Cache sha512 hash and parsed not_before and not_after with X509 cert.

Replace sha1 hash use with sha512 for certificate comparisons internal
to the library. use the cached sha512 for the validator's verification
cache.

Reduces our recomputation of hashes, and heavy use of time1 time
conversion functions noticed bu claudio@ in rpki client.

ok jsing@ tb@

2 files changed, 14 insertions, 7 deletions

diff --git a/src/lib/libcrypto/ts/ts_rsp_sign.c b/src/lib/libcrypto/ts/ts_rsp_sign.c
index 828407aa4b..cbd7039abe 100644
--- a/src/lib/libcrypto/ts/ts_rsp_sign.c
+++ b/src/lib/libcrypto/ts/ts_rsp_sign.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts_rsp_sign.c,v 1.24 2021/11/01 20:53:08 tb Exp $ */
+/* $OpenBSD: ts_rsp_sign.c,v 1.25 2021/11/04 23:52:34 beck Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -849,14 +849,18 @@ ESS_CERT_ID_new_init(X509 *cert, int issuer_needed)
 {
         ESS_CERT_ID *cid = NULL;
         GENERAL_NAME *name = NULL;
+        unsigned char cert_hash[TS_HASH_LEN];
 
         /* Recompute SHA1 hash of certificate if necessary (side effect). */
         X509_check_purpose(cert, -1, 0);
 
         if (!(cid = ESS_CERT_ID_new()))
                 goto err;
-        if (!ASN1_OCTET_STRING_set(cid->hash, cert->sha1_hash,
-            sizeof(cert->sha1_hash)))
+
+        if (!X509_digest(cert, TS_HASH_EVP, cert_hash, NULL))
+                goto err;
+
+        if (!ASN1_OCTET_STRING_set(cid->hash, cert_hash, sizeof(cert_hash)))
                 goto err;
 
         /* Setting the issuer/serial if requested. */
diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c
index 2e72ff47ae..07578945cb 100644
--- a/src/lib/libcrypto/ts/ts_rsp_verify.c
+++ b/src/lib/libcrypto/ts/ts_rsp_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ts_rsp_verify.c,v 1.22 2021/11/01 20:53:08 tb Exp $ */
+/* $OpenBSD: ts_rsp_verify.c,v 1.23 2021/11/04 23:52:34 beck Exp $ */
 /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL
  * project 2002.
  */
@@ -325,10 +325,14 @@ static int
 TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
 {
         int i;
+        unsigned char cert_hash[TS_HASH_LEN];
 
         if (!cert_ids || !cert)
                 return -1;
 
+        if (!X509_digest(cert, TS_HASH_EVP, cert_hash, NULL))
+                return -1;
+
         /* Recompute SHA1 hash of certificate if necessary (side effect). */
         X509_check_purpose(cert, -1, 0);
 
@@ -337,9 +341,8 @@ TS_find_cert(STACK_OF(ESS_CERT_ID) *cert_ids, X509 *cert)
                 ESS_CERT_ID *cid = sk_ESS_CERT_ID_value(cert_ids, i);
 
                 /* Check the SHA-1 hash first. */
-                if (cid->hash->length == sizeof(cert->sha1_hash) &&
-                    !memcmp(cid->hash->data, cert->sha1_hash,
-                        sizeof(cert->sha1_hash))) {
+                if (cid->hash->length == TS_HASH_LEN && !memcmp(cid->hash->data,
+                    cert_hash, TS_HASH_LEN)) {
                         /* Check the issuer/serial as well if specified. */
                         ESS_ISSUER_SERIAL *is = cid->issuer_serial;
                         if (!is || !TS_issuer_serial_cmp(is, cert->cert_info))