Provider currency updates #125
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Refactor the code to make it easier to enhance and to read. Signed-off-by: Ingo Franzki <[email protected]>
Tolerate the use of deterministic signatures (OSSL_SIGNATURE_PARAM_NONCE_TYPE set to a non-zero value), but use the fallback provider for calculating a deterministic signature. Signed-off-by: Ingo Franzki <[email protected]>
Perform a deterministic signature with IBMCA and the default provider using the same key, and compare the resulting signatures. Signed-off-by: Ingo Franzki <[email protected]>
…provider Tolerate the use of DKHEM-IKM EC key generation (OSSL_PKEY_PARAM_DHKEM_IKM set to a non-empty buffer), but use the fallback provider for generating the EC key. Signed-off-by: Ingo Franzki <[email protected]>
Use the DHKEM-IKM option with EC keygen with the IBMCA provider and the default provider and compare the generated keys, they must be equal. This only works for P-256, P-384, and P-521 curves. Signed-off-by: Ingo Franzki <[email protected]>
jschmidb
reviewed
Mar 6, 2025
jschmidb
reviewed
Mar 6, 2025
jschmidb
reviewed
Mar 6, 2025
jschmidb
reviewed
Mar 6, 2025
Add support for the new EVP_PKEY_sign_message_xxx() and EVP_PKEY_verify_message_xxx() API with combined digest and sign algorithms such as 'ECDSA-SHAxxx'. This new API was added with OpenSSL 3.4.0 and requires changes in the providers to support it. Signed-off-by: Ingo Franzki <[email protected]>
Add support for the new EVP_PKEY_sign_message_xxx() and EVP_PKEY_verify_message_xxx() API with combined digest and sign algorithms such as 'RSA-SHAxxx'. Note that RSA-PSS is not supported by this API. This new API was added with OpenSSL 3.4.0 and requires changes in the providers to support it. Signed-off-by: Ingo Franzki <[email protected]>
Add tests to perform the new EVP_PKEY_sign_message_xxx() and EVP_PKEY_verify_message_xxx() API with combined digest and sign algorithms such as 'ECDSA-SHAxxx' or 'RSA-SHAxxx'. Signed-off-by: Ingo Franzki <[email protected]>
Check if the selected digest is an XOF digest and fail if so. Signed-off-by: Ingo Franzki <[email protected]>
... for easy enabling of the sanitizer for a build. Signed-off-by: Ingo Franzki <[email protected]>
p_ibmca.c:882:9: warning: '__builtin_strncpy' specified bound 4096 equals
destination size [-Wstringop-truncation]
882 | strncpy(prov_name, provctx->name, sizeof(prov_name));
| ^
Signed-off-by: Ingo Franzki <[email protected]>
Signed-off-by: Ingo Franzki <[email protected]>
jschmidb
approved these changes
Mar 6, 2025
When importing a private RSA key from params, allow that only private CRT key components OSSL_PARAM_RSA_FACTOR1, OSSL_PARAM_RSA_FACTOR2, as well as the public key components OSSL_PARAM_RSA_N and OSSL_PKEY_PARAM_RSA_E are available in the params, when also OSSL_PKEY_PARAM_RSA_DERIVE_FROM_PQ with a nonzero value is contained. In this case the other CRT components are calculated to form a complete CRT key. OSSL_PKEY_PARAM_RSA_DERIVE_FROM_PQ is available since OpenSSL 3.3. Signed-off-by: Ingo Franzki <[email protected]>
…OM_PQ Add tests to perform an export of an RSA key to params, and then import the params but only with OSSL_PARAM_RSA_FACTOR1, OSSL_PARAM_RSA_FACTOR2, OSSL_PARAM_RSA_N and OSSL_PKEY_PARAM_RSA_E, and with param OSSL_PKEY_PARAM_RSA_DERIVE_FROM_PQ set to 1. The resulting key is expected to be equal to the original key. Signed-off-by: Ingo Franzki <[email protected]>
ifranzki
force-pushed
the
provider-currency-updates
branch
from
48f1340 to
6b4af03
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes: #119
Closes: #114