diff options
| author | Tomas Mraz <tomas@openssl.org> | 2021-04-13 17:31:08 +0200 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2021-04-19 11:36:16 +0200 |
| commit | b247113c053903ebb61a54ba5324847ba883ed70 (patch) | |
| tree | d01dfc99a0b4f52ba94b186ff1e476f1b1916e2f /crypto/rsa | |
| parent | 5ae52001e115452ca285713feb1c2feaf07902ad (diff) | |
Detect low-level engine and app method based keys
The low-level engine and app method based keys have to be treated
as foreign and must be used with old legacy pmeths.
Fixes #14632
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14859)
Diffstat (limited to 'crypto/rsa')
| -rw-r--r-- | crypto/rsa/rsa_backend.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/crypto/rsa/rsa_backend.c b/crypto/rsa/rsa_backend.c index 192b3fdbf7..4a0ad2856b 100644 --- a/crypto/rsa/rsa_backend.c +++ b/crypto/rsa/rsa_backend.c @@ -323,6 +323,15 @@ int ossl_rsa_pss_params_30_fromdata(RSA_PSS_PARAMS_30 *pss_params, return ret; } +int ossl_rsa_is_foreign(const RSA *rsa) +{ +#ifndef FIPS_MODULE + if (rsa->engine != NULL || RSA_get_method(rsa) != RSA_PKCS1_OpenSSL()) + return 1; +#endif + return 0; +} + static ossl_inline int rsa_bn_dup_check(BIGNUM **out, const BIGNUM *f) { if (f != NULL && (*out = BN_dup(f)) == NULL) @@ -335,11 +344,11 @@ RSA *ossl_rsa_dup(const RSA *rsa, int selection) RSA *dupkey = NULL; #ifndef FIPS_MODULE int pnum, i; +#endif /* Do not try to duplicate foreign RSA keys */ - if (RSA_get_method(rsa) != RSA_PKCS1_OpenSSL()) + if (ossl_rsa_is_foreign(rsa)) return NULL; -#endif if ((dupkey = ossl_rsa_new_with_ctx(rsa->libctx)) == NULL) return NULL; |