]> git.ipfire.org Git - thirdparty/openssl.git/commit - crypto/err/openssl.txt
Add domain parameter match check for DH and ECDH key exchange.
authorShane Lontis <shane.lontis@oracle.com>
Sun, 11 Apr 2021 23:06:24 +0000 (09:06 +1000)
committerShane Lontis <shane.lontis@oracle.com>
Wed, 14 Apr 2021 06:01:13 +0000 (16:01 +1000)
commit46eee7104d77f9d303e06a398febdc60fd014d33
treed826be79497504683f836f4c6a9d7c0b6a91f3d0
parent0d5bbaaae2c65ddf7a30596b61617304e0950d9c
Add domain parameter match check for DH and ECDH key exchange.

Fixes #14808

Validation checks were moved into EVP_PKEY_derive_set_peer() which broke
an external negative test. Originally the old code was semi working by checking the peers public key was in the range of other parties p. It was not actually ever
checking that the domain parameters were consistent between the 2
parties. It now checks the parameters match as well as validating the
peers public key.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14823)
crypto/err/openssl.txt
include/openssl/proverr.h
providers/common/provider_err.c
providers/implementations/exchange/dh_exch.c
providers/implementations/exchange/ecdh_exch.c
test/evp_test.c
test/recipes/30-test_evp.t
test/recipes/30-test_evp_data/evppkey_dh.txt [new file with mode: 0644]
test/recipes/30-test_evp_data/evppkey_ecdh.txt