pkcs8: remove HAVE_LIBOQS ifdefs

The key encoding and decoding operations currently do not use liboqs
functions. Remove unnecessary HAVE_LIBOQS ifdefs so it will be easier
to port to other implementations.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
index d35269cd3d6f004065f6f3c75de8796c452d66b6..f213a43dcf1c74e5255bc98db986a5a187106661 100644 (file)
--- a/lib/crypto-backend.h
+++ b/lib/crypto-backend.h
@@ -278,9 +278,7 @@ void gnutls_pk_params_init(gnutls_pk_params_st *p);
 #define RSA_PRIVATE_PARAMS 8
 #define ECC_PRIVATE_PARAMS 3
 #define GOST_PRIVATE_PARAMS 3
-#ifdef HAVE_LIBOQS
 #define ML_DSA_PRIVATE_PARAMS 4
-#endif
 
 #if MAX_PRIV_PARAMS_SIZE - RSA_PRIVATE_PARAMS < 0
 #error INCREASE MAX_PRIV_PARAMS

diff --git a/lib/x509/key_decode.c b/lib/x509/key_decode.c
index 137a66917336813dcf0647f1cf38a0f1d8cf91d4..1cf3b0bb95066f1eff265ec6ba4eccf441dd6940 100644 (file)
--- a/lib/x509/key_decode.c
+++ b/lib/x509/key_decode.c
@@ -735,13 +735,11 @@ int _gnutls_x509_read_pubkey(gnutls_pk_algorithm_t algo, uint8_t *der,
                        params->params_nr = GOST_PUBLIC_PARAMS;
                }
                break;
-#ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLDSA44:
        case GNUTLS_PK_MLDSA65:
        case GNUTLS_PK_MLDSA87:
                ret = _gnutls_set_datum(&params->raw_pub, der, dersize);
                break;
-#endif
        default:
                ret = gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE);
                break;
@@ -839,11 +837,9 @@ int _gnutls_x509_check_pubkey_params(gnutls_pk_params_st *params)
        case GNUTLS_PK_GOST_01:
        case GNUTLS_PK_GOST_12_256:
        case GNUTLS_PK_GOST_12_512:
-#ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLDSA44:
        case GNUTLS_PK_MLDSA65:
        case GNUTLS_PK_MLDSA87:
-#endif
                return 0;
        default:
                return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE);

diff --git a/lib/x509/privkey.c b/lib/x509/privkey.c
index 7eddfb79310e13d5e565869fbf4f6b6243cbb2ed..6c7bf139dec081da44e2faa595a0630f32e2c3dd 100644 (file)
--- a/lib/x509/privkey.c
+++ b/lib/x509/privkey.c
@@ -36,9 +36,6 @@
 #include "ecc.h"
 #include "pin.h"
 
-#ifdef HAVE_LIBOQS
-#include <dlwrap/oqs.h>
-#endif
 /**
  * gnutls_x509_privkey_init:
  * @key: A pointer to the type to be initialized
@@ -531,9 +528,7 @@ error:
 #define PEM_KEY_DSA "DSA PRIVATE KEY"
 #define PEM_KEY_RSA "RSA PRIVATE KEY"
 #define PEM_KEY_ECC "EC PRIVATE KEY"
-#ifdef HAVE_LIBOQS
 #define PEM_KEY_ML_DSA "ML-DSA PRIVATE KEY"
-#endif
 #define PEM_KEY_PKCS8 "PRIVATE KEY"
 
 #define MAX_PEM_HEADER_SIZE 25
@@ -633,7 +628,6 @@ int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
                                        if (result >= 0)
                                                key->params.algo =
                                                        GNUTLS_PK_DSA;
-#ifdef HAVE_LIBOQS
                                } else if (left > sizeof(PEM_KEY_ML_DSA) &&
                                           memcmp(ptr, PEM_KEY_ML_DSA,
                                                  sizeof(PEM_KEY_ML_DSA) - 1) ==
@@ -645,7 +639,6 @@ int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
                                                key->params.algo =
                                                        GNUTLS_PK_MLDSA44;
                                        }
-#endif
                                }
 
                                if (key->params.algo == GNUTLS_PK_UNKNOWN &&
@@ -814,11 +807,7 @@ fail:
        return ret;
 }
 
-#ifdef HAVE_LIBOQS
 #define MAX_ALGORITHM_NAME_SIZE_IN_PEM_HEADER 21
-#else
-#define MAX_ALGORITHM_NAME_SIZE_IN_PEM_HEADER 15
-#endif
 
