diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2021-04-12 09:06:24 +1000 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2021-04-14 16:01:13 +1000 |
| commit | 46eee7104d77f9d303e06a398febdc60fd014d33 (patch) | |
| tree | d826be79497504683f836f4c6a9d7c0b6a91f3d0 /providers/common/provider_err.c | |
| parent | 0d5bbaaae2c65ddf7a30596b61617304e0950d9c (diff) | |
Add domain parameter match check for DH and ECDH key exchange.
Fixes #14808
Validation checks were moved into EVP_PKEY_derive_set_peer() which broke
an external negative test. Originally the old code was semi working by checking the peers public key was in the range of other parties p. It was not actually ever
checking that the domain parameters were consistent between the 2
parties. It now checks the parameters match as well as validating the
peers public key.
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14823)
Diffstat (limited to 'providers/common/provider_err.c')
| -rw-r--r-- | providers/common/provider_err.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/providers/common/provider_err.c b/providers/common/provider_err.c index dd1a98f935..8b5d0008f9 100644 --- a/providers/common/provider_err.c +++ b/providers/common/provider_err.c @@ -111,6 +111,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = { {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_KEY_SIZE_TOO_SMALL), "key size too small"}, {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_LENGTH_TOO_LARGE), "length too large"}, + {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISMATCHING_DOMAIN_PARAMETERS), + "mismatching shared parameters"}, {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CEK_ALG), "missing cek alg"}, {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CIPHER), "missing cipher"}, {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CONFIG_DATA), |