delta/gnutls.git/lib/algorithms, branch tmp-remove-debugging-code

sign APIs: introduce RSA-RAW signing algorithm

2017-08-17T08:43:29+00:00

This ensures that there is a signing algorithm for all the operations
we support. Previously, we required GNUTLS_SIGN_UNKNOWN to be acceptable
by signing functions to accomodate for raw RSA operations. Now we make
that explicit and in the process clean-up the API.

Signed-off-by: Nikos Mavrogiannopoulos

publickey: fixed incorrect assignment

2017-08-08T19:17:56+00:00

Signed-off-by: Nikos Mavrogiannopoulos

mac: simplified iteration functions

2017-08-08T19:17:56+00:00

Signed-off-by: Nikos Mavrogiannopoulos

sign/digest: separate "brokenness" of signatures and hash algorithms

2017-08-04T14:53:53+00:00

That is, allow digital signatures to be marked as broken irrespective
of their used hash, and restrict hash brokenness to preimage resistance.

Signed-off-by: Nikos Mavrogiannopoulos

sign: use C99 syntax for signature algorithm's table

2017-08-04T14:53:53+00:00

Signed-off-by: Nikos Mavrogiannopoulos

gnutls_pk_get_oid: return early on unknown algorithm

2017-08-04T10:05:55+00:00

Signed-off-by: Nikos Mavrogiannopoulos

*set_spki(): return error on incompatible algorithms

2017-08-03T09:57:52+00:00

In addition update the public key algorithm field in the
respective structure.

Signed-off-by: Nikos Mavrogiannopoulos

gnutls_x509_privkey_generate2: do not hardcode the RSA-PSS hash to SHA256

2017-08-03T09:57:52+00:00

Instead use _gnutls_pk_bits_to_sha_hash() to set an appropriate hash
for the number of bits of the key. This matches better the "intention"
of RSA-PSS or tying the security parameter with the salt and hash.

Signed-off-by: Nikos Mavrogiannopoulos

Clarified the purpose of the spki params related functions

2017-08-03T09:57:52+00:00

_gnutls_privkey_get_sign_params was renamed to _gnutls_privkey_get_spki_params,
_gnutls_privkey_update_sign_params to _gnutls_privkey_update_spki_params,
and the dig entry of gnutls_x509_spki_st was renamed to rsa_pss_dig.

The reason is that there could be a confusion on the purpose of
the 'dig' entry, as it could be assumed to be the signature's hash
algorithm in the general case. That could not be because the SPKI
parameters do not contain it for any other algorithm than RSA-PSS.
As such, make a logical separation from SPKI reading functions
with the signature reading functions and try to use the
gnutls_sign_entry_st when signature information is required.

Signed-off-by: Nikos Mavrogiannopoulos

Pass the signature algorithm lower in the verification stack

2017-08-03T09:57:52+00:00

This will allow enhancing the back-ends (PKCS#11 and ext) for
signing with the new signature algorithms like RSA-PSS and Ed25519.

Signed-off-by: Nikos Mavrogiannopoulos