diff options
author | Richard Levitte <levitte@openssl.org> | 2020-03-31 17:20:24 +0200 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2020-04-07 11:16:56 +0200 |
commit | 2d956b320c910a90528e9a3aeb4cf48221dba246 (patch) | |
tree | 6ee6505a2a2cafca60982cf245a56ac3d77e130b /providers/common/der | |
parent | 8c555803476a2af366938161d1186a0d746910ea (diff) | |
download | openssl-new-2d956b320c910a90528e9a3aeb4cf48221dba246.tar.gz |
PROV: Add DERlib support for ECDSA and EC keys
This replaces crypto/ec/ecdsa_aid.c with new code and generated OIDs
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11450)
Diffstat (limited to 'providers/common/der')
-rw-r--r-- | providers/common/der/EC.asn1 | 83 | ||||
-rw-r--r-- | providers/common/der/build.info | 9 | ||||
-rw-r--r-- | providers/common/der/der_ec.c.in | 67 | ||||
-rw-r--r-- | providers/common/der/der_ec.h.in | 21 |
4 files changed, 179 insertions, 1 deletions
diff --git a/providers/common/der/EC.asn1 b/providers/common/der/EC.asn1 new file mode 100644 index 0000000000..d55a69273f --- /dev/null +++ b/providers/common/der/EC.asn1 @@ -0,0 +1,83 @@ +-- ------------------------------------------------------------------- +-- Taken from RFC 3279, 3 ASN.1 Module +-- (https://www.rfc-editor.org/rfc/rfc3279.html#section-3) + +ansi-X9-62 OBJECT IDENTIFIER ::= { + iso(1) member-body(2) us(840) 10045 } + +-- Arc for ECDSA signature OIDS + +id-ecSigType OBJECT IDENTIFIER ::= { ansi-X9-62 signatures(4) } + +-- OID for ECDSA signatures with SHA-1 + +ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { id-ecSigType 1 } + +id-publicKeyType OBJECT IDENTIFIER ::= { ansi-X9-62 keyType(2) } + +id-ecPublicKey OBJECT IDENTIFIER ::= { id-publicKeyType 1 } + +-- Named Elliptic Curves in ANSI X9.62. + +ellipticCurve OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) } + +c-TwoCurve OBJECT IDENTIFIER ::= { + ellipticCurve characteristicTwo(0) } + +c2pnb163v1 OBJECT IDENTIFIER ::= { c-TwoCurve 1 } +c2pnb163v2 OBJECT IDENTIFIER ::= { c-TwoCurve 2 } +c2pnb163v3 OBJECT IDENTIFIER ::= { c-TwoCurve 3 } +c2pnb176w1 OBJECT IDENTIFIER ::= { c-TwoCurve 4 } +c2tnb191v1 OBJECT IDENTIFIER ::= { c-TwoCurve 5 } +c2tnb191v2 OBJECT IDENTIFIER ::= { c-TwoCurve 6 } +c2tnb191v3 OBJECT IDENTIFIER ::= { c-TwoCurve 7 } +c2onb191v4 OBJECT IDENTIFIER ::= { c-TwoCurve 8 } +c2onb191v5 OBJECT IDENTIFIER ::= { c-TwoCurve 9 } +c2pnb208w1 OBJECT IDENTIFIER ::= { c-TwoCurve 10 } +c2tnb239v1 OBJECT IDENTIFIER ::= { c-TwoCurve 11 } +c2tnb239v2 OBJECT IDENTIFIER ::= { c-TwoCurve 12 } +c2tnb239v3 OBJECT IDENTIFIER ::= { c-TwoCurve 13 } +c2onb239v4 OBJECT IDENTIFIER ::= { c-TwoCurve 14 } +c2onb239v5 OBJECT IDENTIFIER ::= { c-TwoCurve 15 } +c2pnb272w1 OBJECT IDENTIFIER ::= { c-TwoCurve 16 } +c2pnb304w1 OBJECT IDENTIFIER ::= { c-TwoCurve 17 } +c2tnb359v1 OBJECT IDENTIFIER ::= { c-TwoCurve 18 } +c2pnb368w1 OBJECT IDENTIFIER ::= { c-TwoCurve 19 } +c2tnb431r1 OBJECT IDENTIFIER ::= { c-TwoCurve 20 } + +primeCurve OBJECT IDENTIFIER ::= { ellipticCurve prime(1) } + +prime192v1 OBJECT IDENTIFIER ::= { primeCurve 1 } +prime192v2 OBJECT IDENTIFIER ::= { primeCurve 2 } +prime192v3 OBJECT IDENTIFIER ::= { primeCurve 3 } +prime239v1 OBJECT IDENTIFIER ::= { primeCurve 4 } +prime239v2 OBJECT IDENTIFIER ::= { primeCurve 5 } +prime239v3 OBJECT IDENTIFIER ::= { primeCurve 6 } +prime256v1 OBJECT IDENTIFIER ::= { primeCurve 7 } + +-- ------------------------------------------------------------------- +-- Taken from RFC 5758, 3.2. ECDSA Signature Algorithm +-- (https://www.rfc-editor.org/rfc/rfc5758.html#section-3.2) + +ecdsa-with-SHA224 OBJECT IDENTIFIER ::= { iso(1) member-body(2) + us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 1 } + +ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) + us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } + +ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2) + us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 