openbsd/src/lib/libcrypto/ec/ec_ameth.c, branch OPENBSD_7_9_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE 2025-05-10T05:54:39+00:00 Use err_local.h rather than err.h in most places 2025-05-10T05:54:39+00:00 tb 2025-05-10T05:54:39+00:00 urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709 ok jsing Unify checking for the asn1_flag 2024-11-25T06:51:39+00:00 tb 2024-11-25T06:51:39+00:00 urn:sha1:9b6f67fd1d0975062609168d617e567a8304ed32 There are only two flag values that libcrypto understands and the default value is 1 while, helpfully, the undesirable non-default is 0. The few existing callers set OPENSSL_EC_NAMED_CURVE or OPENSSL_EC_EXPLICIT_CURVE. Nevertheless, the flag should be checked properly as a flag. The recent upstream checks for EC_GROUP_get_asn1_flag(group) == OPENSSL_EC_NAMED_CURVE don't look right either... ok jsing eckey_compute_pubkey: don't leak the public key 2024-10-29T06:36:58+00:00 tb 2024-10-29T06:36:58+00:00 urn:sha1:ce051cb967424d433f6c495f7c82b2a7204e2d4f EC_KEY_set_public_key() sets a copy, so it doesn't take ownership and hence pub_key must not be nulled out on success. Expose eckey_compute_key() from ec_ameth 2024-10-28T18:01:26+00:00 tb 2024-10-28T18:01:26+00:00 urn:sha1:b489a32343150e531040adb95107a40c69ce9efb This helper will be needed in a subsequent commit. ok jsing ec_ameth.c: fix includes 2024-10-20T10:52:51+00:00 tb 2024-10-20T10:52:51+00:00 urn:sha1:efdb6f7e22332e0438a61f112354aa06dc496bfb Remove the pkey_{,public_,param_}check() handlers 2024-08-29T16:58:19+00:00 tb 2024-08-29T16:58:19+00:00 urn:sha1:c8099c070f0c547b73edced83591dbd871254307 This disables the EVP_PKEY_*check() API and makes it fail (more precisely indicate lack of support) on all key types. This is an intermediate step to full removal. Removal is ok beck jsing Add missing EC_KEY_free() 2024-05-10T05:12:03+00:00 tb 2024-05-10T05:12:03+00:00 urn:sha1:0b6a85a0fa59314578a32fdc7ed1ad4250998851 While eckey_from_explicit_params() frees *out_eckey, eckey_from_object() and eckey_from_params() do not. These functions are currently all callled with a NULL *out_eckey, but the latter two would leak if that should ever change. ok jsing Add some more comments explaining shortcomings of the API 2024-04-18T11:56:53+00:00 tb 2024-04-18T11:56:53+00:00 urn:sha1:dfe495c9ba1a4cf327106407e1213e6346b604a1 The case in point is the incompatibility of the very ergonomic X509_ALGOR API with the RC2-derived API massacre that is EVP_CIPHER_asn1_to_param() and its "inverse". ok jsing Use X509_ALGOR_get0() in ecdh_cms_set_shared_info() 2024-04-18T11:53:40+00:00 tb 2024-04-18T11:53:40+00:00 urn:sha1:831605466ffc29afdd0439e9af769512ad3f4129 This makes things slightly less gross since it involves less reaching into nested ASN.1 structures. But don't get the idea that this means the code is now clean. ok jsing Test and assign in ecdh_cms_set_shared_info() 2024-04-18T11:51:53+00:00 tb 2024-04-18T11:51:53+00:00 urn:sha1:3463149ba7c950bf3c6157f6e5353eb637cdca49 ok jsing