Clean up signature algorithm handling.

Now that we no longer support TLSv1.0 and TLSv1.1, SSL_USE_SIGALGS()
is always true - remove all of the code that handles the non-sigalgs
path, along with SSL_USE_SIGALGS() and the related flags.

Also remove SIGALG_RSA_PKCS1_MD5_SHA1 and references to it, since this
is also now unused.

ok kenjiro@ tb@

1 files changed, 38 insertions, 110 deletions

diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index af4b20f6ce..f9c4ef918a 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.168 2026/04/03 12:58:19 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.169 2026/05/31 14:34:44 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -568,33 +568,14 @@ ssl3_accept(SSL *s)
                         }
 
                         alg_k = s->s3->hs.cipher->algorithm_mkey;
-                        if (SSL_USE_SIGALGS(s)) {
-                                s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
-                                s->init_num = 0;
-                                if (!s->session->peer_cert)
-                                        break;
+                        s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
+                        s->init_num = 0;
+                        if (s->session->peer_cert != NULL) {
                                 /*
                                  * Freeze the transcript for use during client
                                  * certificate verification.
                                  */
                                 tls1_transcript_freeze(s);
-                        } else {
-                                s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
-                                s->init_num = 0;
-
-                                tls1_transcript_free(s);
-
-                                /*
-                                 * We need to get hashes here so if there is
-                                 * a client cert, it can be verified.
-                                 */
-                                if (!tls1_transcript_hash_value(s,
-                                    s->s3->hs.tls12.cert_verify,
-                                    sizeof(s->s3->hs.tls12.cert_verify),
-                                    NULL)) {
-                                        ret = -1;
-                                        goto end;
-                                }
                         }
                         break;
 
@@ -1142,7 +1123,7 @@ ssl3_get_client_hello(SSL *s)
         if (!tls1_transcript_hash_init(s))
                 goto err;
 
-        if (!SSL_USE_SIGALGS(s) || !(s->verify_mode & SSL_VERIFY_PEER))
+        if (!(s->verify_mode & SSL_VERIFY_PEER))
                 tls1_transcript_free(s);
 
         /*
@@ -1501,12 +1482,10 @@ ssl3_send_server_key_exchange(SSL *s)
                         s->s3->hs.our_sigalg = sigalg;
 
                         /* Send signature algorithm. */
-                        if (SSL_USE_SIGALGS(s)) {
-                                if (!CBB_add_u16(&server_kex, sigalg->value)) {
-                                        al = SSL_AD_INTERNAL_ERROR;
-                                        SSLerror(s, ERR_R_INTERNAL_ERROR);
-                                        goto fatal_err;
-                                }
+                        if (!CBB_add_u16(&server_kex, sigalg->value)) {
+                                al = SSL_AD_INTERNAL_ERROR;
+                                SSLerror(s, ERR_R_INTERNAL_ERROR);
+                                goto fatal_err;
                         }
 
                         if (!EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey)) {
@@ -1591,14 +1570,11 @@ ssl3_send_certificate_request(SSL *s)
                 if (!ssl3_get_req_cert_types(s, &cert_types))
                         goto err;
 
-                if (SSL_USE_SIGALGS(s)) {
-                        if (!CBB_add_u16_length_prefixed(&cert_request,
-                            &sigalgs))
-                                goto err;
-                        if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version,
-                            &sigalgs, SSL_get_security_level(s)))
-                                goto err;
-                }
+                if (!CBB_add_u16_length_prefixed(&cert_request, &sigalgs))
+                        goto err;
+                if (!ssl_sigalgs_build(s->s3->hs.negotiated_tls_version,
+                    &sigalgs, SSL_get_security_level(s)))
+                        goto err;
 
                 if (!CBB_add_u16_length_prefixed(&cert_request, &cert_auth))
                         goto err;
@@ -1879,7 +1855,8 @@ ssl3_get_cert_verify(SSL *s)
         EVP_PKEY *pkey;
         X509 *peer_cert = NULL;
         EVP_MD_CTX *mctx = NULL;
-        int al, verify;
+        EVP_PKEY_CTX *pctx;
+        int al;
         const unsigned char *hdata;
         size_t hdatalen;
         int type = 0;
@@ -1932,10 +1909,9 @@ ssl3_get_cert_verify(SSL *s)
                 goto fatal_err;
         }
 
