diff options
| author | Richard Levitte <levitte@openssl.org> | 2020-03-21 06:21:26 +0100 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2020-03-25 17:01:10 +0100 |
| commit | acb90ba8ffe6a27f625607760e82842673eb9378 (patch) | |
| tree | e2960e7bf66bf703ec58c26942462a1cbf27ed7b /include/crypto | |
| parent | 8243d8d1a17b700c9c48fc5660ff61245b1d14d2 (diff) | |
EVP: Downgrade keys rather than upgrade
Upgrading EVP_PKEYs from containing legacy keys to containing provider
side keys proved to be risky, with a number of unpleasant corner
cases, and with functions like EVP_PKEY_get0_DSA() failing
unexpectedly.
We therefore change course, and instead of upgrading legacy internal
keys to provider side internal keys, we downgrade provider side
internal keys to legacy ones. To be able to do this, we add
|import_from| and make it a callback function designed for
evp_keymgmt_export().
This means that evp_pkey_upgrade_to_provider() is replaced with
evp_pkey_downgrade().
EVP_PKEY_copy_parameters() is the most deeply affected function of
this change.
Fixes #11366
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11375)
Diffstat (limited to 'include/crypto')
| -rw-r--r-- | include/crypto/asn1.h | 5 | ||||
| -rw-r--r-- | include/crypto/evp.h | 4 |
2 files changed, 5 insertions, 4 deletions
diff --git a/include/crypto/asn1.h b/include/crypto/asn1.h index 0e7e9ba3d4..20732c2251 100644 --- a/include/crypto/asn1.h +++ b/include/crypto/asn1.h @@ -11,6 +11,8 @@ /* ASN1 public key method structure */ +#include <openssl/core.h> + struct evp_pkey_asn1_method_st { int pkey_id; int pkey_base_id; @@ -68,10 +70,11 @@ struct evp_pkey_asn1_method_st { * TODO: Make sure these functions are defined for key types that are * implemented in providers. */ - /* Exports to providers */ + /* Exports and imports to / from providers */ size_t (*dirty_cnt) (const EVP_PKEY *pk); int (*export_to) (const EVP_PKEY *pk, void *to_keydata, EVP_KEYMGMT *to_keymgmt); + OSSL_CALLBACK *import_from; } /* EVP_PKEY_ASN1_METHOD */ ; DEFINE_STACK_OF_CONST(EVP_PKEY_ASN1_METHOD) diff --git a/include/crypto/evp.h b/include/crypto/evp.h index e5f9aad010..63b6dad9c6 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h @@ -630,10 +630,8 @@ void evp_app_cleanup_int(void); void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx, EVP_KEYMGMT **keymgmt, const char *propquery); -void *evp_pkey_upgrade_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx, - EVP_KEYMGMT **keymgmt, - const char *propquery); #ifndef FIPS_MODE +int evp_pkey_downgrade(EVP_PKEY *pk); void evp_pkey_free_legacy(EVP_PKEY *x); #endif |