Use bits instead of bytes for a private/public key

diff --git a/scripts/key2keyid.c b/scripts/key2keyid.c
index 551d031c6cdfc7035d8a924de85a6428cfd9d417..6a8301c6a9440e00ce833310ae61eb4127776dcc 100644 (file)
--- a/scripts/key2keyid.c
+++ b/scripts/key2keyid.c
@@ -35,7 +35,7 @@ int main(int argc, char *argv[])
        if (private)
        {
                printf("parsed %d bits %N private key.\n",
-                          private->get_keysize(private)*8,
+                          private->get_keysize(private),
                           key_type_names, private->get_type(private));
                if (private->get_fingerprint(private, KEYID_PUBKEY_INFO_SHA1, &chunk))
                {
@@ -65,7 +65,7 @@ int main(int argc, char *argv[])
        if (public)
        {
                printf("parsed %d bits %N public key.\n",
-                          public->get_keysize(public)*8,
+                          public->get_keysize(public),
                           key_type_names, public->get_type(public));
                if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &chunk))
                {

diff --git a/scripts/pubkey_speed.c b/scripts/pubkey_speed.c
index 255f650f507178cfbce667bf82fa4ea948dbfcfa..6402e606daeb1626d18455c80cdc9512fc9c6f74 100644 (file)
--- a/scripts/pubkey_speed.c
+++ b/scripts/pubkey_speed.c
@@ -79,23 +79,23 @@ int main(int argc, char *argv[])
        {
                switch (private->get_keysize(private))
                {
-                       case 32:
+                       case 256:
                                scheme = SIGN_ECDSA_256;
                                break;
-                       case 48:
+                       case 384:
                                scheme = SIGN_ECDSA_384;
                                break;
-                       case 66:
+                       case 521:
                                scheme = SIGN_ECDSA_521;
                                break;
                        default:
                                printf("%d bit ECDSA private key size not supported",
-                                               private->get_keysize(private) * 8);
+                                               private->get_keysize(private));
                                exit(1);
                }
        }
 
-       printf("%4d bit %N: ", private->get_keysize(private)*8,
+       printf("%4d bit %N: ", private->get_keysize(private),
                key_type_names, type);
 
        sigs = malloc(sizeof(chunk_t) * rounds);

diff --git a/src/libcharon/plugins/stroke/stroke_list.c b/src/libcharon/plugins/stroke/stroke_list.c
index a6de35466d38a3bbb6c8657715c6d6b6e009230e..f4ffa94c98268b280b5f335b747a1e9293555a52 100644 (file)
--- a/src/libcharon/plugins/stroke/stroke_list.c
+++ b/src/libcharon/plugins/stroke/stroke_list.c
@@ -638,7 +638,7 @@ static void list_public_key(public_key_t *public, FILE *out)
 
        fprintf(out, "  pubkey:    %N %d bits%s\n",
                        key_type_names, public->get_type(public),
-                       public->get_keysize(public) * 8,
+                       public->get_keysize(public),
                        private ? ", has private key" : "");
        if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid))
        {

diff --git a/src/libcharon/plugins/unit_tester/tests/test_rsa_gen.c b/src/libcharon/plugins/unit_tester/tests/test_rsa_gen.c
index 43688f60a3d6e7a0e8ee51ea016182bd68fa3fef..6ba5769b54af4f984532b4dc54504661c3ac756c 100644 (file)
--- a/src/libcharon/plugins/unit_tester/tests/test_rsa_gen.c
+++ b/src/libcharon/plugins/unit_tester/tests/test_rsa_gen.c
@@ -110,7 +110,7 @@ bool test_rsa_load_any()
        public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
                                                                BUILD_BLOB_ASN1_DER, chunk,
                                                                BUILD_END);
-       if (!public || public->get_keysize(public) != 256)
+       if (!public || public->get_keysize(public) != 2048)
        {
                return FALSE;
        }

