gnutls_sign_is_secure2: introduced

This function exports the ability to check the validity of
a signature algorithm for signing certificates.

That also introduces the flag GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS
which when specified will cause the function to return whether
the algorithm is secure for signing certificates.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

diff --git a/lib/algorithms/sign.c b/lib/algorithms/sign.c
index 55be3d9bdc2365cd8c76648fa4f552bcfb271194..062d926fcf6fe500bf0da36fdc08ac23350a4ee4 100644 (file)
--- a/lib/algorithms/sign.c
+++ b/lib/algorithms/sign.c
@@ -171,7 +171,19 @@ const char *gnutls_sign_get_name(gnutls_sign_algorithm_t algorithm)
  *
  * Returns: Non-zero if the provided signature algorithm is considered to be secure.
  **/
-int gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm)
+unsigned gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm)
+{
+       return gnutls_sign_is_secure2(algorithm, 0);
+}
+
+/**
+ * gnutls_sign_is_secure2:
+ * @algorithm: is a sign algorithm
+ * @flags: zero or %GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS
+ *
+ * Returns: Non-zero if the provided signature algorithm is considered to be secure.
+ **/
+unsigned gnutls_sign_is_secure2(gnutls_sign_algorithm_t algorithm, unsigned int flags)
 {
        gnutls_sign_algorithm_t sign = algorithm;
        gnutls_digest_algorithm_t dig = GNUTLS_DIG_UNKNOWN;
@@ -179,8 +191,12 @@ int gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm)
        /* avoid prefix */
        GNUTLS_SIGN_ALG_LOOP(dig = p->hash);
 
-       if (dig != GNUTLS_DIG_UNKNOWN)
-               return _gnutls_digest_is_secure(hash_to_entry(dig));
+       if (dig != GNUTLS_DIG_UNKNOWN) {
+               if (flags & GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS)
+                       return _gnutls_digest_is_secure_for_certs(hash_to_entry(dig));
+               else
+                       return _gnutls_digest_is_secure(hash_to_entry(dig));
+       }
 
        return 0;
 }

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 9bc89ca4207b8e7f9f7494bb723ff22811bfa683..6c1012f175de081b20426a83878b928e06200035 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -1010,7 +1010,14 @@ size_t
 size_t
        gnutls_mac_get_key_size(gnutls_mac_algorithm_t algorithm) __GNUTLS_CONST__;
 
-int gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm) __GNUTLS_CONST__;
+unsigned gnutls_sign_is_secure(gnutls_sign_algorithm_t algorithm) __GNUTLS_CONST__;
+
+/* It is possible that a signature algorithm is ok to use for short-lived
+ * data (e.g., to sign a TLS session), but not for data that are long-lived
+ * like certificates. This flag is about checking the security of the algorithm
+ * for long-lived data. */
+#define GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS 1
+unsigned gnutls_sign_is_secure2(gnutls_sign_algorithm_t algorithm, unsigned int flags) __GNUTLS_CONST__;
 
 gnutls_digest_algorithm_t
        gnutls_sign_get_hash_algorithm(gnutls_sign_algorithm_t sign) __GNUTLS_CONST__;

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index e1152059f72192a4033c9d267d989f95696902e1..8121f407738b7d48c6a71a9e9a59d3d25522809b 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -1165,6 +1165,7 @@ GNUTLS_3_4
        gnutls_privkey_sign_hash2;
        gnutls_privkey_sign_data2;
        gnutls_priority_set2;
+       gnutls_sign_is_secure2;
  local:
        *;
 };