Browse Source
EVP_PKEY & DH: Make DH EVP_PKEY_CTX parameter ctrls / setters more available
EVP_PKEY_CTX_set_dh_ functions were only available when DH was enabled
('no-dsa' not configured). However, that makes it impossible to use
these functions with an engine or a provider that happens to implement
DH. This change solves that problem by shuffling these functions to
more appropriate places.
By consequence, there are a number of places where we can remove the
check of OPENSSL_NO_DH. This requires some re-arrangements of
internal tables to translate between numeric identities and names.
Partially fixes #13550
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13589)
master
Richard Levitte
1 year ago
16 changed files with 364 additions and 304 deletions
Split View
Diff Options
-
+1 -1crypto/dh/build.info
-
+19 -143crypto/dh/dh_group_params.c
-
+2 -2crypto/evp/build.info
-
+30 -16crypto/evp/dh_ctrl.c
-
+48 -0crypto/evp/dh_support.c
-
+6 -2crypto/evp/p_lib.c
-
+4 -29crypto/evp/pmeth_lib.c
-
+3 -2crypto/ffc/build.info
-
+6 -4crypto/ffc/ffc_backend.c
-
+154 -0crypto/ffc/ffc_dh.c
-
+2 -6crypto/ffc/ffc_params.c
-
+1 -0include/crypto/dh.h
-
+16 -4include/internal/ffc.h
-
+60 -58include/openssl/dh.h
-
+2 -1providers/implementations/encode_decode/encode_key2text.c
-
+10 -36providers/implementations/keymgmt/dh_kmgmt.c
+ 1
- 1
crypto/dh/build.info
View File
+ 19
- 143
crypto/dh/dh_group_params.c
View File
+ 2
- 2
crypto/evp/build.info
View File
crypto/dh/dh_ctrl.c → crypto/evp/dh_ctrl.c
View File
+ 48
- 0
crypto/evp/dh_support.c
View File
| @ -0,0 +1,48 @@ | |||
| /* | |||
| * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. | |||
| * | |||
| * Licensed under the Apache License 2.0 (the "License"). You may not use | |||
| * this file except in compliance with the License. You can obtain a copy | |||
| * in the file LICENSE in the source distribution or at | |||
| * https://www.openssl.org/source/license.html | |||
| */ | |||
| #include <string.h> /* strcmp */ | |||
| #include <openssl/dh.h> | |||
| #include "internal/nelem.h" | |||
| #include "crypto/dh.h" | |||
| typedef struct dh_name2id_st{ | |||
| const char *name; | |||
| int id; | |||
| } DH_GENTYPE_NAME2ID; | |||
| static const DH_GENTYPE_NAME2ID dhtype2id[]= | |||
| { | |||
| { "fips186_4", DH_PARAMGEN_TYPE_FIPS_186_4 }, | |||
| { "fips186_2", DH_PARAMGEN_TYPE_FIPS_186_2 }, | |||
| { "group", DH_PARAMGEN_TYPE_GROUP }, | |||
| { "generator", DH_PARAMGEN_TYPE_GENERATOR } | |||
| }; | |||
| const char *dh_gen_type_id2name(int id) | |||
| { | |||
| size_t i; | |||
| for (i = 0; i < OSSL_NELEM(dhtype2id); ++i) { | |||
| if (dhtype2id[i].id == id) | |||
| return dhtype2id[i].name; | |||
| } | |||
| return NULL; | |||
| } | |||
| int dh_gen_type_name2id(const char *name) | |||
| { | |||
| size_t i; | |||
| for (i = 0; i < OSSL_NELEM(dhtype2id); ++i) { | |||
| if (strcmp(dhtype2id[i].name, name) == 0) | |||
| return dhtype2id[i].id; | |||
| } | |||
| return -1; | |||
| } | |||
+ 6
- 2
crypto/evp/p_lib.c
View File
+ 4
- 29
crypto/evp/pmeth_lib.c
View File
+ 3
- 2
crypto/ffc/build.info
View File
| @ -1,7 +1,8 @@ | |||
| LIBS=../../libcrypto | |||
| $COMMON=ffc_params.c ffc_params_generate.c ffc_key_generate.c\ | |||
| ffc_params_validate.c ffc_key_validate.c ffc_backend.c | |||
| $COMMON=ffc_params.c ffc_params_generate.c ffc_key_generate.c \ | |||
| ffc_params_validate.c ffc_key_validate.c ffc_backend.c \ | |||
| ffc_dh.c | |||
| SOURCE[../../libcrypto]=$COMMON | |||
| SOURCE[../../providers/libfips.a]=$COMMON | |||
+ 6
- 4
crypto/ffc/ffc_backend.c
View File
+ 154
- 0
crypto/ffc/ffc_dh.c
View File
| @ -0,0 +1,154 @@ | |||
| /* | |||
| * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. | |||
| * | |||
| * Licensed under the Apache License 2.0 (the "License"). You may not use | |||
| * this file except in compliance with the License. You can obtain a copy | |||
| * in the file LICENSE in the source distribution or at | |||
| * https://www.openssl.org/source/license.html | |||