 /**
  * gnutls_x509_privkey_import2:
@@ -889,13 +878,10 @@ int gnutls_x509_privkey_import2(gnutls_x509_privkey_t key,
                                            sizeof(PEM_KEY_ECC) - 1) == 0) ||
                                    (left > sizeof(PEM_KEY_DSA) &&
                                     memcmp(ptr, PEM_KEY_DSA,
-                                           sizeof(PEM_KEY_DSA) - 1) == 0)
-#ifdef HAVE_LIBOQS
-                                   || (left > sizeof(PEM_KEY_ML_DSA) &&
-                                       memcmp(ptr, PEM_KEY_ML_DSA,
-                                              sizeof(PEM_KEY_ML_DSA) - 1) == 0)
-#endif
-                               ) {
+                                           sizeof(PEM_KEY_DSA) - 1) == 0) ||
+                                   (left > sizeof(PEM_KEY_ML_DSA) &&
+                                    memcmp(ptr, PEM_KEY_ML_DSA,
+                                           sizeof(PEM_KEY_ML_DSA) - 1) == 0)) {
                                        head_enc = 0;
                                }
                        }
@@ -1647,12 +1633,10 @@ static const char *set_msg(gnutls_x509_privkey_t key)
                return PEM_KEY_DSA;
        case GNUTLS_PK_EC:
                return PEM_KEY_ECC;
-#ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLDSA44:
        case GNUTLS_PK_MLDSA65:
        case GNUTLS_PK_MLDSA87:
                return PEM_KEY_ML_DSA;
-#endif
        default:
                return "UNKNOWN";
        }

diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c
index 41b99861808ba8aa76d9b3c9260d0eb989b5bfbc..f49014fa289360fc7e251d3905aa8971ecd3e7eb 100644 (file)
--- a/lib/x509/privkey_pkcs8.c
+++ b/lib/x509/privkey_pkcs8.c
@@ -39,10 +39,6 @@
 #include "attributes.h"
 #include "prov-seed.h"
 
-#ifdef HAVE_LIBOQS
-#include <dlwrap/oqs.h>
-#endif
-
 static int _decode_pkcs8_ecc_key(asn1_node pkcs8_asn,
                                 gnutls_x509_privkey_t pkey);
 static int pkcs8_key_info(const gnutls_datum_t *raw_key,
@@ -82,7 +78,6 @@ inline static int _encode_privkey(gnutls_x509_privkey_t pkey,
                if (ret < 0)
                        gnutls_assert();
                return ret;
-#ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLDSA44:
        case GNUTLS_PK_MLDSA65:
        case GNUTLS_PK_MLDSA87:
@@ -93,7 +88,6 @@ inline static int _encode_privkey(gnutls_x509_privkey_t pkey,
                if (ret < 0)
                        gnutls_assert();
                return ret;
-#endif
 
        case GNUTLS_PK_GOST_01:
        case GNUTLS_PK_GOST_12_256:
@@ -1470,58 +1464,29 @@ error:
        return ret;
 }
 
