]>
Commit | Line | Data |
---|---|---|
e683582b | 1 | /* |
8020d79b | 2 | * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved. |
e683582b SL |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <stdio.h> | |
11 | #include <stdlib.h> | |
12 | #include <openssl/objects.h> | |
13 | #include <openssl/evp.h> | |
d2f53212 | 14 | #include "internal/numbers.h" /* includes SIZE_MAX */ |
e683582b | 15 | #include "internal/cryptlib.h" |
e683582b | 16 | #include "internal/provider.h" |
6c9bc258 TM |
17 | #include "internal/core.h" |
18 | #include "crypto/evp.h" | |
e683582b SL |
19 | #include "evp_local.h" |
20 | ||
21 | static EVP_SIGNATURE *evp_signature_new(OSSL_PROVIDER *prov) | |
22 | { | |
23 | EVP_SIGNATURE *signature = OPENSSL_zalloc(sizeof(EVP_SIGNATURE)); | |
24 | ||
25 | if (signature == NULL) { | |
26 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); | |
27 | return NULL; | |
28 | } | |
29 | ||
30 | signature->lock = CRYPTO_THREAD_lock_new(); | |
31 | if (signature->lock == NULL) { | |
32 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); | |
33 | OPENSSL_free(signature); | |
34 | return NULL; | |
35 | } | |
36 | signature->prov = prov; | |
37 | ossl_provider_up_ref(prov); | |
38 | signature->refcnt = 1; | |
39 | ||
40 | return signature; | |
41 | } | |
42 | ||
309a78aa RL |
43 | static void *evp_signature_from_algorithm(int name_id, |
44 | const OSSL_ALGORITHM *algodef, | |
45 | OSSL_PROVIDER *prov) | |
e683582b | 46 | { |
309a78aa | 47 | const OSSL_DISPATCH *fns = algodef->implementation; |
e683582b SL |
48 | EVP_SIGNATURE *signature = NULL; |
49 | int ctxfncnt = 0, signfncnt = 0, verifyfncnt = 0, verifyrecfncnt = 0; | |
50 | int digsignfncnt = 0, digverifyfncnt = 0; | |
51 | int gparamfncnt = 0, sparamfncnt = 0, gmdparamfncnt = 0, smdparamfncnt = 0; | |
52 | ||
53 | if ((signature = evp_signature_new(prov)) == NULL) { | |
54 | ERR_raise(ERR_LIB_EVP, ERR_R_MALLOC_FAILURE); | |
55 | goto err; | |
56 | } | |
57 | ||
58 | signature->name_id = name_id; | |
6c9bc258 TM |
59 | if ((signature->type_name = ossl_algorithm_get1_first_name(algodef)) == NULL) |
60 | goto err; | |
309a78aa | 61 | signature->description = algodef->algorithm_description; |
e683582b SL |
62 | |
63 | for (; fns->function_id != 0; fns++) { | |
64 | switch (fns->function_id) { | |
65 | case OSSL_FUNC_SIGNATURE_NEWCTX: | |
66 | if (signature->newctx != NULL) | |
67 | break; | |
363b1e5d | 68 | signature->newctx = OSSL_FUNC_signature_newctx(fns); |
e683582b SL |
69 | ctxfncnt++; |
70 | break; | |
71 | case OSSL_FUNC_SIGNATURE_SIGN_INIT: | |
72 | if (signature->sign_init != NULL) | |
73 | break; | |
363b1e5d | 74 | signature->sign_init = OSSL_FUNC_signature_sign_init(fns); |
e683582b SL |
75 | signfncnt++; |
76 | break; | |
77 | case OSSL_FUNC_SIGNATURE_SIGN: | |
78 | if (signature->sign != NULL) | |
79 | break; | |
363b1e5d | 80 | signature->sign = OSSL_FUNC_signature_sign(fns); |
e683582b SL |
81 | signfncnt++; |
82 | break; | |
83 | case OSSL_FUNC_SIGNATURE_VERIFY_INIT: | |
84 | if (signature->verify_init != NULL) | |
85 | break; | |
363b1e5d | 86 | signature->verify_init = OSSL_FUNC_signature_verify_init(fns); |
e683582b SL |
87 | verifyfncnt++; |
88 | break; | |
89 | case OSSL_FUNC_SIGNATURE_VERIFY: | |
