]>
Commit | Line | Data |
---|---|---|
4486d0cd UM |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
5bf73873 | 5 | DH_set_default_method, DH_get_default_method, |
5270e702 | 6 | DH_set_method, DH_new_method, DH_OpenSSL - select DH method |
4486d0cd UM |
7 | |
8 | =head1 SYNOPSIS | |
9 | ||
10 | #include <openssl/dh.h> | |
6aba658c | 11 | #include <openssl/engine.h> |
4486d0cd | 12 | |
5bf73873 | 13 | void DH_set_default_method(const DH_METHOD *meth); |
4486d0cd | 14 | |
5bf73873 | 15 | const DH_METHOD *DH_get_default_method(void); |
4486d0cd | 16 | |
5bf73873 | 17 | int DH_set_method(DH *dh, const DH_METHOD *meth); |
4486d0cd | 18 | |
6aba658c | 19 | DH *DH_new_method(ENGINE *engine); |
4486d0cd | 20 | |
5bf73873 | 21 | const DH_METHOD *DH_OpenSSL(void); |
4486d0cd UM |
22 | |
23 | =head1 DESCRIPTION | |
24 | ||
25 | A B<DH_METHOD> specifies the functions that OpenSSL uses for Diffie-Hellman | |
26 | operations. By modifying the method, alternative implementations | |
5bf73873 GT |
27 | such as hardware accelerators may be used. IMPORTANT: See the NOTES section for |
28 | important information about how these DH API functions are affected by the use | |
29 | of B<ENGINE> API calls. | |
30 | ||
31 | Initially, the default DH_METHOD is the OpenSSL internal implementation, as | |
32 | returned by DH_OpenSSL(). | |
33 | ||
34 | DH_set_default_method() makes B<meth> the default method for all DH | |
35 | structures created later. B<NB>: This is true only whilst no ENGINE has been set | |
36 | as a default for DH, so this function is no longer recommended. | |
37 | ||
38 | DH_get_default_method() returns a pointer to the current default DH_METHOD. | |
b6a338cb | 39 | However, the meaningfulness of this result is dependent on whether the ENGINE |
5bf73873 GT |
40 | API is being used, so this function is no longer recommended. |
41 | ||
42 | DH_set_method() selects B<meth> to perform all operations using the key B<dh>. | |
43 | This will replace the DH_METHOD used by the DH key and if the previous method | |
44 | was supplied by an ENGINE, the handle to that ENGINE will be released during the | |
45 | change. It is possible to have DH keys that only work with certain DH_METHOD | |
46 | implementations (eg. from an ENGINE module that supports embedded | |
47 | hardware-protected keys), and in such cases attempting to change the DH_METHOD | |
48 | for the key can have unexpected results. | |
49 | ||
50 | DH_new_method() allocates and initializes a DH structure so that B<engine> will | |
51 | be used for the DH operations. If B<engine> is NULL, the default ENGINE for DH | |
52 | operations is used, and if no default ENGINE is set, the DH_METHOD controlled by | |
53 | DH_set_default_method() is used. | |
4486d0cd UM |
54 | |
55 | =head1 THE DH_METHOD STRUCTURE | |
56 | ||
57 | typedef struct dh_meth_st | |
58 | { | |
59 | /* name of the implementation */ | |
60 | const char *name; | |
61 | ||
62 | /* generate private and public DH values for key agreement */ | |
63 | int (*generate_key)(DH *dh); | |
64 | ||
65 | /* compute shared secret */ | |
66 | int (*compute_key)(unsigned char *key, BIGNUM *pub_key, DH *dh); | |
67 | ||
e4947bfe | 68 | /* compute r = a ^ p mod m (May be NULL for some implementations) */ |
4486d0cd UM |
69 | int (*bn_mod_exp)(DH *dh, BIGNUM *r, BIGNUM *a, const BIGNUM *p, |
70 | const BIGNUM *m, BN_CTX *ctx, | |
71 | BN_MONT_CTX *m_ctx); | |
72 | ||
73 | /* called at DH_new */ | |
74 | int (*init)(DH *dh); | |
75 | ||
76 | /* called at DH_free */ | |
77 | int (*finish)(DH *dh); | |
78 | ||
79 | int flags; | |
80 | ||
81 | char *app_data; /* ?? */ | |
82 | ||
83 | } DH_METHOD; | |
84 | ||
85 | =head1 RETURN VALUES | |
86 | ||
5bf73873 GT |
87 | DH_OpenSSL() and DH_get_default_method() return pointers to the respective |
88 | B<DH_METHOD>s. | |
89 | ||
90 | DH_set_default_method() returns no value. | |
91 | ||
92 | DH_set_method() returns non-zero if the provided B<meth> was successfully set as | |
93 | the method for B<dh> (including unloading the ENGINE handle if the previous | |
94 | method was supplied by an ENGINE). | |
4486d0cd | 95 | |
5bf73873 | 96 | DH_new_method() returns NULL and sets an error code that can be obtained by |
9b86974e | 97 | L<ERR_get_error(3)> if the allocation fails. Otherwise it |
5bf73873 | 98 | returns a pointer to the newly allocated structure. |
4486d0cd | 99 | |
5bf73873 | 100 | =head1 NOTES |
4486d0cd | 101 | |
5bf73873 GT |
102 | As of version 0.9.7, DH_METHOD implementations are grouped together with other |
103 | algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a | |
104 | default ENGINE is specified for DH functionality using an ENGINE API function, | |
105 | that will override any DH defaults set using the DH API (ie. | |
106 | DH_set_default_method()). For this reason, the ENGINE API is the recommended way | |
107 | to control default implementations for use in DH and other cryptographic | |
108 | algorithms. | |
4486d0cd UM |
109 | |
110 | =head1 SEE ALSO | |
111 | ||
9b86974e | 112 | L<dh(3)>, L<DH_new(3)> |
4486d0cd UM |
113 | |
114 | =head1 HISTORY | |
115 | ||
116 | DH_set_default_method(), DH_get_default_method(), DH_set_method(), | |
117 | DH_new_method() and DH_OpenSSL() were added in OpenSSL 0.9.4. | |
118 | ||
5bf73873 GT |
119 | DH_set_default_openssl_method() and DH_get_default_openssl_method() replaced |
120 | DH_set_default_method() and DH_get_default_method() respectively, and | |
121 | DH_set_method() and DH_new_method() were altered to use B<ENGINE>s rather than | |
122 | B<DH_METHOD>s during development of the engine version of OpenSSL 0.9.6. For | |
123 | 0.9.7, the handling of defaults in the ENGINE API was restructured so that this | |
124 | change was reversed, and behaviour of the other functions resembled more closely | |
125 | the previous behaviour. The behaviour of defaults in the ENGINE API now | |
126 | transparently overrides the behaviour of defaults in the DH API without | |
127 | requiring changing these function prototypes. | |
5270e702 | 128 | |
4486d0cd | 129 | =cut |