| */ | |||
| #include "internal/ffc.h" | |||
| #include "internal/nelem.h" | |||
| #include "crypto/bn_dh.h" | |||
| #include "e_os.h" /* strcasecmp */ | |||
| #ifndef OPENSSL_NO_DH | |||
| # define FFDHE(sz) { \ | |||
| SN_ffdhe##sz, NID_ffdhe##sz, \ | |||
| sz, \ | |||
| &_bignum_ffdhe##sz##_p, &_bignum_ffdhe##sz##_q, &_bignum_const_2, \ | |||
| } | |||
| # define MODP(sz) { \ | |||
| SN_modp_##sz, NID_modp_##sz, \ | |||
| sz, \ | |||
| &_bignum_modp_##sz##_p, &_bignum_modp_##sz##_q, &_bignum_const_2 \ | |||
| } | |||
| # define RFC5114(name, uid, sz, tag) { \ | |||
| name, uid, \ | |||
| sz, \ | |||
| &_bignum_dh##tag##_p, &_bignum_dh##tag##_q, &_bignum_dh##tag##_g \ | |||
| } | |||
| #else | |||
| # define FFDHE(sz) { SN_ffdhe##sz, NID_ffdhe##sz } | |||
| # define MODP(sz) { SN_modp_##sz, NID_modp_##sz } | |||
| # define RFC5114(name, uid, sz, tag) { name, uid } | |||
| #endif | |||
| struct dh_named_group_st { | |||
| const char *name; | |||
| int uid; | |||
| #ifndef OPENSSL_NO_DH | |||
| int32_t nbits; | |||
| const BIGNUM *p; | |||
| const BIGNUM *q; | |||
| const BIGNUM *g; | |||
| #endif | |||
| }; | |||
| static const DH_NAMED_GROUP dh_named_groups[] = { | |||
| FFDHE(2048), | |||
| FFDHE(3072), | |||
| FFDHE(4096), | |||
| FFDHE(6144), | |||
| FFDHE(8192), | |||
| #ifndef FIPS_MODULE | |||
| MODP(1536), | |||
| #endif | |||
| MODP(2048), | |||
| MODP(3072), | |||
| MODP(4096), | |||
| MODP(6144), | |||
| MODP(8192), | |||
| /* | |||
| * Additional dh named groups from RFC 5114 that have a different g. | |||
| * The uid can be any unique identifier. | |||
| */ | |||
| #ifndef FIPS_MODULE | |||
| RFC5114("dh_1024_160", 1, 1024, 1024_160), | |||
| RFC5114("dh_2048_224", 2, 2048, 2048_224), | |||
| RFC5114("dh_2048_256", 3, 2048, 2048_256), | |||
| #endif | |||
| }; | |||
| const DH_NAMED_GROUP *ossl_ffc_name_to_dh_named_group(const char *name) | |||
| { | |||
| size_t i; | |||
| for (i = 0; i < OSSL_NELEM(dh_named_groups); ++i) { | |||
| if (strcasecmp(dh_named_groups[i].name, name) == 0) | |||
| return &dh_named_groups[i]; | |||
| } | |||
| return NULL; | |||
| } | |||
| const DH_NAMED_GROUP *ossl_ffc_uid_to_dh_named_group(int uid) | |||
| { | |||
| size_t i; | |||
| for (i = 0; i < OSSL_NELEM(dh_named_groups); ++i) { | |||
| if (dh_named_groups[i].uid == uid) | |||
| return &dh_named_groups[i]; | |||
| } | |||
| return NULL; | |||
| } | |||
| #ifndef OPENSSL_NO_DH | |||
| const DH_NAMED_GROUP *ossl_ffc_numbers_to_dh_named_group(const BIGNUM *p, | |||
| const BIGNUM *q, | |||
| const BIGNUM *g) | |||
| { | |||
| size_t i; | |||
| for (i = 0; i < OSSL_NELEM(dh_named_groups); ++i) { | |||
| /* Keep searching until a matching p and g is found */ | |||
| if (BN_cmp(p, dh_named_groups[i].p) == 0 | |||
| && BN_cmp(g, dh_named_groups[i].g) == 0 | |||
| /* Verify q is correct if it exists */ | |||
| && (q == NULL || BN_cmp(q, dh_named_groups[i].q) == 0)) | |||
| return &dh_named_groups[i]; | |||
| } | |||
| return NULL; | |||
| } | |||
| #endif | |||
| int ossl_ffc_named_group_get_uid(const DH_NAMED_GROUP *group) | |||
| { | |||
| if (group == NULL) | |||
| return NID_undef; | |||
| return group->uid; | |||
| } | |||
| const char *ossl_ffc_named_group_get_name(const DH_NAMED_GROUP *group) | |||
| { | |||
| if (group == NULL) | |||
| return NULL; | |||
| return group->name; | |||
| } | |||
| #ifndef OPENSSL_NO_DH | |||
| const BIGNUM *ossl_ffc_named_group_get_q(const DH_NAMED_GROUP *group) | |||
| { | |||
| if (group == NULL) | |||
| return NULL; | |||
| return group->q; | |||
| } | |||
| int ossl_ffc_named_group_set_pqg(FFC_PARAMS *ffc, const DH_NAMED_GROUP *group) | |||
| { | |||
| if (ffc == NULL || group == NULL) | |||
| return 0; | |||
| ossl_ffc_params_set0_pqg(ffc, (BIGNUM *)group->p, (BIGNUM *)group->q, | |||
| (BIGNUM *)group->g); | |||
| /* flush the cached nid, The DH layer is responsible for caching */ | |||
| ffc->nid = NID_undef; | |||
| return 1; | |||
| } | |||
| #endif | |||