Commit ee1d9ec0 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Remove link between digests and signature algorithms. 

Use cross reference table in ASN1_item_sign(), ASN1_item_verify() to eliminate
the need for algorithm specific code.
parent 614b448a

CHANGES

+6 −0
Original line number Diff line number Diff line
@@ -4,6 +4,12 @@ 


 Changes between 0.9.8a and 0.9.9  [xx XXX xxxx]



  *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 

     EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant

     signing method from the key type. This effectively removes the link

     between digests and public key types.

     [Steve Henson]



  *) Add an OID cross reference table and utility functions. Its purpose is to

     translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,

     rsaEncryption. This will allow some of the algorithm specific hackery

apps/ca.c

+2 −0
Original line number Diff line number Diff line
@@ -1412,6 +1412,7 @@ bad: 


		/* we now have a CRL */

		if (verbose) BIO_printf(bio_err,"signing CRL\n");

#if 0

#ifndef OPENSSL_NO_DSA

		if (pkey->type == EVP_PKEY_DSA) 

			dgst=EVP_dss1();
@@ -1420,6 +1421,7 @@ bad: 
#ifndef OPENSSL_NO_ECDSA

		if (pkey->type == EVP_PKEY_EC)

			dgst=EVP_ecdsa();

#endif

#endif



		/* Add any extensions asked for */

apps/req.c

+2 −0
Original line number Diff line number Diff line
@@ -894,6 +894,7 @@ loop: 
			BIO_printf(bio_err,"you need to specify a private key\n");

			goto end;

			}

#if 0

#ifndef OPENSSL_NO_DSA

		if (pkey->type == EVP_PKEY_DSA)

			digest=EVP_dss1();
@@ -901,6 +902,7 @@ loop: 
#ifndef OPENSSL_NO_ECDSA

		if (pkey->type == EVP_PKEY_EC)

			digest=EVP_ecdsa();

#endif

#endif

		if (req == NULL)

			{

apps/x509.c

+2 −0
Original line number Diff line number Diff line
@@ -912,6 +912,7 @@ bad: 
						passin, e, "Private key");

					if (Upkey == NULL) goto end;

					}

#if 0

#ifndef OPENSSL_NO_DSA

		                if (Upkey->type == EVP_PKEY_DSA)

		                        digest=EVP_dss1();
@@ -919,6 +920,7 @@ bad: 
#ifndef OPENSSL_NO_ECDSA

				if (Upkey->type == EVP_PKEY_EC)

					digest=EVP_ecdsa();

#endif

#endif



				assert(need_rand);

crypto/asn1/a_sign.c

+24 −34
Original line number Diff line number Diff line
@@ -123,6 +123,7 @@ 
#include <openssl/x509.h>

#include <openssl/objects.h>

#include <openssl/buffer.h>

#include "asn1_locl.h"



#ifndef NO_ASN1_OLD
@@ -218,45 +219,34 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2, 
	{

	EVP_MD_CTX ctx;

	unsigned char *buf_in=NULL,*buf_out=NULL;

	int i,inl=0,outl=0,outll=0;

	X509_ALGOR *a;

	int inl=0,outl=0,outll=0;

	int signid, paramtype;



	EVP_MD_CTX_init(&ctx);

	for (i=0; i<2; i++)

		{

		if (i == 0)

			a=algor1;

		else

			a=algor2;

		if (a == NULL) continue;

                if (type->pkey_type == NID_dsaWithSHA1 ||

			type->pkey_type == NID_ecdsa_with_SHA1)

			{

			/* special case: RFC 3279 tells us to omit 'parameters'

			 * with id-dsa-with-sha1 and ecdsa-with-SHA1 */

			ASN1_TYPE_free(a->parameter);

			a->parameter = NULL;

			}

		else if ((a->parameter == NULL) || 

			(a->parameter->type != V_ASN1_NULL))

			{

			ASN1_TYPE_free(a->parameter);

			if ((a->parameter=ASN1_TYPE_new()) == NULL) goto err;

			a->parameter->type=V_ASN1_NULL;

			}

		ASN1_OBJECT_free(a->algorithm);

		a->algorithm=OBJ_nid2obj(type->pkey_type);

		if (a->algorithm == NULL)

	if (type->flags & EVP_MD_FLAG_PKEY_METHOD_SIGNATURE)

		{

			ASN1err(ASN1_F_ASN1_ITEM_SIGN,ASN1_R_UNKNOWN_OBJECT_TYPE);

			goto err;

			}

		if (a->algorithm->length == 0)

		if (!pkey->ameth ||

			!OBJ_find_sigid_by_algs(&signid, EVP_MD_nid(type),

						pkey->ameth->pkey_id))

			{

			ASN1err(ASN1_F_ASN1_ITEM_SIGN,ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);

			goto err;

			ASN1err(ASN1_F_ASN1_ITEM_SIGN,

				ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);

			return 0;

			}

		}

	else

		signid = type->pkey_type;



	if (pkey->ameth->pkey_flags & ASN1_PKEY_SIGPARAM_NULL)

		paramtype = V_ASN1_NULL;

	else

		paramtype = V_ASN1_UNDEF;



	if (algor1)

		X509_ALGOR_set0(algor1, OBJ_nid2obj(signid), paramtype, NULL);

	if (algor2)

		X509_ALGOR_set0(algor2, OBJ_nid2obj(signid), paramtype, NULL);



	EVP_MD_CTX_init(&ctx);

	inl=ASN1_item_i2d(asn,&buf_in, it);

	outll=outl=EVP_PKEY_size(pkey);

	buf_out=(unsigned char *)OPENSSL_malloc((unsigned int)outl);