90 | if (signature->verify != NULL) | |
91 | break; | |
363b1e5d | 92 | signature->verify = OSSL_FUNC_signature_verify(fns); |
e683582b SL |
93 | verifyfncnt++; |
94 | break; | |
95 | case OSSL_FUNC_SIGNATURE_VERIFY_RECOVER_INIT: | |
96 | if (signature->verify_recover_init != NULL) | |
97 | break; | |
98 | signature->verify_recover_init | |
363b1e5d | 99 | = OSSL_FUNC_signature_verify_recover_init(fns); |
e683582b SL |
100 | verifyrecfncnt++; |
101 | break; | |
102 | case OSSL_FUNC_SIGNATURE_VERIFY_RECOVER: | |
103 | if (signature->verify_recover != NULL) | |
104 | break; | |
105 | signature->verify_recover | |
363b1e5d | 106 | = OSSL_FUNC_signature_verify_recover(fns); |
e683582b SL |
107 | verifyrecfncnt++; |
108 | break; | |
109 | case OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT: | |
110 | if (signature->digest_sign_init != NULL) | |
111 | break; | |
112 | signature->digest_sign_init | |
363b1e5d | 113 | = OSSL_FUNC_signature_digest_sign_init(fns); |
e683582b SL |
114 | break; |
115 | case OSSL_FUNC_SIGNATURE_DIGEST_SIGN_UPDATE: | |
116 | if (signature->digest_sign_update != NULL) | |
117 | break; | |
118 | signature->digest_sign_update | |
363b1e5d | 119 | = OSSL_FUNC_signature_digest_sign_update(fns); |
e683582b SL |
120 | digsignfncnt++; |
121 | break; | |
122 | case OSSL_FUNC_SIGNATURE_DIGEST_SIGN_FINAL: | |
123 | if (signature->digest_sign_final != NULL) | |
124 | break; | |
125 | signature->digest_sign_final | |
363b1e5d | 126 | = OSSL_FUNC_signature_digest_sign_final(fns); |
e683582b SL |
127 | digsignfncnt++; |
128 | break; | |
eea1e780 MC |
129 | case OSSL_FUNC_SIGNATURE_DIGEST_SIGN: |
130 | if (signature->digest_sign != NULL) | |
131 | break; | |
132 | signature->digest_sign | |
363b1e5d | 133 | = OSSL_FUNC_signature_digest_sign(fns); |
eea1e780 | 134 | break; |
e683582b SL |
135 | case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT: |
136 | if (signature->digest_verify_init != NULL) | |
137 | break; | |
138 | signature->digest_verify_init | |
363b1e5d | 139 | = OSSL_FUNC_signature_digest_verify_init(fns); |
e683582b SL |
140 | break; |
141 | case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_UPDATE: | |
142 | if (signature->digest_verify_update != NULL) | |
143 | break; | |
144 | signature->digest_verify_update | |
363b1e5d | 145 | = OSSL_FUNC_signature_digest_verify_update(fns); |
e683582b SL |
146 | digverifyfncnt++; |
147 | break; | |
148 | case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_FINAL: | |
149 | if (signature->digest_verify_final != NULL) | |
150 | break; | |
151 | signature->digest_verify_final | |
363b1e5d | 152 | = OSSL_FUNC_signature_digest_verify_final(fns); |
e683582b SL |
153 | digverifyfncnt++; |
154 | break; | |
eea1e780 MC |
155 | case OSSL_FUNC_SIGNATURE_DIGEST_VERIFY: |
156 | if (signature->digest_verify != NULL) | |
157 | break; | |
158 | signature->digest_verify | |
363b1e5d | 159 | = OSSL_FUNC_signature_digest_verify(fns); |
eea1e780 | 160 | break; |
e683582b SL |
161 | case OSSL_FUNC_SIGNATURE_FREECTX: |
162 | if (signature->freectx != NULL) | |
163 | break; | |
363b1e5d | 164 | signature->freectx = OSSL_FUNC_signature_freectx(fns); |
e683582b SL |
165 | ctxfncnt++; |
166 | break; | |
167 | case OSSL_FUNC_SIGNATURE_DUPCTX: | |
