diff options
author | Matt Caswell <matt@openssl.org> | 2021-02-24 16:38:28 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2021-03-08 15:11:31 +0000 |
commit | b574c6a9ac96825b4f19c5e835273bf176174af8 (patch) | |
tree | 0320f1f6cd4905072ce38567868d3fe4881c8859 /doc/internal | |
parent | ec961f866ac048a2d3dfd6adcfa95042114bef52 (diff) |
Cache legacy keys instead of downgrading them
If someone calls an EVP_PKEY_get0*() function then we create a legacy
key and cache it in the EVP_PKEY - but it doesn't become an "origin" and
it doesn't ever get updated. This will be documented as a restriction of
the EVP_PKEY_get0*() function with provided keys.
Fixes #14020
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14319)
Diffstat (limited to 'doc/internal')
-rw-r--r-- | doc/internal/man3/evp_pkey_export_to_provider.pod | 7 | ||||
-rw-r--r-- | doc/internal/man7/EVP_PKEY.pod | 35 |
2 files changed, 17 insertions, 25 deletions
diff --git a/doc/internal/man3/evp_pkey_export_to_provider.pod b/doc/internal/man3/evp_pkey_export_to_provider.pod index 6cea8a9aab..65fb7109e0 100644 --- a/doc/internal/man3/evp_pkey_export_to_provider.pod +++ b/doc/internal/man3/evp_pkey_export_to_provider.pod @@ -53,10 +53,9 @@ evp_pkey_downgrade() returns 1 on success or 0 on error. =head1 NOTES -Some functions calling evp_pkey_export_to_provider() or evp_pkey_downgrade() -may have received a const key, and may therefore have to cast the key to -non-const form to call this function. Since B<EVP_PKEY> is always dynamically -allocated, this is OK. +Some functions calling evp_pkey_export_to_provider() may have received a const +key, and may therefore have to cast the key to non-const form to call this +function. Since B<EVP_PKEY> is always dynamically allocated, this is OK. =head1 SEE ALSO diff --git a/doc/internal/man7/EVP_PKEY.pod b/doc/internal/man7/EVP_PKEY.pod index 022f3f0e4e..7088b6cc08 100644 --- a/doc/internal/man7/EVP_PKEY.pod +++ b/doc/internal/man7/EVP_PKEY.pod @@ -178,27 +178,20 @@ OSSL_FUNC_keymgmt_import() function. =back -=head2 Upgrading and downgrading a key - -An B<EVP_PKEY> with a legacy origin will I<never> be upgraded to -become an B<EVP_PKEY> with a provider native origin. Instead, we have -the operation cache as described above, that takes care of the needs -of the diverse operation the application may want to perform. - -An B<EVP_PKEY> with a provider native origin, I<may> be downgraded to -be I<transformed> into an B<EVP_PKEY> with a legacy origin. Because -an B<EVP_PKEY> can't have two origins, it means that it stops having a -provider native origin. The previous provider native key data is -moved to the operation cache. Downgrading is performed with the -internal function L<evp_pkey_downgrade(3)>. - -I<Downgrading a key is understandably fragile>, and possibly surprising, -and should therefore be done I<as little as possible>, but is needed -to be able to support functions like L<EVP_PKEY_get0_RSA(3)>. -The general recommendation is to use L<evp_pkey_copy_downgraded(3)> -whenever possible, which it should be if the need for a legacy origin -is only internal, or better yet, to remove the need for downgrade at -all. +=head2 Changing a key origin + +It is never possible to change the origin of a key. An B<EVP_PKEY> with a legacy +origin will I<never> be upgraded to become an B<EVP_PKEY> with a provider +native origin. Instead, we have the operation cache as described above, that +takes care of the needs of the diverse operation the application may want to +perform. + +Similarly an B<EVP_PKEY> with a provider native origin, will I<never> be +downgraded to be I<transformed> into an B<EVP_PKEY> with a legacy origin. +Instead we may have a cached copy of the provider key in legacy form. Once the +cached copy is created it is never updated. Changes made to the provider key +are not reflected back in the cached legacy copy. Similarly changes made to the +cached legacy copy are not reflected back in the provider key. =head1 SEE ALSO |