]> git.ipfire.org Git - thirdparty/openssl.git/commit - include/crypto/evp.h
Implement EVP_PKEY_param_check_quick() and use it in libssl
authorMatt Caswell <matt@openssl.org>
Tue, 9 Feb 2021 15:50:05 +0000 (15:50 +0000)
committerShane Lontis <shane.lontis@oracle.com>
Mon, 15 Feb 2021 04:17:36 +0000 (14:17 +1000)
commit899e25643dc63a84a924d08f86d7d19613714431
treef79751777385af9b6d4d05a8dc1739a94f59510b
parentaee73562d17499f2660c14f8c150459097680a1d
Implement EVP_PKEY_param_check_quick() and use it in libssl

The low level DH API has two functions for checking parameters:
DH_check_ex() and DH_check_params_ex(). The former does a "full" check,
while the latter does a "quick" check. Most importantly it skips the
check for a safe prime. We're ok without using safe primes here because
we're doing ephemeral DH.

Now that libssl is fully using the EVP API, we need a way to specify that
we want a quick check instead of a full check. Therefore we introduce
EVP_PKEY_param_check_quick() and use it.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/14146)
13 files changed:
crypto/evp/keymgmt_meth.c
crypto/evp/pmeth_check.c
doc/man7/provider-keymgmt.pod
include/crypto/evp.h
include/openssl/core_dispatch.h
include/openssl/evp.h
providers/implementations/keymgmt/dh_kmgmt.c
providers/implementations/keymgmt/dsa_kmgmt.c
providers/implementations/keymgmt/ec_kmgmt.c
providers/implementations/keymgmt/ecx_kmgmt.c
providers/implementations/keymgmt/rsa_kmgmt.c
ssl/statem/statem_clnt.c
util/libcrypto.num