168 | if (signature->dupctx != NULL) | |
169 | break; | |
363b1e5d | 170 | signature->dupctx = OSSL_FUNC_signature_dupctx(fns); |
e683582b SL |
171 | break; |
172 | case OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS: | |
173 | if (signature->get_ctx_params != NULL) | |
174 | break; | |
175 | signature->get_ctx_params | |
363b1e5d | 176 | = OSSL_FUNC_signature_get_ctx_params(fns); |
e683582b SL |
177 | gparamfncnt++; |
178 | break; | |
179 | case OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS: | |
180 | if (signature->gettable_ctx_params != NULL) | |
181 | break; | |
182 | signature->gettable_ctx_params | |
363b1e5d | 183 | = OSSL_FUNC_signature_gettable_ctx_params(fns); |
e683582b SL |
184 | gparamfncnt++; |
185 | break; | |
186 | case OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS: | |
187 | if (signature->set_ctx_params != NULL) | |
188 | break; | |
189 | signature->set_ctx_params | |
363b1e5d | 190 | = OSSL_FUNC_signature_set_ctx_params(fns); |
e683582b SL |
191 | sparamfncnt++; |
192 | break; | |
193 | case OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS: | |
194 | if (signature->settable_ctx_params != NULL) | |
195 | break; | |
196 | signature->settable_ctx_params | |
363b1e5d | 197 | = OSSL_FUNC_signature_settable_ctx_params(fns); |
e683582b SL |
198 | sparamfncnt++; |
199 | break; | |
200 | case OSSL_FUNC_SIGNATURE_GET_CTX_MD_PARAMS: | |
201 | if (signature->get_ctx_md_params != NULL) | |
202 | break; | |
203 | signature->get_ctx_md_params | |
363b1e5d | 204 | = OSSL_FUNC_signature_get_ctx_md_params(fns); |
e683582b SL |
205 | gmdparamfncnt++; |
206 | break; | |
207 | case OSSL_FUNC_SIGNATURE_GETTABLE_CTX_MD_PARAMS: | |
208 | if (signature->gettable_ctx_md_params != NULL) | |
209 | break; | |
210 | signature->gettable_ctx_md_params | |
363b1e5d | 211 | = OSSL_FUNC_signature_gettable_ctx_md_params(fns); |
e683582b SL |
212 | gmdparamfncnt++; |
213 | break; | |
214 | case OSSL_FUNC_SIGNATURE_SET_CTX_MD_PARAMS: | |
215 | if (signature->set_ctx_md_params != NULL) | |
216 | break; | |
217 | signature->set_ctx_md_params | |
363b1e5d | 218 | = OSSL_FUNC_signature_set_ctx_md_params(fns); |
e683582b SL |
219 | smdparamfncnt++; |
220 | break; | |
221 | case OSSL_FUNC_SIGNATURE_SETTABLE_CTX_MD_PARAMS: | |
222 | if (signature->settable_ctx_md_params != NULL) | |
223 | break; | |
224 | signature->settable_ctx_md_params | |
363b1e5d | 225 | = OSSL_FUNC_signature_settable_ctx_md_params(fns); |
e683582b SL |
226 | smdparamfncnt++; |
227 | break; | |
228 | } | |
229 | } | |
230 | if (ctxfncnt != 2 | |
231 | || (signfncnt == 0 | |
232 | && verifyfncnt == 0 | |
233 | && verifyrecfncnt == 0 | |
234 | && digsignfncnt == 0 | |
eea1e780 MC |
235 | && digverifyfncnt == 0 |
236 | && signature->digest_sign == NULL | |
237 | && signature->digest_verify == NULL) | |
e683582b SL |
238 | || (signfncnt != 0 && signfncnt != 2) |
239 | || (verifyfncnt != 0 && verifyfncnt != 2) | |
240 | || (verifyrecfncnt != 0 && verifyrecfncnt != 2) | |
eea1e780 MC |
241 | || (digsignfncnt != 0 && digsignfncnt != 2) |
242 | || (digsignfncnt == 2 && signature->digest_sign_init == NULL) | |
243 | || (digverifyfncnt != 0 && digverifyfncnt != 2) | |
244 | || (digverifyfncnt == 2 && signature->digest_verify_init == NULL) | |
245 | || (signature->digest_sign != NULL | |
246 | && signature->digest_sign_init == NULL) | |
247 | || (signature->digest_verify != NULL | |
248 | && signature->digest_verify_init == NULL) | |
e683582b SL |
249 | || (gparamfncnt != 0 && gparamfncnt != 2) |
250 | || (sparamfncnt != 0 && sparamfncnt != 2) | |
251 | || (gmdparamfncnt != 0 && gmdparamfncnt != 2) | |
252 | || (smdparamfncnt != 0 && smdparamfncnt != 2)) { | |
253 | /* | |
254 | * In order to be a consistent set of functions we must have at least | |
255 | * a set of context functions (newctx and freectx) as well as a set of | |
256 | * "signature" functions: | |
257 | * (sign_init, sign) or | |
258 | * (verify_init verify) or | |
259 | * (verify_recover_init, verify_recover) or | |
260 | * (digest_sign_init, digest_sign_update, digest_sign_final) or | |
eea1e780 MC |
261 | * (digest_verify_init, digest_verify_update, digest_verify_final) or |
262 | * (digest_sign_init, digest_sign) or | |
263 | * (digest_verify_init, digest_verify). | |
e683582b SL |
264 | * |
265 | * set_ctx_params and settable_ctx_params are optional, but if one of | |
266 | * them is present then the other one must also be present. The same | |
267 | * applies to get_ctx_params and gettable_ctx_params. The same rules | |
268 | * apply to the "md_params" functions. The dupctx function is optional. | |
269 | */ | |
270 | ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_PROVIDER_FUNCTIONS); | |
271 | goto err; | |
272 | } | |
273 | ||
274 | return signature; | |
275 | err: | |
276 | EVP_SIGNATURE_free(signature); | |
277 | return NULL; | |
278 | } | |
279 | ||
280 | void EVP_SIGNATURE_free(EVP_SIGNATURE *signature) | |
281 | { | |
543e740b | 282 | int i; |
e683582b | 283 | |
543e740b RS |
284 | if (signature == NULL) |
285 | return; | |
286 | CRYPTO_DOWN_REF(&signature->refcnt, &i, signature->lock); | |
287 | if (i > 0) | |
288 | return; | |
6c9bc258 | 289 | OPENSSL_free(signature->type_name); |
543e740b RS |
290 | ossl_provider_free(signature->prov); |
291 | CRYPTO_THREAD_lock_free(signature->lock); | |
292 | OPENSSL_free(signature); | |
e683582b SL |
293 | } |
294 | ||
295 | int EVP_SIGNATURE_up_ref(EVP_SIGNATURE *signature) | |
296 | { | |
297 | int ref = 0; | |
298 | ||
299 | CRYPTO_UP_REF(&signature->refcnt, &ref, signature->lock); | |
300 | return 1; | |
301 | } | |
302 | ||
303 | OSSL_PROVIDER *EVP_SIGNATURE_provider(const EVP_SIGNATURE *signature) | |
304 | { | |
305 | return signature->prov; | |
306 | } | |
307 | ||
b4250010 | 308 | EVP_SIGNATURE *EVP_SIGNATURE_fetch(OSSL_LIB_CTX *ctx, const char *algorithm, |
e683582b SL |
309 | const char *properties) |
310 | { | |
311 | return evp_generic_fetch(ctx, OSSL_OP_SIGNATURE, algorithm, properties, | |
309a78aa | 312 | evp_signature_from_algorithm, |
e683582b SL |
313 | (int (*)(void *))EVP_SIGNATURE_up_ref, |
314 | (void (*)(void *))EVP_SIGNATURE_free); | |
315 | } | |
316 | ||
317 | int EVP_SIGNATURE_is_a(const EVP_SIGNATURE *signature, const char *name) | |
318 | { | |
e4a1d023 | 319 | return evp_is_a(signature->prov, signature->name_id, NULL, name); |
e683582b SL |
320 | } |
321 | ||
322 | int EVP_SIGNATURE_number(const EVP_SIGNATURE *signature) | |
323 | { | |
324 | return signature->name_id; | |
