diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2017-06-16 18:55:28 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2017-06-21 14:11:01 +0100 |
| commit | b2021556e4b838f451459deab2b2eee9b40c9169 (patch) | |
| tree | b2e9c60d67da57c16e9a18368258523c15edd4d3 /ssl/t1_lib.c | |
| parent | 72ceb6a6923456d9ff036cd81014024cf54280c4 (diff) | |
Allow Ed25519 in TLS 1.2
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3585)
Diffstat (limited to 'ssl/t1_lib.c')
| -rw-r--r-- | ssl/t1_lib.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index cf11921727..0f1d95be31 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1498,6 +1498,7 @@ void ssl_set_sig_mask(uint32_t *pmask_a, SSL *s, int op) break; #endif #ifndef OPENSSL_NO_EC + case NID_ED25519: case EVP_PKEY_EC: if (!have_ecdsa && tls12_sigalg_allowed(s, op, lu)) have_ecdsa = 1; @@ -2380,11 +2381,16 @@ int tls_choose_sigalg(SSL *s, int *al) return 0; } } else if (!ssl_has_cert(s, idx)) { - if (al == NULL) - return 1; - *al = SSL_AD_INTERNAL_ERROR; - SSLerr(SSL_F_TLS_CHOOSE_SIGALG, ERR_R_INTERNAL_ERROR); - return 0; + /* Allow Ed25519 if no EC certificate */ + if (idx == SSL_PKEY_ECC && ssl_has_cert(s, SSL_PKEY_ED25519)) { + idx = SSL_PKEY_ED25519; + } else { + if (al == NULL) + return 1; + *al = SSL_AD_INTERNAL_ERROR; + SSLerr(SSL_F_TLS_CHOOSE_SIGALG, ERR_R_INTERNAL_ERROR); + return 0; + } } } else { /* Find index for client certificate */ @@ -2421,6 +2427,10 @@ int tls_choose_sigalg(SSL *s, int *al) if (lu->sig_idx == idx && (curve == -1 || lu->curve == curve)) break; + if (idx == SSL_PKEY_ECC && lu->sig == NID_ED25519) { + idx = SSL_PKEY_ED25519; + break; + } #endif if (idx == SSL_PKEY_RSA && lu->sig == EVP_PKEY_RSA_PSS) break; |