3 } + +ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) + us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 4 } + +-- ------------------------------------------------------------------- +-- Taken from https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration + +sigAlgs OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 4 3 } + +id-ecdsa-with-sha3-224 OBJECT IDENTIFIER ::= { sigAlgs 9 } +id-ecdsa-with-sha3-256 OBJECT IDENTIFIER ::= { sigAlgs 10 } +id-ecdsa-with-sha3-384 OBJECT IDENTIFIER ::= { sigAlgs 11 } +id-ecdsa-with-sha3-512 OBJECT IDENTIFIER ::= { sigAlgs 12 } + diff --git a/providers/common/der/build.info b/providers/common/der/build.info index c560a7084d..eda763ea8e 100644 --- a/providers/common/der/build.info +++ b/providers/common/der/build.info @@ -1,4 +1,4 @@ -$FIPSABLE=der_rsa.c der_dsa.c +$FIPSABLE=der_rsa.c der_dsa.c der_ec.c SOURCE[../../libfips.a]=$FIPSABLE SOURCE[../../libnonfips.a]=$FIPSABLE @@ -16,3 +16,10 @@ DEPEND[der_dsa.c]=oids_to_c.pm DEPEND[der_dsa.o]=../include/prov/der_dsa.h GENERATE[../include/prov/der_dsa.h]=der_dsa.h.in DEPEND[../include/prov/der_dsa.h]=oids_to_c.pm + +GENERATE[der_ec.c]=der_ec.c.in +DEPEND[der_ec.c]=oids_to_c.pm + +DEPEND[der_ec.o]=../include/prov/der_ec.h +GENERATE[../include/prov/der_ec.h]=der_ec.h.in +DEPEND[../include/prov/der_ec.h]=oids_to_c.pm diff --git a/providers/common/der/der_ec.c.in b/providers/common/der/der_ec.c.in new file mode 100644 index 0000000000..a617651e4e --- /dev/null +++ b/providers/common/der/der_ec.c.in @@ -0,0 +1,67 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include <openssl/bn.h> +#include <openssl/obj_mac.h> +#include "prov/der_ec.h" + +/* Well known OIDs precompiled */ +{- + $OUT = oids_to_c::process_leaves('providers/common/der/EC.asn1', + { dir => $config{sourcedir}, + filter => \&oids_to_c::filter_to_C }); +-} + +int DER_w_algorithmIdentifier_EC(WPACKET *pkt, int cont, EC_KEY *ec) +{ + return DER_w_begin_sequence(pkt, cont) + /* No parameters (yet?) */ + && DER_w_precompiled(pkt, -1, der_oid_id_ecPublicKey, + sizeof(der_oid_id_ecPublicKey)) + && DER_w_end_sequence(pkt, cont); +} + +/* Aliases so we can have a uniform MD_CASE */ +#define der_oid_id_ecdsa_with_sha1 der_oid_ecdsa_with_SHA1 +#define der_oid_id_ecdsa_with_sha224 der_oid_ecdsa_with_SHA224 +#define der_oid_id_ecdsa_with_sha256 der_oid_ecdsa_with_SHA256 +#define der_oid_id_ecdsa_with_sha384 der_oid_ecdsa_with_SHA384 +#define der_oid_id_ecdsa_with_sha512 der_oid_ecdsa_with_SHA512 + +#define MD_CASE(name) \ + case NID_##name: \ + precompiled = der_oid_id_ecdsa_with_##name; \ + precompiled_sz = sizeof(der_oid_id_ecdsa_with_##name); \ + break; + +int DER_w_algorithmIdentifier_ECDSA_with(WPACKET *pkt, int cont, + EC_KEY *ec, int mdnid) +{ + const unsigned char *precompiled = NULL; + size_t precompiled_sz = 0; + + switch (mdnid) { + MD_CASE(sha1); + MD_CASE(sha224); + MD_CASE(sha256); + MD_CASE(sha384); + MD_CASE(sha512); + MD_CASE(sha3_224); + MD_CASE(sha3_256); + MD_CASE(sha3_384); + MD_CASE(sha3_512); + default: + return 0; + } + + return DER_w_begin_sequence(pkt, cont) + /* No parameters (yet?) */ + && DER_w_precompiled(pkt, -1, precompiled, precompiled_sz) + && DER_w_end_sequence(pkt, cont); +} diff --git a/providers/common/der/der_ec.h.in b/providers/common/der/der_ec.h.in new file mode 100644 index 0000000000..24f153cd8f --- /dev/null +++ b/providers/common/der/der_ec.h.in @@ -0,0 +1,21 @@ +/* + * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include "internal/der.h" + +/* Well known OIDs precompiled */ +{- + $OUT = oids_to_c::process_leaves('providers/common/der/EC.asn1', + { dir => $config{sourcedir}, + filter => \&oids_to_c::filter_to_H }); +-} + +int DER_w_algorithmIdentifier_EC(WPACKET *pkt, int cont, EC_KEY *ec); +int DER_w_algorithmIdentifier_ECDSA_with(WPACKET *pkt, int cont, + EC_KEY *ec, int mdnid); |