openbsd/src/lib/libssl/ssl_sigalgs.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-05-09T16:52:15+00:00 Forcibly ensure that only PSS may be used with RSA in TLS 1.3. 2020-05-09T16:52:15+00:00 beck 2020-05-09T16:52:15+00:00 urn:sha1:b60935caafce85d413353f003f520d0bd0abad6b This prevents us from incorrectly choosing a PKCS1 based signature if the client advertises support for them but also prefers them to PSS such as appears to be the case with gnuTLS. ok jsing@ Correct subtle bug in sigalgs, only care about curve_nid if we are 2019-04-01T02:09:21+00:00 beck 2019-04-01T02:09:21+00:00 urn:sha1:5c3b06261b92569c576cf596d4ef856d59cd4cfd checking the curve. ok jsing@ tb@ Strip out all of the pkey to sigalg and sigalg to pkey linkages. 2019-03-25T17:33:26+00:00 jsing 2019-03-25T17:33:26+00:00 urn:sha1:97b045dbcc34049cb190d3b235aaed0155c5e995 These are no longer used now that we defer signature algorithm selection. ok beck@ Defer sigalgs selection until the certificate is known. 2019-03-25T17:21:18+00:00 jsing 2019-03-25T17:21:18+00:00 urn:sha1:c46928243f6c8aa22e46219e22df33de006a501f Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@. Avoid an internal 2 byte overread in ssl_sigalgs(). 2019-03-19T16:56:04+00:00 jsing 2019-03-19T16:56:04+00:00 urn:sha1:1517415bce5f040c30f534901ec426684cfa80a4 Found by oss-fuzz, fixes issue #13797. ok beck@ tb@ Remove SHA224 based sigalgs from use in TLS 1.2 as SHA224 is deprecated. 2019-01-24T00:07:58+00:00 beck 2019-01-24T00:07:58+00:00 urn:sha1:0c4d3f4e4b1febe6578a3147f00c5604cbbba167 Remove GOST based sigalgs from TLS 1.2 since they don't work with TLS 1.2. ok jsing@ Correct ECDSA_SECP512R1 typo to ECDSA_SECP521R1 2019-01-23T23:47:13+00:00 beck 2019-01-23T23:47:13+00:00 urn:sha1:0a4b909395f2a5effee0b6326c75021b6d4a9968 spotted by naddy@ Modify sigalgs extension processing to accomodate TLS 1.3. 2019-01-23T18:39:28+00:00 beck 2019-01-23T18:39:28+00:00 urn:sha1:5b044ab96482aee07d5182930013d4e606d4740d - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2. - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 from a 1.3 handshake. ok jsing@ tb@ revert previous, accidentally contained another diff in addition 2019-01-23T18:24:40+00:00 beck 2019-01-23T18:24:40+00:00 urn:sha1:9a6a5e403c8b66eb5bbc3532a5f1b5e325b172c1 to the one I intended to commit Modify sigalgs extension processing for TLS 1.3. 2019-01-23T16:46:04+00:00 beck 2019-01-23T16:46:04+00:00 urn:sha1:eb8cfbe6972b8b99de20acf4ed8e9b7ffc9b22df - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@