325 | } | |
326 | ||
6c9bc258 TM |
327 | const char *EVP_SIGNATURE_name(const EVP_SIGNATURE *signature) |
328 | { | |
329 | return signature->type_name; | |
330 | } | |
331 | ||
03888233 RL |
332 | const char *EVP_SIGNATURE_description(const EVP_SIGNATURE *signature) |
333 | { | |
334 | return signature->description; | |
335 | } | |
336 | ||
b4250010 | 337 | void EVP_SIGNATURE_do_all_provided(OSSL_LIB_CTX *libctx, |
e683582b SL |
338 | void (*fn)(EVP_SIGNATURE *signature, |
339 | void *arg), | |
340 | void *arg) | |
341 | { | |
342 | evp_generic_do_all(libctx, OSSL_OP_SIGNATURE, | |
343 | (void (*)(void *, void *))fn, arg, | |
309a78aa | 344 | evp_signature_from_algorithm, |
e683582b SL |
345 | (void (*)(void *))EVP_SIGNATURE_free); |
346 | } | |
347 | ||
348 | ||
d84f5515 MC |
349 | int EVP_SIGNATURE_names_do_all(const EVP_SIGNATURE *signature, |
350 | void (*fn)(const char *name, void *data), | |
351 | void *data) | |
e683582b SL |
352 | { |
353 | if (signature->prov != NULL) | |
d84f5515 MC |
354 | return evp_names_do_all(signature->prov, signature->name_id, fn, data); |
355 | ||
356 | return 1; | |
e683582b SL |
357 | } |
358 | ||
e3efe7a5 SL |
359 | const OSSL_PARAM *EVP_SIGNATURE_gettable_ctx_params(const EVP_SIGNATURE *sig) |
360 | { | |
361 | void *provctx; | |
362 | ||
363 | if (sig == NULL || sig->gettable_ctx_params == NULL) | |
364 | return NULL; | |
365 | ||
366 | provctx = ossl_provider_ctx(EVP_SIGNATURE_provider(sig)); | |
fb67126e | 367 | return sig->gettable_ctx_params(NULL, provctx); |
e3efe7a5 SL |
368 | } |
369 | ||
370 | const OSSL_PARAM *EVP_SIGNATURE_settable_ctx_params(const EVP_SIGNATURE *sig) | |
371 | { | |
372 | void *provctx; | |
373 | ||
374 | if (sig == NULL || sig->settable_ctx_params == NULL) | |
375 | return NULL; | |
376 | ||
377 | provctx = ossl_provider_ctx(EVP_SIGNATURE_provider(sig)); | |
fb67126e | 378 | return sig->settable_ctx_params(NULL, provctx); |
e3efe7a5 SL |
379 | } |
380 | ||
4b58d9b4 P |
381 | static int evp_pkey_signature_init(EVP_PKEY_CTX *ctx, int operation, |
382 | const OSSL_PARAM params[]) | |
e683582b SL |
383 | { |
384 | int ret = 0; | |
385 | void *provkey = NULL; | |
386 | EVP_SIGNATURE *signature = NULL; | |
f6aa5774 RL |
387 | EVP_KEYMGMT *tmp_keymgmt = NULL; |
388 | const char *supported_sig = NULL; | |
e683582b SL |
389 | |
390 | if (ctx == NULL) { | |
9311d0c4 | 391 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
392 | return -2; |
393 | } | |
394 | ||
395 | evp_pkey_ctx_free_old_ops(ctx); | |
396 | ctx->operation = operation; | |
397 | ||
0b9dd384 RL |
398 | /* |
399 | * TODO when we stop falling back to legacy, this and the ERR_pop_to_mark() | |
400 | * calls can be removed. | |
401 | */ | |
402 | ERR_set_mark(); | |
403 | ||
f21c9c64 | 404 | if (evp_pkey_ctx_is_legacy(ctx)) |
e683582b SL |
405 | goto legacy; |
406 | ||
3c6ed955 RL |
407 | /* |
408 | * Ensure that the key is provided, either natively, or as a cached export. | |
409 | * If not, go legacy | |
410 | */ | |
f6aa5774 | 411 | tmp_keymgmt = ctx->keymgmt; |
3c6ed955 RL |
412 | provkey = evp_pkey_export_to_provider(ctx->pkey, ctx->libctx, |
413 | &tmp_keymgmt, ctx->propquery); | |
d0ddf9b4 | 414 | if (tmp_keymgmt == NULL) |
f6aa5774 RL |
