diff options
| author | Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> | 2018-06-21 19:34:45 +0300 |
|---|---|---|
| committer | Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> | 2019-10-18 15:04:10 +0300 |
| commit | 975e1e81f78490baf9e4da220f892b13708aee66 (patch) | |
| tree | 971c92b15298383ae84a257100d36ee44bfda2c9 /lib | |
| parent | 0778871b97bf9e3ef6a92e04fe6a68f8e70275d7 (diff) | |
| download | gnutls-975e1e81f78490baf9e4da220f892b13708aee66.tar.gz | |
lib: pubkey vs TLS signature compatibility for GOST algorithms
Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/pubkey.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/lib/pubkey.c b/lib/pubkey.c index 74d19d8b39..3b4d7f9003 100644 --- a/lib/pubkey.c +++ b/lib/pubkey.c @@ -1972,6 +1972,19 @@ int _gnutls_pubkey_compatible_with_sig(gnutls_session_t session, hash_size); } + } else if (pubkey->params.algo == GNUTLS_PK_GOST_01 || + pubkey->params.algo == GNUTLS_PK_GOST_12_256 || + pubkey->params.algo == GNUTLS_PK_GOST_12_512) { + if (_gnutls_version_has_selectable_sighash(ver) + && se != NULL) { + if (_gnutls_gost_digest(pubkey->params.algo) != se->hash) { + _gnutls_audit_log(session, + "The hash algo used in signature (%u) is not expected (%u)\n", + se->hash, _gnutls_gost_digest(pubkey->params.algo)); + return gnutls_assert_val(GNUTLS_E_CONSTRAINT_ERROR); + } + } + } else if (pubkey->params.algo == GNUTLS_PK_RSA_PSS) { if (!_gnutls_version_has_selectable_sighash(ver)) /* this should not have happened */ |