From 3f534e9f9450f122637aed8d48c9f569cdcbdd94 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Sun, 9 Apr 2023 18:26:26 +0000
Subject: Drop X9.31 support from libtls
The TLS signer isn't exposed in public API (we should finally fix it...)
and it supports X9.31, a standard that has been retired and deprecated for
a very long time. libcrypto will stop supporting it soon, this step is
needed to prepare userland.
ok jsing
---
src/lib/libtls/tls_internal.h | 3 +--
src/lib/libtls/tls_signer.c | 6 +-----
2 files changed, 2 insertions(+), 7 deletions(-)
(limited to 'src/lib')
diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index ca1d96f627..f4c23f64e6 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_internal.h,v 1.80 2022/03/24 15:56:34 tb Exp $ */
+/* $OpenBSD: tls_internal.h,v 1.81 2023/04/09 18:26:26 tb Exp $ */
/*
* Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
* Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -302,7 +302,6 @@ ECDSA_METHOD *tls_signer_ecdsa_method(void);
#define TLS_PADDING_NONE 0
#define TLS_PADDING_RSA_PKCS1 1
-#define TLS_PADDING_RSA_X9_31 2
int tls_config_set_sign_cb(struct tls_config *_config, tls_sign_cb _cb,
void *_cb_arg);
diff --git a/src/lib/libtls/tls_signer.c b/src/lib/libtls/tls_signer.c
index 1f11096792..f6005d3e07 100644
--- a/src/lib/libtls/tls_signer.c
+++ b/src/lib/libtls/tls_signer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_signer.c,v 1.4 2022/02/01 17:18:38 jsing Exp $ */
+/* $OpenBSD: tls_signer.c,v 1.5 2023/04/09 18:26:26 tb Exp $ */
/*
* Copyright (c) 2021 Eric Faurot <eric@openbsd.org>
*
@@ -193,8 +193,6 @@ tls_sign_rsa(struct tls_signer *signer, struct tls_signer_key *skey,
rsa_padding = RSA_NO_PADDING;
} else if (padding_type == TLS_PADDING_RSA_PKCS1) {
rsa_padding = RSA_PKCS1_PADDING;
- } else if (padding_type == TLS_PADDING_RSA_X9_31) {
- rsa_padding = RSA_X931_PADDING;
} else {
tls_error_setx(&signer->error, "invalid RSA padding type (%d)",
padding_type);
@@ -331,8 +329,6 @@ tls_rsa_priv_enc(int from_len, const unsigned char *from, unsigned char *to,
padding_type = TLS_PADDING_NONE;
} else if (rsa_padding == RSA_PKCS1_PADDING) {
padding_type = TLS_PADDING_RSA_PKCS1;
- } else if (rsa_padding == RSA_X931_PADDING) {
- padding_type = TLS_PADDING_RSA_X9_31;
} else {
goto err;
}
--
cgit v1.2.3-55-g6feb