From 7b548d3f11adccc67123e1f6f5c118aef857a8d2 Mon Sep 17 00:00:00 2001 From: Dr Stephen Henson Date: Tue, 9 Feb 2016 14:33:51 +0000 Subject: Test for and use AES CSP for RSA if present. Some keys are attached to the full RSA CSP which doesn't support SHA2 algorithms: uses the AES CSP if present. Reviewed-by: Tim Hudson --- engines/e_capi.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) (limited to 'engines') diff --git a/engines/e_capi.c b/engines/e_capi.c index 62c4ad3c2d..8e78354b70 100644 --- a/engines/e_capi.c +++ b/engines/e_capi.c @@ -133,6 +133,10 @@ # define CALG_SHA_512 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_512) # endif +# ifndef PROV_RSA_AES +# define PROV_RSA_AES 24 +# endif + # include # include # include @@ -458,11 +462,14 @@ static DSA_METHOD capi_dsa_method = { 0 /* dsa_keygen */ }; +static int use_aes_csp = 0; + static int capi_init(ENGINE *e) { CAPI_CTX *ctx; const RSA_METHOD *ossl_rsa_meth; const DSA_METHOD *ossl_dsa_meth; + HCRYPTPROV hprov; if (capi_idx < 0) { capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0); @@ -509,6 +516,14 @@ static int capi_init(ENGINE *e) } # endif + /* See if we support AES CSP */ + + if (CryptAcquireContext(&hprov, NULL, NULL, PROV_RSA_AES, + CRYPT_VERIFYCONTEXT)) { + use_aes_csp = 1; + CryptReleaseContext(hprov, 0); + } + return 1; memerr: @@ -1454,10 +1469,15 @@ static CAPI_KEY *capi_get_key(CAPI_CTX * ctx, const TCHAR *contname, if (key == NULL) return NULL; - if (sizeof(TCHAR) == sizeof(char)) + /* If PROV_RSA_AES supported use it instead */ + if (ptype == PROV_RSA_FULL && use_aes_csp) { + provname = NULL; + ptype = PROV_RSA_AES; + CAPI_trace(ctx, "capi_get_key, contname=%s, RSA_AES_CSP\n", contname); + } else if (sizeof(TCHAR) == sizeof(char)) { CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n", contname, provname, ptype); - else if (ctx && ctx->debug_level >= CAPI_DBG_TRACE && ctx->debug_file) { + } else if (ctx && ctx->debug_level >= CAPI_DBG_TRACE && ctx->debug_file) { /* above 'if' is optimization to minimize malloc-ations */ char *_contname = wide_to_asc((WCHAR *)contname); char *_provname = wide_to_asc((WCHAR *)provname); -- cgit v1.2.3