From 3a37ddde911fe735c73121a8a561451cc719fc91 Mon Sep 17 00:00:00 2001 From: Shane Lontis Date: Thu, 11 Mar 2021 13:36:27 +1000 Subject: Fix DSA EVP_PKEY_param_check() when defaults are used for param generation. Fixes #14480 An internal flag that is set during param gen was not being tested, so the wrong type was used to select the dsa domain param validation method. In the default provider - if no gen_type is set then by default the fips186_4 gentype will be selected when pbits >=2048 otherwise it selects fips186_2. The fips provider ignores the gen_type and always uses fips186_4. Before this change dsa used fips186_2 by default in the default provider. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/14508) --- providers/implementations/keymgmt/dsa_kmgmt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'providers/implementations/keymgmt') diff --git a/providers/implementations/keymgmt/dsa_kmgmt.c b/providers/implementations/keymgmt/dsa_kmgmt.c index e6e9a51397..f37982c278 100644 --- a/providers/implementations/keymgmt/dsa_kmgmt.c +++ b/providers/implementations/keymgmt/dsa_kmgmt.c @@ -78,7 +78,7 @@ static const DSA_GENTYPE_NAME2ID dsatype2id[]= #ifdef FIPS_MODULE { "default", DSA_PARAMGEN_TYPE_FIPS_186_4 }, #else - { "default", DSA_PARAMGEN_TYPE_FIPS_186_2 }, + { "default", DSA_PARAMGEN_TYPE_FIPS_DEFAULT }, #endif { "fips186_4", DSA_PARAMGEN_TYPE_FIPS_186_4 }, { "fips186_2", DSA_PARAMGEN_TYPE_FIPS_186_2 }, @@ -382,7 +382,7 @@ static void *dsa_gen_init(void *provctx, int selection, #ifdef FIPS_MODULE gctx->gen_type = DSA_PARAMGEN_TYPE_FIPS_186_4; #else - gctx->gen_type = DSA_PARAMGEN_TYPE_FIPS_186_2; + gctx->gen_type = DSA_PARAMGEN_TYPE_FIPS_DEFAULT; #endif gctx->gindex = -1; gctx->pcounter = -1; @@ -527,6 +527,10 @@ static void *dsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) if (dsa == NULL) return NULL; + if (gctx->gen_type == DSA_PARAMGEN_TYPE_FIPS_DEFAULT) + gctx->gen_type = (gctx->pbits >= 2048 ? DSA_PARAMGEN_TYPE_FIPS_186_4 : + DSA_PARAMGEN_TYPE_FIPS_186_2); + gctx->cb = osslcb; gctx->cbarg = cbarg; gencb = BN_GENCB_new(); -- cgit v1.2.3