diff --git a/src/libcharon/sa/authenticators/pubkey_authenticator.c b/src/libcharon/sa/authenticators/pubkey_authenticator.c
index 3c67f6db6d29bbe32051fd6f5254845faee1e43d..54b4338bb54a5f36676fc4d1718c1af948510465 100644 (file)
--- a/src/libcharon/sa/authenticators/pubkey_authenticator.c
+++ b/src/libcharon/sa/authenticators/pubkey_authenticator.c
@@ -84,15 +84,15 @@ static status_t build(private_pubkey_authenticator_t *this, message_t *message)
                        /* we try to deduct the signature scheme from the keysize */
                        switch (private->get_keysize(private))
                        {
-                               case 32:
+                               case 256:
                                        scheme = SIGN_ECDSA_256;
                                        auth_method = AUTH_ECDSA_256;
                                        break;
-                               case 48:
+                               case 384:
                                        scheme = SIGN_ECDSA_384;
                                        auth_method = AUTH_ECDSA_384;
                                        break;
-                               case 66:
+                               case 521:
                                        scheme = SIGN_ECDSA_521;
                                        auth_method = AUTH_ECDSA_521;
                                        break;

diff --git a/src/libstrongswan/credentials/keys/private_key.h b/src/libstrongswan/credentials/keys/private_key.h
index cec920b02e4ed60532d9ff400f27e5c1e589bc7b..e57d3f5a57684fdeb94ffe48679eec03146a98ed 100644 (file)
--- a/src/libstrongswan/credentials/keys/private_key.h
+++ b/src/libstrongswan/credentials/keys/private_key.h
@@ -60,11 +60,11 @@ struct private_key_t {
                                        chunk_t crypto, chunk_t *plain);
 
        /**
-        * Get the strength of the key in bytes.
+        * Get the strength of the key in bits.
         *
-        * @return                      strength of the key in bytes
+        * @return                      strength of the key in bits
         */
-       size_t (*get_keysize) (private_key_t *this);
+       int (*get_keysize) (private_key_t *this);
 
        /**
         * Get the public part from the private key.

diff --git a/src/libstrongswan/credentials/keys/public_key.h b/src/libstrongswan/credentials/keys/public_key.h
index 3b45b6c3e80d7c9ea51af0ad83cc7ff26a5fcd3a..d20d2736bffb45911535e669cfcbaf44dbf47fd4 100644 (file)
--- a/src/libstrongswan/credentials/keys/public_key.h
+++ b/src/libstrongswan/credentials/keys/public_key.h
@@ -165,11 +165,11 @@ struct public_key_t {
        bool (*equals)(public_key_t *this, public_key_t *other);
 
        /**
-        * Get the strength of the key in bytes.
+        * Get the strength of the key in bits.
         *
-        * @return                      strength of the key in bytes
+        * @return                      strength of the key in bits
         */
-       size_t (*get_keysize) (public_key_t *this);
+       int (*get_keysize) (public_key_t *this);
 
        /**
         * Get the fingerprint of the key.

diff --git a/src/libstrongswan/plugins/agent/agent_private_key.c b/src/libstrongswan/plugins/agent/agent_private_key.c
index 7fc840f8ba633df9a5cb83e24e0f98c8e41b5c7e..31f0b07027b39ca3deaf4f79b8d1aa859ea8795e 100644 (file)
--- a/src/libstrongswan/plugins/agent/agent_private_key.c
+++ b/src/libstrongswan/plugins/agent/agent_private_key.c
@@ -306,10 +306,10 @@ METHOD(private_key_t, decrypt, bool,
        return FALSE;
 }
 
-METHOD(private_key_t, get_keysize, size_t,
+METHOD(private_key_t, get_keysize, int,
        private_agent_private_key_t *this)
 {
-       return this->key_size;
+       return this->key_size * 8;
 }
 
 METHOD(private_key_t, get_public_key, public_key_t*,

diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c b/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c
index 63002d2fe868cee1766b3e4fca5476c0f90593ed..2d9baa47169c7374af01255c793dc76d2d0db45a 100644 (file)
--- a/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c
+++ b/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c
@@ -277,10 +277,10 @@ METHOD(private_key_t, decrypt, bool,
        return TRUE;
 }
 
-METHOD(private_key_t, get_keysize, size_t,
+METHOD(private_key_t, get_keysize, int,
        private_gcrypt_rsa_private_key_t *this)
 {
-       return gcry_pk_get_nbits(this->key) / 8;
+       return gcry_pk_get_nbits(this->key);
 }
 
