diff options
author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2019-01-21 20:33:00 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2019-01-22 09:50:48 +0100 |
commit | aef00dae5c55919e9a36e61c0db00869067dd285 (patch) | |
tree | ebc427259f60079c9e76b6021e845a1c585b50f3 /tests | |
parent | 69bd75e39d0ddd4e86630facf38e7bf3186f3b06 (diff) | |
download | gnutls-aef00dae5c55919e9a36e61c0db00869067dd285.tar.gz |
gnutls_pkcs11_privkey_import_url: enable RSA-PSS only when an RSA key can signtmp-key-rsa-pss
In gnutls_pkcs11_privkey_import_url() we only enabled RSA-PSS functionality to
the key if the CKM_RSA_PKCS_PSS mechanism is available to the token. However,
if the specific key is not marked for use with digital signatures (CKA_SIGN
set), then we may have still ended-up using it and fail when using it. We
now test whether CKA_SIGN is set prior to enabling such keys for PSS.
Resolves: #667
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Diffstat (limited to 'tests')
-rw-r--r-- | tests/pkcs11/tls-neg-pkcs11-key.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/tests/pkcs11/tls-neg-pkcs11-key.c b/tests/pkcs11/tls-neg-pkcs11-key.c index 764e93b6ad..f91414a6af 100644 --- a/tests/pkcs11/tls-neg-pkcs11-key.c +++ b/tests/pkcs11/tls-neg-pkcs11-key.c @@ -280,6 +280,14 @@ static const test_st tests[] = { .exp_kx = GNUTLS_KX_RSA, .needs_decryption = 1 }, + {.name = "tls1.2: rsa-decryption key, signatures prioritized", + .pk = GNUTLS_PK_RSA, + .prio = "NORMAL:-KX-ALL:+ECDHE-RSA:+RSA:-VERS-TLS-ALL:+VERS-TLS1.2:-SIGN-ALL:+SIGN-RSA-PSS-RSAE-SHA256", + .cert = &server_ca3_localhost_cert, + .key = &server_ca3_key, + .exp_kx = GNUTLS_KX_RSA, + .needs_decryption = 1 + }, {.name = "tls1.2: ecc key", .pk = GNUTLS_PK_ECDSA, .prio = "NORMAL:-KX-ALL:+ECDHE-RSA:+ECDHE-ECDSA:-VERS-TLS-ALL:+VERS-TLS1.2", |