From: Shane Lontis Date: Tue, 4 Aug 2020 01:15:18 +0000 (+1000) Subject: Add DHX support to keymanager X-Git-Tag: openssl-3.0.0-alpha7~604 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=627c220311bcd3bd6f4f745b76ce6a548bed4629;p=thirdparty%2Fopenssl.git Add DHX support to keymanager Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/12575) --- diff --git a/include/openssl/dh.h b/include/openssl/dh.h index 4907bc6567d..1a02f8a330b 100644 --- a/include/openssl/dh.h +++ b/include/openssl/dh.h @@ -40,6 +40,10 @@ extern "C" { # define DH_FLAG_CACHE_MONT_P 0x01 +# define DH_FLAG_TYPE_MASK 0xF000 +# define DH_FLAG_TYPE_DH 0x0000 +# define DH_FLAG_TYPE_DHX 0x1000 + # ifndef OPENSSL_NO_DEPRECATED_1_1_0 /* * Does nothing. Previously this switched off constant time behaviour. diff --git a/providers/defltprov.c b/providers/defltprov.c index 00d1800c245..c34c5397260 100644 --- a/providers/defltprov.c +++ b/providers/defltprov.c @@ -374,6 +374,7 @@ static const OSSL_ALGORITHM deflt_asym_cipher[] = { static const OSSL_ALGORITHM deflt_keymgmt[] = { #ifndef OPENSSL_NO_DH { "DH:dhKeyAgreement", "provider=default", dh_keymgmt_functions }, + { "DHX:X9.42 DH:dhpublicnumber", "provider=default", dhx_keymgmt_functions }, #endif #ifndef OPENSSL_NO_DSA { "DSA:dsaEncryption", "provider=default", dsa_keymgmt_functions }, diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c index 4711a99b016..b29cae509c0 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c @@ -447,6 +447,7 @@ static const OSSL_ALGORITHM fips_asym_cipher[] = { static const OSSL_ALGORITHM fips_keymgmt[] = { #ifndef OPENSSL_NO_DH { "DH:dhKeyAgreement", FIPS_DEFAULT_PROPERTIES, dh_keymgmt_functions }, + { "DHX:X9.42 DH:dhpublicnumber", FIPS_DEFAULT_PROPERTIES, dhx_keymgmt_functions }, #endif #ifndef OPENSSL_NO_DSA { "DSA", FIPS_DEFAULT_PROPERTIES, dsa_keymgmt_functions }, diff --git a/providers/implementations/include/prov/implementations.h b/providers/implementations/include/prov/implementations.h index 9e3ef4d79cc..f56c698fb3c 100644 --- a/providers/implementations/include/prov/implementations.h +++ b/providers/implementations/include/prov/implementations.h @@ -267,6 +267,7 @@ extern const OSSL_DISPATCH crngt_functions[]; /* Key management */ extern const OSSL_DISPATCH dh_keymgmt_functions[]; +extern const OSSL_DISPATCH dhx_keymgmt_functions[]; extern const OSSL_DISPATCH dsa_keymgmt_functions[]; extern const OSSL_DISPATCH rsa_keymgmt_functions[]; extern const OSSL_DISPATCH rsapss_keymgmt_functions[]; diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c index 73fcb3fc410..0ea6ce77842 100644 --- a/providers/implementations/keymgmt/dh_kmgmt.c +++ b/providers/implementations/keymgmt/dh_kmgmt.c @@ -29,6 +29,7 @@ static OSSL_FUNC_keymgmt_new_fn dh_newdata; static OSSL_FUNC_keymgmt_free_fn dh_freedata; static OSSL_FUNC_keymgmt_gen_init_fn dh_gen_init; +static OSSL_FUNC_keymgmt_gen_init_fn dhx_gen_init; static OSSL_FUNC_keymgmt_gen_set_template_fn dh_gen_set_template; static OSSL_FUNC_keymgmt_gen_set_params_fn dh_gen_set_params; static OSSL_FUNC_keymgmt_gen_settable_params_fn dh_gen_settable_params; @@ -73,6 +74,7 @@ struct dh_gen_ctx { const char *mdprops; OSSL_CALLBACK *cb; void *cbarg; + int dh_type; }; typedef struct dh_name2id_st{ @@ -131,7 +133,26 @@ static int dh_key_todata(DH *dh, OSSL_PARAM_BLD *bld, OSSL_PARAM params[]) static void *dh_newdata(void *provctx) { - return dh_new_with_libctx(PROV_LIBRARY_CONTEXT_OF(provctx)); + DH *dh = NULL; + + dh = dh_new_with_libctx(PROV_LIBRARY_CONTEXT_OF(provctx)); + if (dh != NULL) { + DH_clear_flags(dh, DH_FLAG_TYPE_MASK); + DH_set_flags(dh, DH_FLAG_TYPE_DH); + } + return dh; +} + +static void *dhx_newdata(void *provctx) +{ + DH *dh = NULL; + + dh = dh_new_with_libctx(PROV_LIBRARY_CONTEXT_OF(provctx)); + if (dh != NULL) { + DH_clear_flags(dh, DH_FLAG_TYPE_MASK); + DH_set_flags(dh, DH_FLAG_TYPE_DHX); + } + return dh; } static void dh_freedata(void *keydata) @@ -399,7 +420,7 @@ static int dh_validate(void *keydata, int selection) return ok; } -static void *dh_gen_init(void *provctx, int selection) +static void *dh_gen_init_base(void *provctx, int selection, int type) { OPENSSL_CTX *libctx = PROV_LIBRARY_CONTEXT_OF(provctx); struct dh_gen_ctx *gctx = NULL; @@ -419,10 +440,21 @@ static void *dh_gen_init(void *provctx, int selection) gctx->hindex = 0; gctx->pcounter = -1; gctx->generator = DH_GENERATOR_2; + gctx->dh_type = type; } return gctx; } +static void *dh_gen_init(void *provctx, int selection) +{ + return dh_gen_init_base(provctx, selection, DH_FLAG_TYPE_DH); +} + +static void *dhx_gen_init(void *provctx, int selection) +{ + return dh_gen_init_base(provctx, selection, DH_FLAG_TYPE_DHX); +} + static int dh_gen_set_template(void *genctx, void *templ) { struct dh_gen_ctx *gctx = genctx; @@ -624,6 +656,9 @@ static void *dh_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) if (DH_generate_key(dh) <= 0) goto end; } + DH_clear_flags(dh, DH_FLAG_TYPE_MASK); + DH_set_flags(dh, gctx->dh_type); + ret = 1; end: if (ret <= 0) { @@ -683,3 +718,36 @@ const OSSL_DISPATCH dh_keymgmt_functions[] = { { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))dh_export_types }, { 0, NULL } }; + +/* For any DH key, we use the "DH" algorithms regardless of sub-type. */ +static const char *dhx_query_operation_name(int operation_id) +{ + return "DH"; +} + +const OSSL_DISPATCH dhx_keymgmt_functions[] = { + { OSSL_FUNC_KEYMGMT_NEW, (void (*)(void))dhx_newdata }, + { OSSL_FUNC_KEYMGMT_GEN_INIT, (void (*)(void))dhx_gen_init }, + { OSSL_FUNC_KEYMGMT_GEN_SET_TEMPLATE, (void (*)(void))dh_gen_set_template }, + { OSSL_FUNC_KEYMGMT_GEN_SET_PARAMS, (void (*)(void))dh_gen_set_params }, + { OSSL_FUNC_KEYMGMT_GEN_SETTABLE_PARAMS, + (void (*)(void))dh_gen_settable_params }, + { OSSL_FUNC_KEYMGMT_GEN, (void (*)(void))dh_gen }, + { OSSL_FUNC_KEYMGMT_GEN_CLEANUP, (void (*)(void))dh_gen_cleanup }, + { OSSL_FUNC_KEYMGMT_LOAD, (void (*)(void))dh_load }, + { OSSL_FUNC_KEYMGMT_FREE, (void (*)(void))dh_freedata }, + { OSSL_FUNC_KEYMGMT_GET_PARAMS, (void (*) (void))dh_get_params }, + { OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (void (*) (void))dh_gettable_params }, + { OSSL_FUNC_KEYMGMT_SET_PARAMS, (void (*) (void))dh_set_params }, + { OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (void (*) (void))dh_settable_params }, + { OSSL_FUNC_KEYMGMT_HAS, (void (*)(void))dh_has }, + { OSSL_FUNC_KEYMGMT_MATCH, (void (*)(void))dh_match }, + { OSSL_FUNC_KEYMGMT_VALIDATE, (void (*)(void))dh_validate }, + { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))dh_import }, + { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (void (*)(void))dh_import_types }, + { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))dh_export }, + { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (void (*)(void))dh_export_types }, + { OSSL_FUNC_KEYMGMT_QUERY_OPERATION_NAME, + (void (*)(void))dhx_query_operation_name }, + { 0, NULL } +};