diff options
| author | Matt Caswell <matt@openssl.org> | 2021-03-09 17:07:48 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2021-03-15 15:51:26 +0000 |
| commit | 2cf8bb46fc3e0e2aaead764d333c6e216f028ef3 (patch) | |
| tree | e769525123b367abfeb520e7ead3c2c9e1a050a6 /providers/implementations/keymgmt/rsa_kmgmt.c | |
| parent | 2db5834c43dcc2a04ccf4cf98f412d4d3474731e (diff) | |
Ensure that ECX keys pass EVP_PKEY_param_check()
RSA keys have no parameters and pass EVP_PKEY_param_check(). Previously,
ECX keys had no parammeters and failed EVP_PKEY_param_check(). We should
be consistent. It makes more sense to always pass, and therefore this
commit implements that behaviour.
Fixes #14482
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/14485)
Diffstat (limited to 'providers/implementations/keymgmt/rsa_kmgmt.c')
| -rw-r--r-- | providers/implementations/keymgmt/rsa_kmgmt.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/providers/implementations/keymgmt/rsa_kmgmt.c b/providers/implementations/keymgmt/rsa_kmgmt.c index 095c713aac..425b6c80f2 100644 --- a/providers/implementations/keymgmt/rsa_kmgmt.c +++ b/providers/implementations/keymgmt/rsa_kmgmt.c @@ -367,7 +367,18 @@ static int rsa_validate(const void *keydata, int selection, int checktype) if (!ossl_prov_is_running()) return 0; - if ((selection & RSA_POSSIBLE_SELECTIONS) != 0) + /* + * Although an RSA key has no domain parameters, validating them should + * return true. + * + * RSA_POSSIBLE_SELECTIONS already includes + * OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS. We explicitly add + * OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS here as well for completeness. In + * practice this makes little difference since EVP_PKEY_param_check() always + * checks the combination of "other" and "domain" parameters anyway. + */ + if ((selection & (RSA_POSSIBLE_SELECTIONS + | OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS)) != 0) ok = 1; /* If the whole key is selected, we do a pairwise validation */ |