-        if (SSL_USE_SIGALGS(s)) {
-                if (!CBS_get_u16(&cbs, &sigalg_value))
-                        goto decode_err;
-        }
+        if (!CBS_get_u16(&cbs, &sigalg_value))
+                goto decode_err;
+
         if (!CBS_get_u16_length_prefixed(&cbs, &signature))
                 goto err;
         if (CBS_len(&cbs) != 0) {
@@ -1957,74 +1933,26 @@ ssl3_get_cert_verify(SSL *s)
         }
         s->s3->hs.peer_sigalg = sigalg;
 
-        if (SSL_USE_SIGALGS(s)) {
-                EVP_PKEY_CTX *pctx;
-
-                if (!tls1_transcript_data(s, &hdata, &hdatalen)) {
-                        SSLerror(s, ERR_R_INTERNAL_ERROR);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(),
-                    NULL, pkey)) {
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) &&
-                    (!EVP_PKEY_CTX_set_rsa_padding(pctx,
-                        RSA_PKCS1_PSS_PADDING) ||
-                    !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-                if (EVP_DigestVerify(mctx, CBS_data(&signature),
-                    CBS_len(&signature), hdata, hdatalen) <= 0) {
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        al = SSL_AD_INTERNAL_ERROR;
-                        goto fatal_err;
-                }
-        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-                RSA *rsa;
-
-                if ((rsa = EVP_PKEY_get0_RSA(pkey)) == NULL) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        goto fatal_err;
-                }
-                verify = RSA_verify(NID_md5_sha1, s->s3->hs.tls12.cert_verify,
-                    MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, CBS_data(&signature),
-                    CBS_len(&signature), rsa);
-                if (verify < 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_RSA_DECRYPT);
-                        goto fatal_err;
-                }
-                if (verify == 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_RSA_SIGNATURE);
-                        goto fatal_err;
-                }
-        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-                EC_KEY *eckey;
-
-                if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) {
-                        al = SSL_AD_INTERNAL_ERROR;
-                        SSLerror(s, ERR_R_EVP_LIB);
-                        goto fatal_err;
-                }
-                verify = ECDSA_verify(0,
-                    &(s->s3->hs.tls12.cert_verify[MD5_DIGEST_LENGTH]),
-                    SHA_DIGEST_LENGTH, CBS_data(&signature),
-                    CBS_len(&signature), eckey);
-                if (verify <= 0) {
-                        al = SSL_AD_DECRYPT_ERROR;
-                        SSLerror(s, SSL_R_BAD_ECDSA_SIGNATURE);
-                        goto fatal_err;
-                }
-        } else {
+        if (!tls1_transcript_data(s, &hdata, &hdatalen)) {
                 SSLerror(s, ERR_R_INTERNAL_ERROR);
-                al = SSL_AD_UNSUPPORTED_CERTIFICATE;
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if (!EVP_DigestVerifyInit(mctx, &pctx, sigalg->md(), NULL, pkey)) {
+                SSLerror(s, ERR_R_EVP_LIB);
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if ((sigalg->flags & SIGALG_FLAG_RSA_PSS) &&
+            (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) ||
+            !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1))) {
+                al = SSL_AD_INTERNAL_ERROR;
+                goto fatal_err;
+        }
+        if (EVP_DigestVerify(mctx, CBS_data(&signature), CBS_len(&signature),
+            hdata, hdatalen) <= 0) {
+                SSLerror(s, ERR_R_EVP_LIB);
+                al = SSL_AD_INTERNAL_ERROR;
                 goto fatal_err;
         }