Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

enable CMS sign/verify for provider-implemented PKEYs #17733

Closed
wants to merge 7 commits into from
Closed

enable CMS sign/verify for provider-implemented PKEYs #17733

Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4eeb579
enable CMS sign/verify for provider-implemented PKEYs
baentsch Feb 18, 2022
72d6281
addressing PR review feedback
baentsch Feb 19, 2022
e2f1215
improving OBJ_ function use (PR feedback)
baentsch Feb 20, 2022
35cf0e7
handle signatures with and without digest algs
baentsch Feb 26, 2022
6a61720
corrections for PR feedback
baentsch Feb 28, 2022
082012b
comments updated as per PR feedback [skip ci]
baentsch Mar 1, 2022
5ad1217
Testing OBJ_find_sigid_by_algs
baentsch Mar 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
26 changes: 25 additions & 1 deletion crypto/cms/cms_sd.c
View file
Open in desktop
Expand Up @@ -227,6 +227,30 @@ int ossl_cms_SignerIdentifier_cert_cmp(CMS_SignerIdentifier *sid, X509 *cert)
return -1;
}

/* Method to map any, incl. provider-implemented PKEY types to OIDs */
static int cms_generic_sign(CMS_SignerInfo *si, int verify)
{
if (!verify) {
int hnid;
X509_ALGOR *alg1, *alg2;
EVP_PKEY *pkey = si->pkey;
const char *typename = EVP_PKEY_get0_type_name(pkey);

CMS_SignerInfo_get0_algs(si, NULL, NULL, &alg1, &alg2);
if (alg1 == NULL || alg1->algorithm == NULL)
return -1;
hnid = OBJ_obj2nid(alg1->algorithm);
if (hnid == NID_undef)
return -1;
mattcaswell marked this conversation as resolved.
Show resolved Hide resolved

/* Generic PKEY->name->NID->OID mapping check */
if (typename == NULL)
return -1;
return X509_ALGOR_set0(alg2, OBJ_nid2obj(OBJ_sn2nid(typename)), V_ASN1_UNDEF, NULL);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest replacing OBJ_nid2obj(OBJ_sn2nid(typename)) with OBJ_txt2obj(typename, 0)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in e2f1215.

}
return 1;
}

static int cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd)
{
EVP_PKEY *pkey = si->pkey;
Expand All @@ -239,7 +263,7 @@ static int cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd)

/* Something else? We'll give engines etc a chance to handle this */
mattcaswell marked this conversation as resolved.
Show resolved Hide resolved
if (pkey->ameth == NULL || pkey->ameth->pkey_ctrl == NULL)
return 1;
return cms_generic_sign(si, cmd);
i = pkey->ameth->pkey_ctrl(pkey, ASN1_PKEY_CTRL_CMS_SIGN, cmd, si);
if (i == -2) {
ERR_raise(ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE);
Expand Down