-filter the configured signing prefs. Also switch EVP_PKEY_RSA to NID_rsaEncryption. These are identical, but if some key types are to be NIDs, we should make them all NIDs. Change-Id: I82ea41c27a3c57f4c4401ffe1ccad406783e4c64 Reviewed-on: https://boringssl-review.googlesource.com/8785 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 18:47:55 +01:00
/* Prior to TLS 1.3, ECDSA curves did not match the signature algorithm. */
if (ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
return 1;
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
}
Widen SSL_PRIVATE_KEY_METHOD types to include the curve name. This makes custom private keys and EVP_PKEYs symmetric again. There is no longer a requirement that the caller pre-filter the configured signing prefs. Also switch EVP_PKEY_RSA to NID_rsaEncryption. These are identical, but if some key types are to be NIDs, we should make them all NIDs. Change-Id: I82ea41c27a3c57f4c4401ffe1ccad406783e4c64 Reviewed-on: https://boringssl-review.googlesource.com/8785 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-14 18:47:55 +01:00
Require custom private keys to specify curve in 1.3. If someone is still using EVP_PKEY_EC (I really should get on converting Chromium...), don't silently skip the curve match check in TLS 1.3, otherwise it may work on accident. Refuse to sign anything so this gets caught. Change-Id: I4ea46efb0b8f31a656771b9d2e5f882bba64eb99 Reviewed-on: https://boringssl-review.googlesource.com/11244 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-09-23 19:49:42 +01:00
return curve != NID_undef && type == curve;
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
}
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
if (is_rsa_pss(&md, signature_algorithm)) {
RSA-PSS should work in TLS 1.2. However, for now, we will only enable it if TLS 1.3 is offered. BUG=85 Change-Id: I958ae0adeafee553dbffb966a6fa41f8a81cef96 Reviewed-on: https://boringssl-review.googlesource.com/10342 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-14 02:08:56 +01:00
if (ssl_private_key_type(ssl) != NID_rsaEncryption) {
Account for key size when selecting RSA-PSS. RSASSA-PSS with SHA-512 is slightly too large for 1024-bit RSA. One should not be using 1024-bit RSA, but it's common enough for tests (including our own in runner before they were regenerated), that we should probably do the size check and avoid unnecessary turbulence to everyone else's test setups. Change-Id: If0c7e401d7d05404755cba4cbff76de3bc65c138 Reviewed-on: https://boringssl-review.googlesource.com/8746 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-13 03:27:01 +01:00
return 0;
}
/* Ensure the RSA key is large enough for the hash. RSASSA-PSS requires that
* emLen be at least hLen + sLen + 2. Both hLen and sLen are the size of the
* hash in TLS. Reasonable RSA key sizes are large enough for the largest
* defined RSASSA-PSS algorithm, but 1024-bit RSA is slightly too large for
* SHA-512. 1024-bit RSA is sometimes used for test credentials, so check
* the size to fall back to another algorithm. */
if (ssl_private_key_max_signature_len(ssl) < 2 * EVP_MD_size(md) + 2) {
return 0;
}
Give SSL_PRIVATE_KEY_METHOD a message-based API. This allows us to implement custom RSA-PSS-based keys, so the async TLS 1.3 tests can proceed. For now, both sign and sign_digest exist, so downstreams only need to manage a small change atomically. We'll remove sign_digest separately. In doing so, fold all the *_complete hooks into a single complete hook as no one who implemented two operations ever used different function pointers for them. While I'm here, I've bumped BORINGSSL_API_VERSION. I do not believe we have any SSL_PRIVATE_KEY_METHOD versions who cannot update atomically, but save a round-trip in case we do. It's free. Change-Id: I7f031aabfb3343805deee429b9e244aed5d76aed Reviewed-on: https://boringssl-review.googlesource.com/8786 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-14 19:52:41 +01:00
/* RSA-PSS is only supported by message-based private keys. */
if (ssl->cert->key_method != NULL && ssl->cert->key_method->sign == NULL) {
return 0;
}
Account for key size when selecting RSA-PSS. RSASSA-PSS with SHA-512 is slightly too large for 1024-bit RSA. One should not be using 1024-bit RSA, but it's common enough for tests (including our own in runner before they were regenerated), that we should probably do the size check and avoid unnecessary turbulence to everyone else's test setups. Change-Id: If0c7e401d7d05404755cba4cbff76de3bc65c138 Reviewed-on: https://boringssl-review.googlesource.com/8746 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-13 03:27:01 +01:00
return 1;
Adding RSA-PSS signature algorithms. [Rebased and tests added by davidben.] In doing so, regenerate the test RSA certificate to be 2048-bit RSA. RSA-PSS with SHA-512 is actually too large for 1024-bit RSA. Also make the sigalg test loop test versions that do and don't work which subsumes the ecdsa_sha1 TLS 1.3 test. For now, RSA-PKCS1 is still allowed because NSS has yet to implement RSA-PSS and we'd like to avoid complicated interop testing. Change-Id: I686b003ef7042ff757bdaab8d5838b7a4d6edd87 Reviewed-on: https://boringssl-review.googlesource.com/8613 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-06 19:24:47 +01:00
}
Enforce ECDSA curve matching in TLS 1.3. Implement in both C and Go. To test this, route config into all the sign.go functions so we can expose bugs to skip the check. Unfortunately, custom private keys are going to be a little weird since we can't check their curve type. We may need to muse on what to do here. Perhaps the key type bit should return an enum that includes the curve? It's weird because, going forward, hopefully all new key types have exactly one kind of signature so key type == sig alg == sig alg prefs. Change-Id: I1f487ec143512ead931e3392e8be2a3172abe3d2 Reviewed-on: https://boringssl-review.googlesource.com/8701 Reviewed-by: David Benjamin <davidben@google.com>
2016-07-09 02:52:12 +01:00
return 0;
}
Reference in New Issue Copy Permalink