Add RSA key validation to default provider
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10780)master
Shane Lontis
3 years ago
parent
a76ce2862b
commit
12603de634
@ -0,0 +1,158 @@
|
||||
/*
|
||||
* Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include "internal/cryptlib.h"
|
||||
#include <openssl/objects.h>
|
||||
#include <openssl/evp.h>
|
||||
#include "crypto/bn.h"
|
||||
#include "crypto/asn1.h"
|
||||
#include "crypto/evp.h"
|
||||
#include "evp_local.h"
|
||||
|
||||
int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EVP_PKEY *pkey = ctx->pkey;
|
||||
void *key;
|
||||
EVP_KEYMGMT *keymgmt;
|
||||
|
||||
if (pkey == NULL) {
|
||||
EVPerr(EVP_F_EVP_PKEY_PUBLIC_CHECK, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
keymgmt = pkey->pkeys[0].keymgmt;
|
||||
key = pkey->pkeys[0].provdata;
|
||||
|
||||
if (key != NULL && keymgmt != NULL)
|
||||
return evp_keymgmt_validate_public(keymgmt, key);
|
||||
|
||||
/* legacy */
|
||||
/* call customized public key check function first */
|
||||
if (ctx->pmeth->public_check != NULL)
|
||||
return ctx->pmeth->public_check(pkey);
|
||||
|
||||
/* use default public key check function in ameth */
|
||||
if (pkey->ameth == NULL || pkey->ameth->pkey_public_check == NULL) {
|
||||
EVPerr(EVP_F_EVP_PKEY_PUBLIC_CHECK,
|
||||
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
||||
return -2;
|
||||
}
|
||||
|
||||
return pkey->ameth->pkey_public_check(pkey);
|
||||
}
|
||||
|
||||
int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EVP_PKEY *pkey = ctx->pkey;
|
||||
void *key;
|
||||
EVP_KEYMGMT *keymgmt;
|
||||
|
||||
if (pkey == NULL) {
|
||||
EVPerr(EVP_F_EVP_PKEY_PARAM_CHECK, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
keymgmt = pkey->pkeys[0].keymgmt;
|
||||
key = pkey->pkeys[0].provdata;
|
||||
|
||||
if (key != NULL && keymgmt != NULL)
|
||||
return evp_keymgmt_validate_domparams(keymgmt, key);
|
||||
|
||||
/* call customized param check function first */
|
||||
if (ctx->pmeth->param_check != NULL)
|
||||
return ctx->pmeth->param_check(pkey);
|
||||
|
||||
/* legacy */
|
||||
/* use default param check function in ameth */
|
||||
if (pkey->ameth == NULL || pkey->ameth->pkey_param_check == NULL) {
|
||||
EVPerr(EVP_F_EVP_PKEY_PARAM_CHECK,
|
||||
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
||||
return -2;
|
||||
}
|
||||
|
||||
return pkey->ameth->pkey_param_check(pkey);
|
||||
}
|
||||
|
||||
int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EVP_PKEY *pkey = ctx->pkey;
|
||||
void *key;
|
||||
EVP_KEYMGMT *keymgmt;
|
||||
|
||||
if (pkey == NULL) {
|
||||
EVPerr(0, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
keymgmt = pkey->pkeys[0].keymgmt;
|
||||
key = pkey->pkeys[0].provdata;
|
||||
|
||||
if (key != NULL && keymgmt != NULL)
|
||||
return evp_keymgmt_validate_private(keymgmt, key);
|
||||
/* not supported for legacy keys */
|
||||
return -2;
|
||||
}
|
||||
|
||||
int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EVP_PKEY *pkey = ctx->pkey;
|
||||
void *key;
|
||||
EVP_KEYMGMT *keymgmt;
|
||||
|
||||
if (pkey == NULL) {
|
||||
EVPerr(0, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
keymgmt = pkey->pkeys[0].keymgmt;
|
||||
key = pkey->pkeys[0].provdata;
|
||||
|
||||
if (key != NULL && keymgmt != NULL)
|
||||
return evp_keymgmt_validate_pairwise(keymgmt, key);
|
||||
/* not supported for legacy keys */
|
||||
return -2;
|
||||
}
|
||||
|
||||
int EVP_PKEY_check(EVP_PKEY_CTX *ctx)
|
||||
{
|
||||
EVP_PKEY *pkey = ctx->pkey;
|
||||
void *key;
|
||||
EVP_KEYMGMT *keymgmt;
|
||||
|