 METHOD(private_key_t, get_public_key, public_key_t*,

diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_public_key.c b/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_public_key.c
index 7eae5949d105df9d12fd3e8527e81bb12f9f1655..a49a6e5e284220bacd3e9df96404365b6e42fca5 100644 (file)
--- a/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_public_key.c
+++ b/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_public_key.c
@@ -228,10 +228,10 @@ METHOD(public_key_t, encrypt_, bool,
        return !!encrypted->len;
 }
 
-METHOD(public_key_t, get_keysize, size_t,
+METHOD(public_key_t, get_keysize, int,
        private_gcrypt_rsa_public_key_t *this)
 {
-       return gcry_pk_get_nbits(this->key) / 8;
+       return gcry_pk_get_nbits(this->key);
 }
 
 METHOD(public_key_t, get_encoding, bool,

diff --git a/src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c b/src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c
index e21e7131debfcd75753fdc604be29c0fa4f29912..5001a872bc8e881d946b86c3824a986694c5a453 100644 (file)
--- a/src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c
+++ b/src/libstrongswan/plugins/gmp/gmp_rsa_private_key.c
@@ -250,7 +250,7 @@ static bool build_emsa_pkcs1_signature(private_gmp_rsa_private_key_t *this,
        {
                free(digestInfo.ptr);
                DBG1(DBG_LIB, "unable to sign %d bytes using a %dbit key", data.len,
-                        this->k * 8);
+                        mpz_sizeinbase(this->n, 2));
                return FALSE;
        }
 
@@ -356,10 +356,10 @@ end:
        return success;
 }
 
-METHOD(private_key_t, get_keysize, size_t,
+METHOD(private_key_t, get_keysize, int,
        private_gmp_rsa_private_key_t *this)
 {
-       return this->k;
+       return mpz_sizeinbase(this->n, 2);
 }
 
 METHOD(private_key_t, get_public_key, public_key_t*,

diff --git a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
index 762238f49c66f4377d130bdb6c1af5b9b7c93678..4beeaa51c4243771fbf34898dc57e3146f09a90e 100644 (file)
--- a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
+++ b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
@@ -375,10 +375,10 @@ METHOD(public_key_t, encrypt_, bool,
        return TRUE;
 }
 
-METHOD(public_key_t, get_keysize, size_t,
+METHOD(public_key_t, get_keysize, int,
        private_gmp_rsa_public_key_t *this)
 {
-       return this->k;
+       return mpz_sizeinbase(this->n, 2);
 }
 
 METHOD(public_key_t, get_encoding, bool,

diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c b/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c
index ffd9ac62ea5ce1f464b40835035be639acc3395d..15b0f577bebd6a1d0f4824b43579a8fd380ff5f6 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c
+++ b/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c
@@ -178,10 +178,20 @@ METHOD(private_key_t, decrypt, bool,
        return FALSE;
 }
 
-METHOD(private_key_t, get_keysize, size_t,
+METHOD(private_key_t, get_keysize, int,
        private_openssl_ec_private_key_t *this)
 {
-       return EC_FIELD_ELEMENT_LEN(EC_KEY_get0_group(this->ec));
+       switch (EC_GROUP_get_curve_name(EC_KEY_get0_group(this->ec)))
+       {
+               case NID_X9_62_prime256v1:
+                       return 256;
+               case NID_secp384r1:
+                       return 384;
+               case NID_secp521r1:
+                       return 521;
+               default:
+                       return 0;
+       }
 }
 
 METHOD(private_key_t, get_type, key_type_t,

diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c b/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c
index 16257178d54f85bcdc48d64de2ada49f4492f7fa..f680749a369bab637990e4dd79e6173e63636931 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c
+++ b/src/libstrongswan/plugins/openssl/openssl_ec_public_key.c
@@ -176,10 +176,20 @@ METHOD(public_key_t, encrypt, bool,
        return FALSE;
 }
 
-METHOD(public_key_t, get_keysize, size_t,
+METHOD(public_key_t, get_keysize, int,
        private_openssl_ec_public_key_t *this)
 {
-       return EC_FIELD_ELEMENT_LEN(EC_KEY_get0_group(this->ec));
+       switch (EC_GROUP_get_curve_name(EC_KEY_get0_group(this->ec)))
+       {
+               case NID_X9_62_prime256v1:
+                       return 256;
+               case NID_secp384r1:
+                       return 384;
+               case NID_secp521r1:
+                       return 521;
+               default:
+                       return 0;
+       }
 }
 
