From: Dr. David von Oheimb Date: Wed, 27 Apr 2022 17:07:46 +0000 (+0200) Subject: crmf_lib.c: Make sure Ed signature for POPO is called without digest X-Git-Tag: openssl-3.2.0-alpha1~2708 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=de56f726e163e99128ff93a04d74a8461f5a724b;p=thirdparty%2Fopenssl.git crmf_lib.c: Make sure Ed signature for POPO is called without digest Fixes #18184 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/18230) --- diff --git a/crypto/crmf/crmf_lib.c b/crypto/crmf/crmf_lib.c index ea1e2dda09f..11351e33d16 100644 --- a/crypto/crmf/crmf_lib.c +++ b/crypto/crmf/crmf_lib.c @@ -369,6 +369,8 @@ static int create_popo_signature(OSSL_CRMF_POPOSIGNINGKEY *ps, EVP_PKEY *pkey, const EVP_MD *digest, OSSL_LIB_CTX *libctx, const char *propq) { + char name[80] = ""; + if (ps == NULL || cr == NULL || pkey == NULL) { ERR_raise(ERR_LIB_CRMF, CRMF_R_NULL_ARGUMENT); return 0; @@ -379,6 +381,10 @@ static int create_popo_signature(OSSL_CRMF_POPOSIGNINGKEY *ps, return 0; } + if (EVP_PKEY_get_default_digest_name(pkey, name, sizeof(name)) > 0 + && strcmp(name, "UNDEF") == 0) /* at least for Ed25519, Ed448 */ + digest = NULL; + return ASN1_item_sign_ex(ASN1_ITEM_rptr(OSSL_CRMF_CERTREQUEST), ps->algorithmIdentifier, NULL, ps->signature, cr, NULL, pkey, digest, libctx, propq); diff --git a/doc/man3/OSSL_CRMF_MSG_set0_validity.pod b/doc/man3/OSSL_CRMF_MSG_set0_validity.pod index 6489645e566..5984abe51b5 100644 --- a/doc/man3/OSSL_CRMF_MSG_set0_validity.pod +++ b/doc/man3/OSSL_CRMF_MSG_set0_validity.pod @@ -62,11 +62,13 @@ OSSL_CRMF_MSG_push0_extension() pushes the X509 extension I to the extensions in the certTemplate of I. Consumes I. OSSL_CRMF_MSG_create_popo() creates and sets the Proof-of-Possession (POPO) -according to the method I in I.< +according to the method I in I. The library context I and property query string I, may be NULL to select the defaults. In case the method is OSSL_CRMF_POPO_SIGNATURE the POPO is calculated -using the private key I and the digest method I. +using the private key I and the digest method I, +where the I argument is ignored if I is of a type (such as +Ed25519 and Ed448) that is implicitly associated with a digest alorithm. I can be one of the following: