Skip to content

Commit

Permalink
Do not special case export of EC keys
Browse files Browse the repository at this point in the history
All other private keys are exported in PKCS#8 format, while EC
keys use traditional format. Switch them to use PKCS#8 format as
well.

As the OpenSSL docs say:

> PEM_write_bio_PrivateKey_traditional() writes out a private key
> in the "traditional" format with a simple private key marker and
> should only be used for compatibility with legacy programs.
  • Loading branch information
nikic committed Aug 6, 2021
1 parent 5843ba5 commit f2d3e75
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 31 deletions.
4 changes: 4 additions & 0 deletions UPGRADING
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,10 @@ PHP 8.1 UPGRADE NOTES
. The mysqlnd.fetch_copy_data ini setting has been removed. However, this
should not result in user-visible behavior changes.

- OpenSSL:
. EC private keys will now be exported in PKCS#8 format rather than
traditional format, just like all other keys.

- PDO:
. PDO::ATTR_STRINGIFY_FETCHES now also stringifies values of type bool to
"0" or "1". Previously booleans were not stringified.
Expand Down
36 changes: 6 additions & 30 deletions ext/openssl/openssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -4200,21 +4200,9 @@ PHP_FUNCTION(openssl_pkey_export_to_file)
cipher = NULL;
}

switch (EVP_PKEY_base_id(key)) {
#ifdef HAVE_EVP_PKEY_EC
case EVP_PKEY_EC:
pem_write = PEM_write_bio_ECPrivateKey(
bio_out, EVP_PKEY_get0_EC_KEY(key), cipher,
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
break;
#endif
default:
pem_write = PEM_write_bio_PrivateKey(
bio_out, key, cipher,
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
break;
}

pem_write = PEM_write_bio_PrivateKey(
bio_out, key, cipher,
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
if (pem_write) {
/* Success!
* If returning the output as a string, do so now */
Expand Down Expand Up @@ -4272,21 +4260,9 @@ PHP_FUNCTION(openssl_pkey_export)
cipher = NULL;
}

switch (EVP_PKEY_base_id(key)) {
#ifdef HAVE_EVP_PKEY_EC
case EVP_PKEY_EC:
pem_write = PEM_write_bio_ECPrivateKey(
bio_out, EVP_PKEY_get0_EC_KEY(key), cipher,
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
break;
#endif
default:
pem_write = PEM_write_bio_PrivateKey(
bio_out, key, cipher,
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
break;
}

pem_write = PEM_write_bio_PrivateKey(
bio_out, key, cipher,
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
if (pem_write) {
/* Success!
* If returning the output as a string, do so now */
Expand Down
6 changes: 5 additions & 1 deletion ext/openssl/tests/openssl_pkey_export_basic.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,11 @@ var_dump($key instanceof OpenSSLAsymmetricKey);
object(OpenSSLAsymmetricKey)#%d (0) {
}
bool(true)
-----BEGIN EC PRIVATE KEY-----%a-----END EC PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgs+Sqh7IzteDBiS5K
PfTvuWuyt9YkrkuoyiW/6bag6NmhRANCAAQ+riFshYe8HnWt1avx6OuNajipU1ZW
6BgW0+D/EtDDSYeQg9ngO8qyo5M6cyh7ORtKZVUy7DP1+W+eocaZC+a6
-----END PRIVATE KEY-----
bool(true)
bool(true)
object(OpenSSLAsymmetricKey)#%d (0) {
Expand Down

0 comments on commit f2d3e75

Please sign in to comment.