 /**

diff --git a/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c b/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c
index 291acb0c3047d0cc6799b039a003a7cb5549eeb8..dbf990e8184fd69e5e7ffc99e279459e12cc1e4a 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c
+++ b/src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c
@@ -173,10 +173,10 @@ METHOD(private_key_t, decrypt, bool,
        return FALSE;
 }
 
-METHOD(private_key_t, get_keysize, size_t,
+METHOD(private_key_t, get_keysize, int,
        private_openssl_rsa_private_key_t *this)
 {
-       return RSA_size(this->rsa);
+       return RSA_size(this->rsa) * 8;
 }
 
 METHOD(private_key_t, get_public_key, public_key_t*,

diff --git a/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c b/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
index e3ce66db51725460676029155fd5cef241886d8c..80a57105856580a88a190b6075ec1f20114effcf 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
+++ b/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c
@@ -155,10 +155,10 @@ METHOD(public_key_t, encrypt, bool,
        return FALSE;
 }
 
-METHOD(public_key_t, get_keysize, size_t,
+METHOD(public_key_t, get_keysize, int,
        private_openssl_rsa_public_key_t *this)
 {
-       return RSA_size(this->rsa);
+       return RSA_size(this->rsa) * 8;
 }
 
 /**

diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c b/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
index 87ef89e003d7c2de3269055f7dfcafeec3f70d41..52a9e09c2b9308628685136222edeb0b4fbc3971 100644 (file)
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
@@ -80,7 +80,7 @@ METHOD(private_key_t, get_type, key_type_t,
        return this->pubkey->get_type(this->pubkey);
 }
 
-METHOD(private_key_t, get_keysize, size_t,
+METHOD(private_key_t, get_keysize, int,
        private_pkcs11_private_key_t *this)
 {
        return this->pubkey->get_keysize(this->pubkey);
@@ -178,7 +178,7 @@ METHOD(private_key_t, sign, bool,
                DBG1(DBG_LIB, "C_SignInit() failed: %N", ck_rv_names, rv);
                return FALSE;
        }
-       len = get_keysize(this);
+       len = (get_keysize(this) + 7) / 8;
        buf = malloc(len);
        rv = this->lib->f->C_Sign(this->session, data.ptr, data.len, buf, &len);
        this->mutex->unlock(this->mutex);

diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c b/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
index 468c2bb27602a83b711bcde236d8f6c7f1214ab2..affd8cafc3268048d704b21e6b4e6232497e47ad 100644 (file)
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
@@ -125,10 +125,10 @@ METHOD(public_key_t, encrypt, bool,
        return FALSE;
 }
 
-METHOD(public_key_t, get_keysize, size_t,
+METHOD(public_key_t, get_keysize, int,
        private_pkcs11_public_key_t *this)
 {
-       return this->k;
+       return this->k * 8;
 }
 
 /**

diff --git a/src/pki/commands/print.c b/src/pki/commands/print.c
index 6d5462783a3700c81abd89cdb0a0a5f355be3878..1f449de4ea2bb333bd05cfb0d4d2daee520b2637 100644 (file)
--- a/src/pki/commands/print.c
+++ b/src/pki/commands/print.c
@@ -29,7 +29,7 @@ static void print_pubkey(public_key_t *key)
        chunk_t chunk;
 
        printf("pubkey:    %N %d bits\n", key_type_names, key->get_type(key),
-                  key->get_keysize(key) * 8);
+                  key->get_keysize(key));
        if (key->get_fingerprint(key, KEYID_PUBKEY_INFO_SHA1, &chunk))
        {
                printf("keyid:     %#B\n", &chunk);

diff --git a/src/pluto/certs.c b/src/pluto/certs.c
index 414f2430a82fc4450102d3ec5a013cb78a0290b7..a9179c4492388ee3c129d01f90d8837857a280fa 100644 (file)
--- a/src/pluto/certs.c
+++ b/src/pluto/certs.c
@@ -232,7 +232,7 @@ void list_pgp_end_certs(bool utc)
 