||||
if (pkey == NULL) {
|
||||
EVPerr(EVP_F_EVP_PKEY_CHECK, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
keymgmt = pkey->pkeys[0].keymgmt;
|
||||
key = pkey->pkeys[0].provdata;
|
||||
|
||||
if (key != NULL && keymgmt != NULL) {
|
||||
return evp_keymgmt_validate_domparams(keymgmt, key)
|
||||
&& evp_keymgmt_validate_public(keymgmt, key)
|
||||
&& evp_keymgmt_validate_private(keymgmt, key)
|
||||
&& evp_keymgmt_validate_pairwise(keymgmt, key);
|
||||
}
|
||||
/* legacy */
|
||||
/* call customized check function first */
|
||||
if (ctx->pmeth->check != NULL)
|
||||
return ctx->pmeth->check(pkey);
|
||||
|
||||
/* use default check function in ameth */
|
||||
if (pkey->ameth == NULL || pkey->ameth->pkey_check == NULL) {
|
||||
EVPerr(EVP_F_EVP_PKEY_CHECK,
|
||||
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
|
||||
return -2;
|
||||
}
|
||||
|
||||
return pkey->ameth->pkey_check(pkey);
|
||||
}
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
EVP_PKEY_check, EVP_PKEY_param_check, EVP_PKEY_public_check,
|
||||
EVP_PKEY_private_check, EVP_PKEY_pairwise_check
|
||||
- key and parameter validation functions
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/evp.h>
|
||||
|
||||
int EVP_PKEY_check(EVP_PKEY_CTX *ctx);
|
||||
int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx);
|
||||
int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx);
|
||||
int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx);
|
||||
int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
EVP_PKEY_param_check() validates the domain parameters component of the key
|
||||
given by B<ctx>.
|
||||
|
||||
EVP_PKEY_public_check() validates the public component of the key given by B<ctx>.
|
||||
|
||||
EVP_PKEY_private_check() validates the private component of the key given by B<ctx>.
|
||||
|
||||
EVP_PKEY_pairwise_check() validates that the public and private components have
|
||||
the correct mathematical relationship to each other for the key given by B<ctx>.
|
||||
|
||||
EVP_PKEY_check() validates all components of a key given by B<ctx>.
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
Refer to SP800-56A and SP800-56B for rules relating to when these functions
|
||||
should be called during key establishment.
|
||||
It is not necessary to call these functions after locally calling an approved key
|
||||
generation method, but may be required for assurance purposes when receiving
|
||||
keys from a third party.
|
||||
|
||||
In OpenSSL an EVP_PKEY structure containing a private key also contains the
|
||||
public key components and parameters (if any). An OpenSSL private key is
|
||||
equivalent to what some libraries call a "key pair". A private key can be used
|
||||
in functions which require the use of a public key or parameters.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
All functions return 1 for success or others for failure.
|
||||
They return -2 if the operation is not supported for the specific algorithm.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<EVP_PKEY_CTX_new(3)>,
|
||||
L<EVP_PKEY_fromdata(3)>,
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
EVP_PKEY_check(), EVP_PKEY_public_check() and EVP_PKEY_param_check() were added
|
||||
in OpenSSL 1.1.1.
|
||||
|
||||
EVP_PKEY_private_check() and EVP_PKEY_pairwise_check() were added
|
||||
in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
in the file LICENSE in the source distribution or at
|
||||
L<https://www.openssl.org/source/license.html>.
|
||||
|
||||
=cut
|
||||
Loading…
Reference in New Issue