415 | goto legacy; |
416 | if (!EVP_KEYMGMT_up_ref(tmp_keymgmt)) { | |
0b9dd384 | 417 | ERR_clear_last_mark(); |
f6aa5774 RL |
418 | ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); |
419 | goto err; | |
e683582b | 420 | } |
f6aa5774 RL |
421 | EVP_KEYMGMT_free(ctx->keymgmt); |
422 | ctx->keymgmt = tmp_keymgmt; | |
423 | ||
424 | if (ctx->keymgmt->query_operation_name != NULL) | |
425 | supported_sig = ctx->keymgmt->query_operation_name(OSSL_OP_SIGNATURE); | |
426 | ||
427 | /* | |
428 | * If we didn't get a supported sig, assume there is one with the | |
429 | * same name as the key type. | |
430 | */ | |
431 | if (supported_sig == NULL) | |
432 | supported_sig = ctx->keytype; | |
433 | ||
434 | /* | |
435 | * Because we cleared out old ops, we shouldn't need to worry about | |
436 | * checking if signature is already there. | |
437 | */ | |
438 | signature = | |
439 | EVP_SIGNATURE_fetch(ctx->libctx, supported_sig, ctx->propquery); | |
440 | ||
441 | if (signature == NULL | |
e683582b SL |
442 | || (EVP_KEYMGMT_provider(ctx->keymgmt) |
443 | != EVP_SIGNATURE_provider(signature))) { | |
444 | /* | |
0b9dd384 RL |
445 | * We don't need to free ctx->keymgmt here, as it's not necessarily |
446 | * tied to this operation. It will be freed by EVP_PKEY_CTX_free(). | |
e683582b SL |
447 | */ |
448 | EVP_SIGNATURE_free(signature); | |
449 | goto legacy; | |
450 | } | |
451 | ||
0b9dd384 RL |
452 | /* |
453 | * TODO remove this when legacy is gone | |
454 | * If we don't have the full support we need with provided methods, | |
455 | * let's go see if legacy does. | |
456 | */ | |
457 | ERR_pop_to_mark(); | |
458 | ||
459 | /* No more legacy from here down to legacy: */ | |
460 | ||
e683582b | 461 | ctx->op.sig.signature = signature; |
2c6094ba RL |
462 | ctx->op.sig.sigprovctx = |
463 | signature->newctx(ossl_provider_ctx(signature->prov), ctx->propquery); | |
e683582b SL |
464 | if (ctx->op.sig.sigprovctx == NULL) { |
465 | /* The provider key can stay in the cache */ | |
9311d0c4 | 466 | ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); |
e683582b SL |
467 | goto err; |
468 | } | |
469 | ||
470 | switch (operation) { | |
471 | case EVP_PKEY_OP_SIGN: | |
472 | if (signature->sign_init == NULL) { | |
9311d0c4 | 473 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
474 | ret = -2; |
475 | goto err; | |
476 | } | |
4b58d9b4 | 477 | ret = signature->sign_init(ctx->op.sig.sigprovctx, provkey, params); |
e683582b SL |
478 | break; |
479 | case EVP_PKEY_OP_VERIFY: | |
480 | if (signature->verify_init == NULL) { | |
9311d0c4 | 481 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
482 | ret = -2; |
483 | goto err; | |
484 | } | |
4b58d9b4 | 485 | ret = signature->verify_init(ctx->op.sig.sigprovctx, provkey, params); |
e683582b SL |
486 | break; |
487 | case EVP_PKEY_OP_VERIFYRECOVER: | |
488 | if (signature->verify_recover_init == NULL) { | |
9311d0c4 | 489 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
490 | ret = -2; |
491 | goto err; | |
492 | } | |
4b58d9b4 P |
493 | ret = signature->verify_recover_init(ctx->op.sig.sigprovctx, provkey, |
494 | params); | |
e683582b SL |
495 | break; |
496 | default: | |
9311d0c4 | 497 | ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); |
e683582b SL |