                                whack_log(RC_COMMENT, "  pubkey:    %N %4d bits%s",
                                                key_type_names, key->get_type(key),
-                                               key->get_keysize(key) * BITS_PER_BYTE,
+                                               key->get_keysize(key),
                                                has_private_key(cert)? ", has private key" : "");
                                if (key->get_fingerprint(key, KEYID_PUBKEY_INFO_SHA1, &keyid))
                                {

diff --git a/src/pluto/ike_alg.c b/src/pluto/ike_alg.c
index 7521dd33bd9bfc39d9b794ec3eee31eeeaa3c10f..08353907e75f43deb9110100fb442fad93991d69 100644 (file)
--- a/src/pluto/ike_alg.c
+++ b/src/pluto/ike_alg.c
@@ -194,18 +194,16 @@ struct db_context *ike_alg_db_new(connection_t *c, lset_t policy)
 
                if (policy & POLICY_PUBKEY)
                {
-                       int auth_method = 0;
-                       size_t key_size = 0;
+                       int auth_method = 0, key_size = 0;
                        key_type_t key_type = KEY_ANY;
 
-
                        if (c->spd.this.cert)
                        {
                                certificate_t *certificate = c->spd.this.cert->cert;
                                public_key_t *key = certificate->get_public_key(certificate);
 
                                if (key == NULL)
-                               {                               
+                               {
                                        plog("ike alg: unable to retrieve my public key");
                                        continue;
                                }
@@ -233,13 +231,13 @@ struct db_context *ike_alg_db_new(connection_t *c, lset_t policy)
                                case KEY_ECDSA:
                                        switch (key_size)
                                        {
-                                               case 32:
+                                               case 256:
                                                        auth_method = OAKLEY_ECDSA_256;
                                                        break;
-                                               case 48:
+                                               case 384:
                                                        auth_method = OAKLEY_ECDSA_384;
                                                        break;
-                                               case 66:
+                                               case 521:
                                                        auth_method = OAKLEY_ECDSA_521;
                                                        break;
                                                default:

diff --git a/src/pluto/keys.c b/src/pluto/keys.c
index 12a3ccfc97d8f0d7dec8f976c48c83fc7ab9a9a4..a79c2c0d2314817c64b88f4374fafa6c62574e4b 100644 (file)
--- a/src/pluto/keys.c
+++ b/src/pluto/keys.c
@@ -1449,7 +1449,7 @@ void list_public_keys(bool utc)
                whack_log(RC_COMMENT, "  identity: '%Y'", key->id);
                whack_log(RC_COMMENT, "  pubkey:    %N %4d bits, until %T %s",
                        key_type_names, public->get_type(public),
-                       public->get_keysize(public) * BITS_PER_BYTE,
+                       public->get_keysize(public),
                        &key->until_time, utc,
                        check_expiry(key->until_time, PUBKEY_WARNING_INTERVAL, TRUE));
                if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid))

diff --git a/src/pluto/x509.c b/src/pluto/x509.c
index 2b86812463e01c374cd5a677305801797525875a..d717beb15ba80be089312f8a62ce5f37149e0b2e 100644 (file)
--- a/src/pluto/x509.c
+++ b/src/pluto/x509.c
@@ -427,7 +427,7 @@ void list_x509cert_chain(const char *caption, cert_t* cert,
                        {
                                whack_log(RC_COMMENT, "  pubkey:    %N %4d bits%s",
                                        key_type_names, key->get_type(key),
-                                       key->get_keysize(key) * BITS_PER_BYTE,
+                                       key->get_keysize(key),
                                        cert->smartcard ? ", on smartcard" :
                                        (has_private_key(cert)? ", has private key" : ""));
 

diff --git a/src/scepclient/scepclient.c b/src/scepclient/scepclient.c
index b7d029f2d149f4c6104b0ce6900605814988cbae..448854acd25b2192e7ba7f68a66673b05e1afd20 100644 (file)
--- a/src/scepclient/scepclient.c
+++ b/src/scepclient/scepclient.c
@@ -807,7 +807,7 @@ int main(int argc, char **argv)
        public_key = private_key->get_public_key(private_key);
 
        /* check for minimum key length */
-       if (private_key->get_keysize(private_key) < RSA_MIN_OCTETS)
+       if (private_key->get_keysize(private_key) < RSA_MIN_OCTETS / BITS_PER_BYTE)
        {
                exit_scepclient("length of RSA key has to be at least %d bits"
                        ,RSA_MIN_OCTETS * BITS_PER_BYTE);