diff options
| author | Matt Caswell <matt@openssl.org> | 2021-02-24 16:38:28 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2021-03-08 15:11:31 +0000 |
| commit | b574c6a9ac96825b4f19c5e835273bf176174af8 (patch) | |
| tree | 0320f1f6cd4905072ce38567868d3fe4881c8859 /crypto/evp/pmeth_gn.c | |
| parent | ec961f866ac048a2d3dfd6adcfa95042114bef52 (diff) | |
Cache legacy keys instead of downgrading them
If someone calls an EVP_PKEY_get0*() function then we create a legacy
key and cache it in the EVP_PKEY - but it doesn't become an "origin" and
it doesn't ever get updated. This will be documented as a restriction of
the EVP_PKEY_get0*() function with provided keys.
Fixes #14020
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14319)
Diffstat (limited to 'crypto/evp/pmeth_gn.c')
| -rw-r--r-- | crypto/evp/pmeth_gn.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/crypto/evp/pmeth_gn.c b/crypto/evp/pmeth_gn.c index 1e4078cfa7..1953e0f958 100644 --- a/crypto/evp/pmeth_gn.c +++ b/crypto/evp/pmeth_gn.c @@ -197,7 +197,7 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey) #endif /* - * Because we still have legacy keys, and evp_pkey_downgrade() + * Because we still have legacy keys * TODO remove this #legacy internal keys are gone */ (*ppkey)->type = ctx->legacy_keytype; @@ -208,8 +208,17 @@ int EVP_PKEY_gen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey) #ifdef FIPS_MODULE goto not_supported; #else - if (ctx->pkey && !evp_pkey_downgrade(ctx->pkey)) + /* + * If we get here then we're using legacy paramgen/keygen. In that case + * the pkey in ctx (if there is one) had better not be provided (because the + * legacy methods may not know how to handle it). However we can only get + * here if ctx->op.keymgmt.genctx == NULL, but that should never be the case + * if ctx->pkey is provided because we don't allow this when we initialise + * the ctx. + */ + if (ctx->pkey != NULL && !ossl_assert(!evp_pkey_is_provided(ctx->pkey))) goto not_accessible; + switch (ctx->operation) { case EVP_PKEY_OP_PARAMGEN: ret = ctx->pmeth->paramgen(ctx, *ppkey); |