From 6a2b8ff392a304bbb106528653397b864acc53fa Mon Sep 17 00:00:00 2001 From: Richard Levitte Date: Thu, 27 May 2021 12:34:03 +0200 Subject: Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/15498) --- test/endecode_test.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'test/endecode_test.c') diff --git a/test/endecode_test.c b/test/endecode_test.c index f800d7738c..d28ea3c812 100644 --- a/test/endecode_test.c +++ b/test/endecode_test.c @@ -526,7 +526,7 @@ static int test_unprotected_via_DER(const char *type, EVP_PKEY *key) return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, - "DER", "pkcs8", NULL, NULL, + "DER", "PrivateKeyInfo", NULL, NULL, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_mem, check_unprotected_PKCS8_DER, dump_der, 0); @@ -548,7 +548,7 @@ static int test_unprotected_via_PEM(const char *type, EVP_PKEY *key) return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, - "PEM", "pkcs8", NULL, NULL, + "PEM", "PrivateKeyInfo", NULL, NULL, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_text, check_unprotected_PKCS8_PEM, dump_pem, 0); @@ -703,7 +703,8 @@ static int test_protected_via_DER(const char *type, EVP_PKEY *key) return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR | OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS, - "DER", "pkcs8", pass, pass_cipher, + "DER", "PrivateKeyInfo", + pass, pass_cipher, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_mem, check_protected_PKCS8_DER, dump_der, 0); @@ -725,7 +726,8 @@ static int test_protected_via_PEM(const char *type, EVP_PKEY *key) return test_encode_decode(__FILE__, __LINE__, type, key, OSSL_KEYMGMT_SELECT_KEYPAIR | OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS, - "PEM", "pkcs8", pass, pass_cipher, + "PEM", "PrivateKeyInfo", + pass, pass_cipher, encode_EVP_PKEY_prov, decode_EVP_PKEY_prov, test_text, check_protected_PKCS8_PEM, dump_pem, 0); -- cgit v1.2.3