kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libseckey: RSA cipher: Tolerate "implicit rejection" option

Browse Source 
With parameter OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION one can enable or
disable the implicit rejection mechanism for RSA PKCS#1 v1.5 decryption.
For the default provider, this is enabled by default.

We do not support implicit rejection so far, so disable it for the
default provider operation context when the key contains an RSA secure key,
and reject to set it to anything else then 0 (disabled).

See OpenSSL commit 5ab3ec1bb1

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2023-01-09 13:28:56 +01:00
committed by Steffen Eiden
parent 1fb05038cd
commit 8709a47f6f
1 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
libseckey/sk_provider.c
View File

@@ -877,6 +877,20 @@ static int sk_prov_asym_op_set_ctx_params(void *vctx, const OSSL_PARAM params[])
for (p = params; p != NULL && p->key != NULL; p++)
sk_debug_op_ctx(ctx, "param: %s", p->key);
#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
/* OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION is for RSA decrypt only */
if (!sk_prov_check_uint_param(params,
OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
ctx->key, EVP_PKEY_RSA, 0) ||
!sk_prov_check_uint_param(params,
OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
ctx->key, EVP_PKEY_RSA_PSS, 0)) {
put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
"Implicit rejection is not supported");
return 0;
}
#endif
default_set_params_fn = (OSSL_FUNC_asym_cipher_set_ctx_params_fn *)
sk_prov_get_default_asym_func(ctx->provctx,
ctx->type,
@@ -1152,6 +1166,14 @@ static int sk_prov_asym_op_decrypt_init(void *vctx, void *vkey,
struct sk_prov_op_ctx *ctx = vctx;
struct sk_prov_key *key = vkey;
const OSSL_PARAM *p;
#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
unsigned int implicit_rejection = 0;
OSSL_PARAM set_params[] = {
OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
&implicit_rejection),
OSSL_PARAM_END
};
#endif
if (ctx == NULL || key == NULL)
return 0;
@@ -1160,6 +1182,20 @@ static int sk_prov_asym_op_decrypt_init(void *vctx, void *vkey,
for (p = params; p != NULL && p->key != NULL; p++)
sk_debug_op_ctx(ctx, "param: %s", p->key);
#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
/* OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION is for RSA decrypt only */
if (!sk_prov_check_uint_param(params,
OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
key, EVP_PKEY_RSA, 0) ||
!sk_prov_check_uint_param(params,
OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION,
key, EVP_PKEY_RSA_PSS, 0)) {
put_error_op_ctx(ctx, SK_PROV_ERR_INVALID_PARAM,
"Implicit rejection is not supported");
return 0;
}
#endif
default_decrypt_init_fn = (OSSL_FUNC_asym_cipher_decrypt_init_fn *)
sk_prov_get_default_asym_func(ctx->provctx,
ctx->type,
@@ -1182,6 +1218,26 @@ static int sk_prov_asym_op_decrypt_init(void *vctx, void *vkey,
return 0;
}
#ifdef OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION
if ((key->type == EVP_PKEY_RSA || key->type == EVP_PKEY_RSA_PSS) &&
key->secure_key != NULL) {
/*
* By default, implicit rejection is enabled for the default
* provider. We currently do not support implicit rejection with
* secure keys, so disable implicit rejection in the default
* provider operation context to report its status correctly
* with get-params.
*/
implicit_rejection = 0;
if (!sk_prov_asym_op_set_ctx_params(ctx, set_params)) {
sk_debug_op_ctx(ctx,
"ERROR: sk_prov_asym_op_set_ctx_params "
"failed");
return 0;
}
}
#endif
return 1;
}