diff options
| author | Tomas Mraz <tomas@openssl.org> | 2021-04-01 17:14:43 +0200 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2021-04-06 09:10:11 +0200 |
| commit | 0cfbc828e03ad69c50ae51e0c88920d90906498a (patch) | |
| tree | 1d931bc42093e7d9b119815785f7ada3330b8b6e /providers/implementations/asymciphers | |
| parent | 5ad3e6c56eb1c295a7de92de5bb2f54614d5c277 (diff) | |
Deprecate the EVP_PKEY controls for CMS and PKCS#7
Improve the ossl_rsa_check_key() to prevent non-signature
operations with PSS keys.
Do not invoke the EVP_PKEY controls for CMS and PKCS#7 anymore
as they are not needed anymore and deprecate them.
Fixes #14276
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/14760)
Diffstat (limited to 'providers/implementations/asymciphers')
| -rw-r--r-- | providers/implementations/asymciphers/rsa_enc.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c index 621239d79e..ab84d53512 100644 --- a/providers/implementations/asymciphers/rsa_enc.c +++ b/providers/implementations/asymciphers/rsa_enc.c @@ -96,10 +96,13 @@ static int rsa_init(void *vprsactx, void *vrsa, const OSSL_PARAM params[], { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; - if (!ossl_prov_is_running() - || prsactx == NULL - || vrsa == NULL - || !RSA_up_ref(vrsa)) + if (!ossl_prov_is_running() || prsactx == NULL || vrsa == NULL) + return 0; + + if (!ossl_rsa_check_key(vrsa, operation)) + return 0; + + if (!RSA_up_ref(vrsa)) return 0; RSA_free(prsactx->rsa); prsactx->rsa = vrsa; @@ -110,11 +113,8 @@ static int rsa_init(void *vprsactx, void *vrsa, const OSSL_PARAM params[], prsactx->pad_mode = RSA_PKCS1_PADDING; break; default: - ERR_raise(ERR_LIB_PROV, PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); - return 0; - } - if (!ossl_rsa_check_key(vrsa, operation == EVP_PKEY_OP_ENCRYPT)) { - ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); + /* This should not happen due to the check above */ + ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR); return 0; } return rsa_set_ctx_params(prsactx, params); |