diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2020-08-11 10:15:28 +1000 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2020-08-17 23:40:20 +1000 |
| commit | 38145fba0a5f6163743f007dd6c9ba1a1e07e4f4 (patch) | |
| tree | af3b5a8ae3d4e004bc6452a1ad3cc3ae96bb2941 /providers/implementations/keymgmt | |
| parent | 6c4e2e52d87d61a6df3ddf5f67c7207387585d6c (diff) | |
Fix DSA/DH so that legacy keys can still be generated by the default provider
Fixes #12589
The 'type' parameter needed to be propagated to the ffc params during keygen,
so that the simple validation of params done during keygen can handle legacy keys for the default provider.
The fips provider ignores this change and only allows fips186-4 approved sizes.
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12623)
Diffstat (limited to 'providers/implementations/keymgmt')
| -rw-r--r-- | providers/implementations/keymgmt/dh_kmgmt.c | 2 | ||||
| -rw-r--r-- | providers/implementations/keymgmt/dsa_kmgmt.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c index 0ea6ce7784..002cdec1f9 100644 --- a/providers/implementations/keymgmt/dh_kmgmt.c +++ b/providers/implementations/keymgmt/dh_kmgmt.c @@ -653,6 +653,8 @@ static void *dh_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) goto end; if (gctx->priv_len > 0) DH_set_length(dh, (long)gctx->priv_len); + ffc_params_enable_flags(ffc, FFC_PARAM_FLAG_VALIDATE_LEGACY, + gctx->gen_type == DH_PARAMGEN_TYPE_FIPS_186_2); if (DH_generate_key(dh) <= 0) goto end; } diff --git a/providers/implementations/keymgmt/dsa_kmgmt.c b/providers/implementations/keymgmt/dsa_kmgmt.c index d9c6007650..855fa18c38 100644 --- a/providers/implementations/keymgmt/dsa_kmgmt.c +++ b/providers/implementations/keymgmt/dsa_kmgmt.c @@ -529,6 +529,8 @@ static void *dsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) gencb) <= 0) goto end; } + ffc_params_enable_flags(ffc, FFC_PARAM_FLAG_VALIDATE_LEGACY, + gctx->gen_type == DSA_PARAMGEN_TYPE_FIPS_186_2); if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) { if (ffc->p == NULL || ffc->q == NULL |