498 | goto err; |
499 | } | |
500 | ||
501 | if (ret <= 0) { | |
502 | signature->freectx(ctx->op.sig.sigprovctx); | |
503 | ctx->op.sig.sigprovctx = NULL; | |
504 | goto err; | |
505 | } | |
86df26b3 | 506 | goto end; |
e683582b SL |
507 | |
508 | legacy: | |
0b9dd384 RL |
509 | /* |
510 | * TODO remove this when legacy is gone | |
511 | * If we don't have the full support we need with provided methods, | |
512 | * let's go see if legacy does. | |
513 | */ | |
514 | ERR_pop_to_mark(); | |
515 | ||
e683582b SL |
516 | if (ctx->pmeth == NULL |
517 | || (operation == EVP_PKEY_OP_SIGN && ctx->pmeth->sign == NULL) | |
518 | || (operation == EVP_PKEY_OP_VERIFY && ctx->pmeth->verify == NULL) | |
519 | || (operation == EVP_PKEY_OP_VERIFYRECOVER | |
520 | && ctx->pmeth->verify_recover == NULL)) { | |
9311d0c4 | 521 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
522 | return -2; |
523 | } | |
524 | ||
525 | switch (operation) { | |
526 | case EVP_PKEY_OP_SIGN: | |
527 | if (ctx->pmeth->sign_init == NULL) | |
528 | return 1; | |
529 | ret = ctx->pmeth->sign_init(ctx); | |
530 | break; | |
531 | case EVP_PKEY_OP_VERIFY: | |
532 | if (ctx->pmeth->verify_init == NULL) | |
533 | return 1; | |
534 | ret = ctx->pmeth->verify_init(ctx); | |
535 | break; | |
536 | case EVP_PKEY_OP_VERIFYRECOVER: | |
537 | if (ctx->pmeth->verify_recover_init == NULL) | |
538 | return 1; | |
539 | ret = ctx->pmeth->verify_recover_init(ctx); | |
540 | break; | |
541 | default: | |
9311d0c4 | 542 | ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); |
e683582b SL |
543 | goto err; |
544 | } | |
545 | if (ret <= 0) | |
546 | goto err; | |
86df26b3 RL |
547 | end: |
548 | #ifndef FIPS_MODULE | |
549 | if (ret > 0) | |
550 | ret = evp_pkey_ctx_use_cached_data(ctx); | |
551 | #endif | |
e683582b | 552 | |
86df26b3 | 553 | return ret; |
e683582b | 554 | err: |
c7fa9297 | 555 | evp_pkey_ctx_free_old_ops(ctx); |
e683582b SL |
556 | ctx->operation = EVP_PKEY_OP_UNDEFINED; |
557 | return ret; | |
558 | } | |
559 | ||
560 | int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx) | |
561 | { | |
4b58d9b4 P |
562 | return evp_pkey_signature_init(ctx, EVP_PKEY_OP_SIGN, NULL); |
563 | } | |
564 | ||
565 | int EVP_PKEY_sign_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]) | |
566 | { | |
567 | return evp_pkey_signature_init(ctx, EVP_PKEY_OP_SIGN, params); | |
e683582b SL |
568 | } |
569 | ||
570 | int EVP_PKEY_sign(EVP_PKEY_CTX *ctx, | |
571 | unsigned char *sig, size_t *siglen, | |
572 | const unsigned char *tbs, size_t tbslen) | |
573 | { | |
574 | int ret; | |
575 | ||
576 | if (ctx == NULL) { | |
9311d0c4 | 577 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
578 | return -2; |
579 | } | |
580 | ||
581 | if (ctx->operation != EVP_PKEY_OP_SIGN) { | |
bf23b9a1 | 582 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED); |
e683582b SL |
583 | return -1; |
584 | } | |
585 | ||
586 | if (ctx->op.sig.sigprovctx == NULL) | |
587 | goto legacy; | |
588 | ||
589 | ret = ctx->op.sig.signature->sign(ctx->op.sig.sigprovctx, sig, siglen, | |
590 | SIZE_MAX, tbs, tbslen); | |
591 | ||
592 | return ret; | |
593 | legacy: | |
594 | ||
595 | if (ctx->pmeth == NULL || ctx->pmeth->sign == NULL) { | |
