From: Steffan Karger Date: Sun, 25 Dec 2016 22:38:25 +0000 (+0100) Subject: Document that RSA_SIGN can also request TLS 1.2 signatures X-Git-Tag: v2.5_beta1~773 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e36b814073c0f56c77e4922cc105f00b8558e7e;p=thirdparty%2Fopenvpn.git Document that RSA_SIGN can also request TLS 1.2 signatures Ever since we support TLS 1.2 (OpenVPN 2.3.3+), the RSA_SIGN might not only request MD5-SHA1 'TLS signatures', but also other variants. Document this by updating the implementation hints, and explicitly stating that we expect a PKCS#1 1.5 signature. Trac: #764 Signed-off-by: Steffan Karger Acked-by: Arne Schwabe Message-Id: <1482705505-20302-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13714.html Signed-off-by: David Sommerseth --- diff --git a/doc/management-notes.txt b/doc/management-notes.txt index dd870ebc7..29c3aadf2 100644 --- a/doc/management-notes.txt +++ b/doc/management-notes.txt @@ -773,8 +773,9 @@ via a notification as follows: >RSA_SIGN:[BASE64_DATA] -The management interface client should then sign BASE64_DATA -using the private key and return the SSL signature as follows: +The management interface client should then create a PKCS#1 v1.5 signature of +the (decoded) BASE64_DATA using the private key and return the SSL signature as +follows: rsa-sig [BASE64_SIG_LINE] @@ -783,8 +784,8 @@ rsa-sig . END -Base64 encoded output of RSA_sign(NID_md5_sha1,... will provide a -correct signature. +Base64 encoded output of RSA_private_encrypt() (OpenSSL) or mbedtls_pk_sign() +(mbed TLS) will provide a correct signature. This capability is intended to allow the use of arbitrary cryptographic service providers with OpenVPN via the management interface.