<div dir="ltr"><div>Ok, that makes sense with what I'm seeing. I just tried changing this:<br> const EVP_MD* md = EVP_get_digestbyobj(sig_alg_oid);<br></div>to this:<br><div> const EVP_MD* md = EVP_get_digestbyname("SHA256");<br><br></div><div>and it all worked correctly.<br></div><div>so given that I have an OID for ecdsa-with-SHA256, is there a function that will return just the digest algorithm?<br></div><div>I'm trying to be as flexible as possible, so I don't want to hard code this or have my own limited lookup table.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 7, 2016 at 2:54 PM, Jakob Bohm <span dir="ltr"><<a href="mailto:jb-openssl@wisemo.com" target="_blank">jb-openssl@wisemo.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 07/07/2016 20:08, Chris Bare wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
EVP_get_digestbyobj fails for ecdsa-with-SHA256<br>
<br>
</blockquote>
ecdsa-with-SHA256 is not a digest algorithm, it is a signature<br>
algorithm with a specific choice of digest algorithm (SHA256).<br>
<br>
In OpenSSL 1.0.2 and older there is a very old compatibility<br>
feature which allows accessing a few old signature+digest<br>
algorithm pairs via a digest algorithm object.<br>
<br>
Specifically:<br>
<br>
RSA with md2, md4, md5, mdc2, ripemd, SHA-0, SHA-1, SHA224,<br>
SHA256, SHA384 and SHA512<br>
DSA with SHA-0 and SHA1<br>
ECDSA with with SHA1<br>
<br>
This has been deprecated for a long time, but the compatibility<br>
code makes your code below work for the above algorithm pairs.<br>
<br>
The reason this compatibility code is deprecated is that it<br>
causes the RSA algorithm to be referenced every time someone<br>
tries to reference just the hash algorithm object for one of<br>
the digest algorithms listed above.<div><div class="h5"><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm trying to perform a standard signature verification using the EVP_* functions.<br>
I think my code is correct, because it all runs fine if the digest is RSA-SHA256.<br>
I have an ASN1_OBJECT that specifics the signature/disgest type.<br>
Here is my code that dumps out all the intermediate steps called by EVP_get_digestbyobj:<br>
<br>
ASN1_OBJECT * ;<br>
<br>
OBJ_obj2txt(name, 256, sig_alg_oid, 1);<br>
printf ("NAME %s", name);<br>
printf ("NID = %d", OBJ_obj2nid(sig_alg_oid));<br>
printf ("sn = %s", OBJ_nid2sn(OBJ_obj2nid(sig_alg_oid)));<br>
printf ("OBJ_NAME_get = %p", OBJ_NAME_get(OBJ_nid2sn(OBJ_obj2nid(sig_alg_oid)),OBJ_NAME_TYPE_MD_METH));<br>
const EVP_MD* md = EVP_get_digestbyobj(sig_alg_oid);<br>
if(md == NULL)<br>
printf ("EVP_get_digestbyobj failed");<br>
<br>
When I call this with the RSA-SHA256 I get:<br>
NAME 1.2.840.113549.1.1.11<br>
NID = 668<br>
sn = RSA-SHA256<br>
OBJ_NAME_get = 0x7fe8846f1ee0<br>
<br>
and the rest of the steps succeeed.<br>
Then when I call the same code (in the same program, so I'm sure the openssl library is correctly initialized) with<br>
ecdsa-with-SHA256, I get:<br>
NAME 1.2.840.10045.4.3.2<br>
NID = 794<br>
sn = ecdsa-with-SHA256<br>
OBJ_NAME_get = (nil)<br>
EVP_get_digestbyobj failed<br>
<br>
So it looks like my sig_alg_oid is good, but OBJ_NAME_get fails.<br>
<br>
I am using openssl 1.0.2d-0ubuntu1.5 in ubuntu 15.10<br>
<br>
Am I doing something wrong, or could this be a bug in the library?<br>
Any suggestions appreciated.<br>
</blockquote>
<br></div></div>
Enjoy<br>
<br>
Jakob<span class="HOEnZb"><font color="#888888"><br>
-- <br>
Jakob Bohm, CIO, Partner, WiseMo A/S. <a href="https://www.wisemo.com" rel="noreferrer" target="_blank">https://www.wisemo.com</a><br>
Transformervej 29, 2860 Søborg, Denmark. Direct <a href="tel:%2B45%2031%2013%2016%2010" value="+4531131610" target="_blank">+45 31 13 16 10</a><br>
This public discussion message is non-binding and may contain errors.<br>
WiseMo - Remote Service Management for PCs, Phones and Embedded<br>
<br>
-- <br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">Chris Bare</div>
</div>