9311d0c4 | 596 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
597 | return -2; |
598 | } | |
599 | ||
600 | M_check_autoarg(ctx, sig, siglen, EVP_F_EVP_PKEY_SIGN) | |
601 | return ctx->pmeth->sign(ctx, sig, siglen, tbs, tbslen); | |
602 | } | |
603 | ||
604 | int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx) | |
605 | { | |
4b58d9b4 P |
606 | return evp_pkey_signature_init(ctx, EVP_PKEY_OP_VERIFY, NULL); |
607 | } | |
608 | ||
609 | int EVP_PKEY_verify_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]) | |
610 | { | |
611 | return evp_pkey_signature_init(ctx, EVP_PKEY_OP_VERIFY, params); | |
e683582b SL |
612 | } |
613 | ||
614 | int EVP_PKEY_verify(EVP_PKEY_CTX *ctx, | |
615 | const unsigned char *sig, size_t siglen, | |
616 | const unsigned char *tbs, size_t tbslen) | |
617 | { | |
618 | int ret; | |
619 | ||
620 | if (ctx == NULL) { | |
9311d0c4 | 621 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
622 | return -2; |
623 | } | |
624 | ||
625 | if (ctx->operation != EVP_PKEY_OP_VERIFY) { | |
bf23b9a1 | 626 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED); |
e683582b SL |
627 | return -1; |
628 | } | |
629 | ||
630 | if (ctx->op.sig.sigprovctx == NULL) | |
631 | goto legacy; | |
632 | ||
633 | ret = ctx->op.sig.signature->verify(ctx->op.sig.sigprovctx, sig, siglen, | |
634 | tbs, tbslen); | |
635 | ||
636 | return ret; | |
637 | legacy: | |
638 | if (ctx->pmeth == NULL || ctx->pmeth->verify == NULL) { | |
9311d0c4 | 639 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
640 | return -2; |
641 | } | |
642 | ||
643 | return ctx->pmeth->verify(ctx, sig, siglen, tbs, tbslen); | |
644 | } | |
645 | ||
646 | int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx) | |
647 | { | |
4b58d9b4 P |
648 | return evp_pkey_signature_init(ctx, EVP_PKEY_OP_VERIFYRECOVER, NULL); |
649 | } | |
650 | ||
651 | int EVP_PKEY_verify_recover_init_ex(EVP_PKEY_CTX *ctx, | |
652 | const OSSL_PARAM params[]) | |
653 | { | |
654 | return evp_pkey_signature_init(ctx, EVP_PKEY_OP_VERIFYRECOVER, params); | |
e683582b SL |
655 | } |
656 | ||
657 | int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx, | |
658 | unsigned char *rout, size_t *routlen, | |
659 | const unsigned char *sig, size_t siglen) | |
660 | { | |
661 | int ret; | |
662 | ||
663 | if (ctx == NULL) { | |
9311d0c4 | 664 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
665 | return -2; |
666 | } | |
667 | ||
668 | if (ctx->operation != EVP_PKEY_OP_VERIFYRECOVER) { | |
bf23b9a1 | 669 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_INITIALIZED); |
e683582b SL |
670 | return -1; |
671 | } | |
672 | ||
673 | if (ctx->op.sig.sigprovctx == NULL) | |
674 | goto legacy; | |
675 | ||
676 | ret = ctx->op.sig.signature->verify_recover(ctx->op.sig.sigprovctx, rout, | |
677 | routlen, | |
678 | (rout == NULL ? 0 : *routlen), | |
679 | sig, siglen); | |
680 | return ret; | |
681 | legacy: | |
682 | if (ctx->pmeth == NULL || ctx->pmeth->verify_recover == NULL) { | |
9311d0c4 | 683 | ERR_raise(ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); |
e683582b SL |
684 | return -2; |
685 | } | |
686 | M_check_autoarg(ctx, rout, routlen, EVP_F_EVP_PKEY_VERIFY_RECOVER) | |
687 | return ctx->pmeth->verify_recover(ctx, rout, routlen, sig, siglen); | |
688 | } |