diff options
| author | Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com> | 2016-09-21 20:29:42 -0400 |
|---|---|---|
| committer | Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com> | 2016-09-21 20:29:42 -0400 |
| commit | 62f0afa2ecead02b1258dabab8097ca278a22f8f (patch) | |
| tree | 56132d617fff7c4f05e67024ec872d88fcafa92d /Cryptlib/OpenSSL/crypto/dh | |
| parent | d3819813b8e0a64400ddf3ce033bae7c3f245508 (diff) | |
| download | efi-boot-shim-62f0afa2ecead02b1258dabab8097ca278a22f8f.tar.gz efi-boot-shim-62f0afa2ecead02b1258dabab8097ca278a22f8f.zip | |
Import upstream version 0.9+1474479173.6c180c6
Diffstat (limited to 'Cryptlib/OpenSSL/crypto/dh')
| -rw-r--r-- | Cryptlib/OpenSSL/crypto/dh/dh_check.c | 34 | ||||
| -rw-r--r-- | Cryptlib/OpenSSL/crypto/dh/dh_pmeth.c | 15 |
2 files changed, 33 insertions, 16 deletions
diff --git a/Cryptlib/OpenSSL/crypto/dh/dh_check.c b/Cryptlib/OpenSSL/crypto/dh/dh_check.c index 347467c6..02770411 100644 --- a/Cryptlib/OpenSSL/crypto/dh/dh_check.c +++ b/Cryptlib/OpenSSL/crypto/dh/dh_check.c @@ -151,23 +151,37 @@ int DH_check(const DH *dh, int *ret) int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) { int ok = 0; - BIGNUM *q = NULL; + BIGNUM *tmp = NULL; + BN_CTX *ctx = NULL; *ret = 0; - q = BN_new(); - if (q == NULL) + ctx = BN_CTX_new(); + if (ctx == NULL) goto err; - BN_set_word(q, 1); - if (BN_cmp(pub_key, q) <= 0) + BN_CTX_start(ctx); + tmp = BN_CTX_get(ctx); + if (tmp == NULL || !BN_set_word(tmp, 1)) + goto err; + if (BN_cmp(pub_key, tmp) <= 0) *ret |= DH_CHECK_PUBKEY_TOO_SMALL; - BN_copy(q, dh->p); - BN_sub_word(q, 1); - if (BN_cmp(pub_key, q) >= 0) + if (BN_copy(tmp, dh->p) == NULL || !BN_sub_word(tmp, 1)) + goto err; + if (BN_cmp(pub_key, tmp) >= 0) *ret |= DH_CHECK_PUBKEY_TOO_LARGE; + if (dh->q != NULL) { + /* Check pub_key^q == 1 mod p */ + if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx)) + goto err; + if (!BN_is_one(tmp)) + *ret |= DH_CHECK_PUBKEY_INVALID; + } + ok = 1; err: - if (q != NULL) - BN_free(q); + if (ctx != NULL) { + BN_CTX_end(ctx); + BN_CTX_free(ctx); + } return (ok); } diff --git a/Cryptlib/OpenSSL/crypto/dh/dh_pmeth.c b/Cryptlib/OpenSSL/crypto/dh/dh_pmeth.c index e5f345aa..926be98e 100644 --- a/Cryptlib/OpenSSL/crypto/dh/dh_pmeth.c +++ b/Cryptlib/OpenSSL/crypto/dh/dh_pmeth.c @@ -207,7 +207,11 @@ static int pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) case EVP_PKEY_CTRL_DH_KDF_TYPE: if (p1 == -2) return dctx->kdf_type; +#ifdef OPENSSL_NO_CMS + if (p1 != EVP_PKEY_DH_KDF_NONE) +#else if (p1 != EVP_PKEY_DH_KDF_NONE && p1 != EVP_PKEY_DH_KDF_X9_42) +#endif return -2; dctx->kdf_type = p1; return 1; @@ -448,10 +452,9 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, return ret; *keylen = ret; return 1; - } else if (dctx->kdf_type == EVP_PKEY_DH_KDF_X9_42) { -#ifdef OPENSSL_NO_CMS - return 0; -#else + } +#ifndef OPENSSL_NO_CMS + else if (dctx->kdf_type == EVP_PKEY_DH_KDF_X9_42) { unsigned char *Z = NULL; size_t Zlen = 0; if (!dctx->kdf_outlen || !dctx->kdf_oid) @@ -481,9 +484,9 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, OPENSSL_free(Z); } return ret; -#endif } - return 1; +#endif + return 0; } const EVP_PKEY_METHOD dh_pkey_meth = { |