-
-
Notifications
You must be signed in to change notification settings - Fork 11.2k
It is impossible to set provider added signature schemes via SSL_set1_sigalgs #29684
Copy link
Copy link
Open
Labels
branch: masterApplies to master branchApplies to master branchtriaged: featureThe issue/pr requests/adds a featureThe issue/pr requests/adds a feature
Description
It is common with newer signature schemes that the hash is undefined (this comes from the underlying standards). SSL_set1_sigalgs should be able to set these schemes even when hash is NID_undef, eg. if the list is previously read via SSL_get_shared_sigalgs.
For instance it seems that if postquantum crypto is used, SSL_get_shared_sigalgs can return something like this list (hash:sign):
0:5b2,0:5b3,0:5b1,2a0:198,2a1:198,2a2:198,0:43f,0:440,2a0:198,2a1:198,2a2:198,2a0:390,2a1:390,2a2:390,2a0:390,2a1:390,2a2:390,2a0:6,2a1:6,2a2:6,2a3:198,40:198,2a3:6,40:6
This list can not be set via SSL_set1_sigalgs.
@mattcaswell asked me to create this within #29678 discussion.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
branch: masterApplies to master branchApplies to master branchtriaged: featureThe issue/pr requests/adds a featureThe issue/pr requests/adds a feature