diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2017-01-16 16:52:52 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2017-01-18 15:04:49 +0000 |
| commit | 79ebfc46817bc5da1082bcdc5bd50905c83fa712 (patch) | |
| tree | 036babddbe82995d4f6c2b901a3a97bf7b91ae49 /crypto/rsa/rsa_pmeth.c | |
| parent | 31a51151fc163a7f5f4d07dff9478be50e4b5707 (diff) | |
Add support for -1, -2 salt lengths for PSS only keys.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2236)
Diffstat (limited to 'crypto/rsa/rsa_pmeth.c')
| -rw-r--r-- | crypto/rsa/rsa_pmeth.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/crypto/rsa/rsa_pmeth.c b/crypto/rsa/rsa_pmeth.c index d55fb21c40..c31b9a3cb8 100644 --- a/crypto/rsa/rsa_pmeth.c +++ b/crypto/rsa/rsa_pmeth.c @@ -432,9 +432,16 @@ static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) } else { if (p1 < -2) return -2; - if (rsa_pss_restricted(rctx) && p1 < rctx->min_saltlen) { - RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL); - return 0; + if (rsa_pss_restricted(rctx)) { + if (p1 == -2 && ctx->operation == EVP_PKEY_OP_VERIFY) { + RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_INVALID_PSS_SALTLEN); + return -2; + } + if ((p1 == -1 && rctx->min_saltlen > EVP_MD_size(rctx->md)) + || (p1 >= 0 && p1 < rctx->min_saltlen)) { + RSAerr(RSA_F_PKEY_RSA_CTRL, RSA_R_PSS_SALTLEN_TOO_SMALL); + return 0; + } } rctx->saltlen = p1; } @@ -752,7 +759,7 @@ static int pkey_pss_init(EVP_PKEY_CTX *ctx) RSA_PKEY_CTX *rctx = ctx->data; const EVP_MD *md; const EVP_MD *mgf1md; - int min_saltlen; + int min_saltlen, max_saltlen; /* Should never happen */ if (!pkey_ctx_is_pss(ctx)) @@ -765,6 +772,15 @@ static int pkey_pss_init(EVP_PKEY_CTX *ctx) if (!rsa_pss_get_param(rsa->pss, &md, &mgf1md, &min_saltlen)) return 0; + /* See if minumum salt length exceeds maximum possible */ + max_saltlen = RSA_size(rsa) - EVP_MD_size(md); + if ((RSA_bits(rsa) & 0x7) == 1) + max_saltlen--; + if (min_saltlen > max_saltlen) { + RSAerr(RSA_F_PKEY_PSS_INIT, RSA_R_INVALID_SALT_LENGTH); + return 0; + } + rctx->min_saltlen = min_saltlen; /* |