19670949ca
Rather than adding a new mode to EVP_PKEY_CTX, upstream chose to tie single-shot signing to EVP_MD_CTX, adding functions which combine EVP_Digest*Update and EVP_Digest*Final. This adds a weird vestigial EVP_MD_CTX and makes the signing digest parameter non-uniform, slightly complicating things. But it means APIs like X509_sign_ctx can work without modification. Align with upstream's APIs. This required a bit of fiddling around evp_test.cc. For consistency and to avoid baking details of parameter input order, I made it eagerly read all inputs before calling SetupContext. Otherwise which attributes are present depend a lot on the shape of the API we use---notably the NO_DEFAULT_DIGEST tests for RSA switch to failing before consuming an input, which is odd. (This only matters because we have some tests which expect the operation to abort the operation early with parameter errors and match against Error. Those probably should not use FileTest to begin with, but I'll tease that apart a later time.) Upstream also named NID_Ed25519 as NID_ED25519, even though the algorithm is normally stylized as "Ed25519". Switch it to match. Change-Id: Id6c8f5715930038e754de50338924d044e908045 Reviewed-on: https://boringssl-review.googlesource.com/17044 Commit-Queue: Steven Valdez <svaldez@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
84 lines
2.5 KiB
C++
84 lines
2.5 KiB
C++
/* Copyright (c) 2017, Google Inc.
|
|
*
|
|
* Permission to use, copy, modify, and/or distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
|
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
|
|
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
|
|
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
|
|
|
|
#include <map>
|
|
#include <vector>
|
|
|
|
#include <openssl/bio.h>
|
|
#include <openssl/evp.h>
|
|
#include <openssl/pem.h>
|
|
|
|
#include "internal.h"
|
|
|
|
|
|
static const struct argument kArguments[] = {
|
|
{"-key", kRequiredArgument, "The private key, in PEM format, to sign with"},
|
|
{"-digest", kOptionalArgument, "The digest algorithm to use"},
|
|
{"", kOptionalArgument, ""},
|
|
};
|
|
|
|
bool Sign(const std::vector<std::string> &args) {
|
|
std::map<std::string, std::string> args_map;
|
|
if (!ParseKeyValueArguments(&args_map, args, kArguments)) {
|
|
PrintUsage(kArguments);
|
|
return false;
|
|
}
|
|
|
|
// Load the private key.
|
|
bssl::UniquePtr<BIO> bio(BIO_new(BIO_s_file()));
|
|
if (!bio || !BIO_read_filename(bio.get(), args_map["-key"].c_str())) {
|
|
return false;
|
|
}
|
|
bssl::UniquePtr<EVP_PKEY> key(
|
|
PEM_read_bio_PrivateKey(bio.get(), nullptr, nullptr, nullptr));
|
|
if (!key) {
|
|
return false;
|
|
}
|
|
|
|
const EVP_MD *md = nullptr;
|
|
if (args_map.count("-digest")) {
|
|
md = EVP_get_digestbyname(args_map["-digest"].c_str());
|
|
if (md == nullptr) {
|
|
fprintf(stderr, "Unknown digest algorithm: %s\n",
|
|
args_map["-digest"].c_str());
|
|
return false;
|
|
}
|
|
}
|
|
|
|
bssl::ScopedEVP_MD_CTX ctx;
|
|
if (!EVP_DigestSignInit(ctx.get(), nullptr, md, nullptr, key.get())) {
|
|
return false;
|
|
}
|
|
|
|
std::vector<uint8_t> data;
|
|
if (!ReadAll(&data, stdin)) {
|
|
fprintf(stderr, "Error reading input.\n");
|
|
return false;
|
|
}
|
|
|
|
size_t sig_len = EVP_PKEY_size(key.get());
|
|
std::unique_ptr<uint8_t[]> sig(new uint8_t[sig_len]);
|
|
if (!EVP_DigestSign(ctx.get(), sig.get(), &sig_len, data.data(),
|
|
data.size())) {
|
|
return false;
|
|
}
|
|
|
|
if (fwrite(sig.get(), 1, sig_len, stdout) != sig_len) {
|
|
fprintf(stderr, "Error writing signature.\n");
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|