From f5300bb014a205047638e02ab49acb28240d93eb Mon Sep 17 00:00:00 2001
From: beck <>
Date: Sun, 11 Nov 2018 21:54:47 +0000
Subject: Add check function to verify that pkey is usable with a sigalg.
 Include check for appropriate RSA key size when used with PSS. ok tb@

---
 src/lib/libssl/ssl_sigalgs.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

(limited to 'src/lib/libssl/ssl_sigalgs.c')

diff --git a/src/lib/libssl/ssl_sigalgs.c b/src/lib/libssl/ssl_sigalgs.c
index 5dc261810b..a6c5a4e9d8 100644
--- a/src/lib/libssl/ssl_sigalgs.c
+++ b/src/lib/libssl/ssl_sigalgs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sigalgs.c,v 1.6 2018/11/11 02:03:23 beck Exp $ */
+/* $OpenBSD: ssl_sigalgs.c,v 1.7 2018/11/11 21:54:47 beck Exp $ */
 /*
  * Copyright (c) 2018, Bob Beck <beck@openbsd.org>
  *
@@ -225,3 +225,19 @@ ssl_sigalgs_build(CBB *cbb, uint16_t *values, size_t len)
 	}
 	return 1;
 }
+
+int
+ssl_sigalg_pkey_ok(const struct ssl_sigalg *sigalg, EVP_PKEY *pkey)
+{
+	if (sigalg->key_type == pkey->type) {
+		if (!(sigalg->flags & SIGALG_FLAG_RSA_PSS))
+			return 1;
+		/*
+		 * RSA keys for PSS need to be at least
+		 * as big as twice the size of the hash + 2
+		 */
+		if (EVP_PKEY_size(pkey) < (2 * EVP_MD_size(sigalg->md()) + 2))
+			return 1;
+	}
+	return 0;
+}
-- 
cgit v1.2.3-55-g6feb