openbsd/src/lib/libcrypto/cms/cms_sd.c, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92025-07-31T02:24:21+00:00Rework PKCS7_simple_smimecap()2025-07-31T02:24:21+00:00tb2025-07-31T02:24:21+00:00urn:sha1:939b14b31a0ec57a91982f54dd055e000bf5f6ac
This is nearly identical to CMS_add_simple_smimecap(). We can reuse
its doc comment mutatis mutandis and use the same construction.
Maybe this wants deduplicating. Maybe not.
ok kenjiro
Inline cms_add1_signingTime() in its only consumer2025-07-27T07:16:20+00:00tb2025-07-27T07:16:20+00:00urn:sha1:c8c2f886f887bd8387f9dee0bdf4c876658d2833
Why have seven lines if you can have 30...
tweak/ok kenjiro
Use err_local.h rather than err.h in most places2025-05-10T05:54:39+00:00tb2025-05-10T05:54:39+00:00urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709
ok jsing
Remove more unnecessary GOST code2024-04-20T10:11:55+00:00tb2024-04-20T10:11:55+00:00urn:sha1:dbc91b02b46414edaa98f5ae533bc4c44c5b6ef7
ok jsing
Rework CMS_add_simple_smimecap()2024-04-07T06:34:42+00:00tb2024-04-07T06:34:42+00:00urn:sha1:483b41efefd82d053ce8da00bd0d02f21616e651
This is an API to add an OID attribute to the set of SMIMECapabilities.
While attributes are complicated in general, this only supports simple
capabilities encoded as an OID with an optional integer parameter (e.g.,
the key size of a cipher).
Make this API transactional, i.e., don't leave a new empty set behind on
failure or leak the key size if setting the parameter on the X509_ALGOR
fails.
Also convert to single exit and add a doc comment with a reference.
ok beck
Implement Ed25519 signatures for CMS (RFC 8419)2024-03-29T06:41:58+00:00tb2024-03-29T06:41:58+00:00urn:sha1:207bd9bb06ecc406c0e992892c96391e5f299077
This adds support for Edwards curve digital signature algorithms in the
cryptographic message syntax, as specified in RFC 8419. Only Ed25519 is
supported since that is the only EdDSA algorithm that LibreSSL supports
(this is unlikely to change ever, but, as they say - never is a very
long time).
This has the usual curly interactions between EVP and CMS with poorly
documented interfaces and lots of confusing magic return values and
controls. This improves upon existing control handlers by documenting
what is being done and why. Unlike other (draft) implementations we
also happen to use the correct hashing algorithm.
There are no plans to implement RFC 8418.
joint work with job at p2k23
ok jsing
Ignore EVP_MD_CTX_reset() return value2024-02-02T14:13:11+00:00tb2024-02-02T14:13:11+00:00urn:sha1:596318a93b385d8ceac9fe58bdc42976e748c110
Also drop now unnecessary NULL checks before it.
Use X509_ALGOR_set_evp_md() in CMS_add1_signer()2023-10-18T07:30:49+00:00tb2023-10-18T07:30:49+00:00urn:sha1:8e27400f3be8740bb959238b66aa047cb43bfd4a
Contrary to X509_ALGOR_set_md() this allows for error checking. Avoid
local complications by freeing in the exit path and use a const version
of X509_ALGOR for walking a STACK_OF() to avoid a bad free.
Clean up includes
ok jsing
Small cleanups in cms_sd_asn1_ctrl():2023-09-11T09:29:30+00:00tb2023-09-11T09:29:30+00:00urn:sha1:7b9ac939ddc743eb500e57c6326c5f8fde2eda31
Compare explicitly against NULL and use ret instead of i.
Rewrite CMS_SignerInfo_{sign,verify}()2023-09-11T09:24:14+00:00tb2023-09-11T09:24:14+00:00urn:sha1:a85fbcce5ef459e11c27d544f9823aee7b0c441d
Convert to using one-shot signing and verification. This is simpler than
doing Init/Update/Final and necessary for Ed25519 support (RFC 8419). Use
a single exit idiom, don't reuse the same buffer for decoding and signing
and simplify a few other things.
ok jsing