summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_sigalgs.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Strip out all of the pkey to sigalg and sigalg to pkey linkages.jsing2019-03-251-2/+1
| | | | | | These are no longer used now that we defer signature algorithm selection. ok beck@
* Defer sigalgs selection until the certificate is known.jsing2019-03-251-3/+5
| | | | | | | | | | | | | Previously the signature algorithm was selected when the TLS extension was parsed (or the client received a certificate request), however the actual certificate to be used is not known at this stage. This leads to various problems, including the selection of a signature algorithm that cannot be used with the certificate key size (as found by jeremy@ via ruby regress). Instead, store the signature algorithms list and only select a signature algorithm when we're ready to do signature generation. Joint work with beck@.
* Correct ECDSA_SECP512R1 typo to ECDSA_SECP521R1beck2019-01-231-2/+2
| | | | spotted by naddy@
* Modify sigalgs extension processing to accomodate TLS 1.3.beck2019-01-231-1/+3
| | | | | | | | | | - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2. - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 from a 1.3 handshake. ok jsing@ tb@
* revert previous, accidentally contained another diff in additionbeck2019-01-231-3/+1
| | | | to the one I intended to commit
* Modify sigalgs extension processing for TLS 1.3.beck2019-01-231-1/+3
| | | | | | | | | - Make a separate sigalgs list for TLS 1.3 including only modern algorithm choices which we use when the handshake will not negotiate TLS 1.2 - Modify the legacy sigalgs for TLS 1.2 to include the RSA PSS algorithms as mandated by RFC8446 when the handshake will permit negotiation of TLS 1.2 ok jsing@ tb@
* Unbreak legacy ciphers for prior to 1.1 by setting having a legacybeck2018-11-161-1/+4
| | | | | sigalg for MD5_SHA1 and using it as the non sigalgs default ok jsing@
* Add check function to verify that pkey is usable with a sigalg.beck2018-11-111-1/+2
| | | | | Include check for appropriate RSA key size when used with PSS. ok tb@
* Remove dead codebeck2018-11-101-2/+1
| | | | ok jsing@
* Stop keeping track of sigalgs by guessing it from digest and pkey,beck2018-11-101-2/+2
| | | | | | just keep the sigalg around so we can remember what we actually decided to use. ok jsing@
* Ensure we only choose sigalgs from our prefernce list, not the whole listbeck2018-11-091-2/+2
| | | | ok jsing@
* Add the ability to have a separate priority list for sigalgs.beck2018-11-091-2/+5
| | | | | Add a priority list for tls 1.2 ok jsing@
* Add header guards and hidden declarations.jsing2018-11-091-1/+9
|
* Reimplement the sigalgs processing code into a new implementationbeck2018-11-091-0/+69
that will be usable with TLS 1.3 with less eye bleed. ok jsing@ tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 03:59:14 +0000