-#ifdef HAVE_LIBOQS
-struct pq_key_length_st {
-       gnutls_pk_algorithm_t algorithm;
-       int secret_key_length;
-       int public_key_length;
-};
-
-static const struct pq_key_length_st pq_key_lengths[] = {
-       { GNUTLS_PK_MLDSA44, OQS_SIG_ml_dsa_44_length_secret_key,
-         OQS_SIG_ml_dsa_44_length_public_key },
-       { GNUTLS_PK_MLDSA65, OQS_SIG_ml_dsa_65_length_secret_key,
-         OQS_SIG_ml_dsa_65_length_public_key },
-       { GNUTLS_PK_MLDSA87, OQS_SIG_ml_dsa_87_length_secret_key,
-         OQS_SIG_ml_dsa_87_length_public_key },
-
-       { GNUTLS_PK_UNKNOWN, 0, 0 }
-};
-
-static int _get_pqc_keys_length(const gnutls_pk_algorithm_t algo,
-                               int *pqc_alg_secret_key_length,
-                               int *pqc_alg_public_key_length)
-{
-       const struct pq_key_length_st *pqc_key_length = pq_key_lengths;
-       while (pqc_key_length->algorithm != algo &&
-              pqc_key_length->algorithm != GNUTLS_PK_UNKNOWN)
-               pqc_key_length++;
-
-       if (pqc_key_length->algorithm == GNUTLS_PK_UNKNOWN)
-               return GNUTLS_E_UNKNOWN_ALGORITHM;
-
-       *pqc_alg_secret_key_length = pqc_key_length->secret_key_length;
-       *pqc_alg_public_key_length = pqc_key_length->public_key_length;
-
-       return 0;
-}
-
-static int _decode_pkcs8_pqc_alg_key(asn1_node pkcs8_asn,
-                                    gnutls_x509_privkey_t pkey,
-                                    const char *oid)
+static int _decode_pkcs8_ml_dsa_key(asn1_node pkcs8_asn,
+                                   gnutls_x509_privkey_t pkey,
+                                   gnutls_pk_algorithm_t algo)
 {
        int ret;
-       gnutls_datum_t private_key;
-       gnutls_pk_algorithm_t algo = pkey->params.algo;
-       int pqc_alg_secret_key_length;
-       int pqc_alg_public_key_length;
-
-       ret = _get_pqc_keys_length(pkey->params.algo,
-                                  &pqc_alg_secret_key_length,
-                                  &pqc_alg_public_key_length);
-       if (ret < 0) {
-               gnutls_assert();
-               goto error;
+       size_t raw_pub_size, raw_priv_size;
+
+       switch (algo) {
+       case GNUTLS_PK_MLDSA44:
+               raw_priv_size = MLDSA44_PRIVKEY_SIZE;
+               raw_pub_size = MLDSA44_PUBKEY_SIZE;
+               break;
+       case GNUTLS_PK_MLDSA65:
+               raw_priv_size = MLDSA65_PRIVKEY_SIZE;
+               raw_pub_size = MLDSA65_PUBKEY_SIZE;
+               break;
+       case GNUTLS_PK_MLDSA87:
+               raw_priv_size = MLDSA87_PRIVKEY_SIZE;
+               raw_pub_size = MLDSA87_PUBKEY_SIZE;
+               break;
+       default:
+               return gnutls_assert_val(
+                       GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM);
        }
 
        /* TODO: support OneAsymmetricKey to read public key from a
@@ -1529,36 +1494,39 @@ static int _decode_pkcs8_pqc_alg_key(asn1_node pkcs8_asn,
         */
 
        gnutls_pk_params_init(&pkey->params);
+       pkey->params.algo = algo;
 
-       ret = _gnutls_x509_read_string(pkcs8_asn, "privateKey", &private_key,
+       ret = _gnutls_x509_read_string(pkcs8_asn, "privateKey",
+                                      &pkey->params.raw_priv,
                                       ASN1_ETYPE_OCTET_STRING, 1);
        if (ret < 0) {
                gnutls_assert();
                goto error;
        }
 
-       pkey->params.algo = algo;
-       pkey->params.raw_priv.data = private_key.data;
-       pkey->params.raw_priv.size = pqc_alg_secret_key_length;
+       if (pkey->params.raw_priv.size != raw_priv_size + raw_pub_size) {
+               ret = gnutls_assert_val(GNUTLS_E_ASN1_DER_ERROR);
+               goto error;
+       }
 
-       pkey->params.raw_pub.data = gnutls_malloc(pqc_alg_public_key_length);
-       memcpy(pkey->params.raw_pub.data,
-              &private_key.data[pqc_alg_secret_key_length],
-              pqc_alg_public_key_length);
-       pkey->params.raw_pub.size = pqc_alg_public_key_length;
+       ret = _gnutls_set_datum(&pkey->params.raw_pub,
+                               &pkey->params.raw_priv.data[raw_priv_size],
+                               raw_pub_size);
+       if (ret < 0) {
+               gnutls_assert();
+               goto error;
+       }
 
-       private_key.data = NULL;
+       pkey->params.raw_priv.size = raw_priv_size;
 
        return GNUTLS_E_SUCCESS;
 
 error:
-       gnutls_free(pkey->params.raw_priv.data);
        gnutls_pk_params_clear(&pkey->params);
        gnutls_pk_params_release(&pkey->params);
 
        return ret;
 }
-#endif
 
 static int decode_private_key_info(const gnutls_datum_t *der,
                                   gnutls_x509_privkey_t pkey)
@@ -1638,13 +1606,12 @@ static int decode_private_key_info(const gnutls_datum_t *der,
                result = _decode_pkcs8_gost_key(pkcs8_asn, pkey,
                                                pkey->params.algo);
                break;
-#ifdef HAVE_LIBOQS
        case GNUTLS_PK_MLDSA44:
        case GNUTLS_PK_MLDSA65:
        case GNUTLS_PK_MLDSA87:
-               result = _decode_pkcs8_pqc_alg_key(pkcs8_asn, pkey, oid);
+               result = _decode_pkcs8_ml_dsa_key(pkcs8_asn, pkey,
+                                                 pkey->params.algo);
                break;
-#endif
        default:
                result = gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE);
                goto error;