[openssl-commits] [openssl] master update
Dr. Stephen Henson
steve at openssl.org
Fri Feb 24 23:50:06 UTC 2017
The branch master has been updated
via 599b586d8775830ad1d5982382a9bb2d78a40679 (commit)
via 9f577cddf917a61ea808947f428eaf183e84a081 (commit)
via d343c30e4282eb62d59c28e4dfe228b5ddb7b895 (commit)
from 80770da39ebba0101079477611b7ce2f426653c5 (commit)
- Log -----------------------------------------------------------------
commit 599b586d8775830ad1d5982382a9bb2d78a40679
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Fri Feb 24 16:39:57 2017 +0000
Add SuiteB support to tls_choose_sigalg()
Reviewed-by: Rich Salz <rsalz at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2738)
commit 9f577cddf917a61ea808947f428eaf183e84a081
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Fri Feb 24 15:47:54 2017 +0000
Add Suite B tests
Reviewed-by: Rich Salz <rsalz at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2738)
commit d343c30e4282eb62d59c28e4dfe228b5ddb7b895
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Sat Feb 18 13:38:37 2017 +0000
Add P-384 root and P-384, P-256 EE certificates.
Reviewed-by: Rich Salz <rsalz at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2738)
-----------------------------------------------------------------------
Summary of changes:
ssl/t1_lib.c | 17 ++++++++
test/certs/p256-server-cert.pem | 12 +++++
test/certs/p256-server-key.pem | 5 +++
test/certs/p384-root-key.pem | 6 +++
test/certs/p384-root.pem | 12 +++++
test/certs/p384-server-cert.pem | 13 ++++++
test/certs/p384-server-key.pem | 6 +++
test/ssl-tests/20-cert-select.conf | 82 ++++++++++++++++++++++++++++++-----
test/ssl-tests/20-cert-select.conf.in | 38 ++++++++++++++++
9 files changed, 181 insertions(+), 10 deletions(-)
create mode 100644 test/certs/p256-server-cert.pem
create mode 100644 test/certs/p256-server-key.pem
create mode 100644 test/certs/p384-root-key.pem
create mode 100644 test/certs/p384-root.pem
create mode 100644 test/certs/p384-server-cert.pem
create mode 100644 test/certs/p384-server-key.pem
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 8b31e84..100c97c 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -2314,6 +2314,17 @@ int tls_choose_sigalg(SSL *s, int *al)
if (SSL_USE_SIGALGS(s)) {
if (s->s3->tmp.peer_sigalgs != NULL) {
size_t i;
+#ifndef OPENSSL_NO_EC
+ int curve;
+
+ /* For Suite B need to match signature algorithm to curve */
+ if (tls1_suiteb(s)) {
+ EC_KEY *ec = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[idx].privatekey);
+ curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
+ } else {
+ curve = -1;
+ }
+#endif
/*
* Find highest preference signature algorithm matching
@@ -2321,8 +2332,14 @@ int tls_choose_sigalg(SSL *s, int *al)
*/
for (i = 0; i < s->cert->shared_sigalgslen; i++) {
lu = s->cert->shared_sigalgs[i];
+#ifdef OPENSSL_NO_EC
if (lu->sig_idx == idx)
break;
+#else
+ if (lu->sig_idx == idx
+ && (curve == -1 || lu->curve == curve))
+ break;
+#endif
if (idx == SSL_PKEY_RSA && lu->sig == EVP_PKEY_RSA_PSS)
break;
}
diff --git a/test/certs/p256-server-cert.pem b/test/certs/p256-server-cert.pem
new file mode 100644
index 0000000..f144e11
--- /dev/null
+++ b/test/certs/p256-server-cert.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByjCCAU+gAwIBAgIBAjAKBggqhkjOPQQDAjAbMRkwFwYDVQQDDBBFQ0RTQSBQ
+LTM4NCByb290MCAXDTE3MDIxODE4NTA1NloYDzIxMTcwMjE5MTg1MDU2WjAcMRow
+GAYDVQQDDBFQLTI1NiBTZXJ2ZXIgQ2VydDBZMBMGByqGSM49AgEGCCqGSM49AwEH
+A0IABBQtneXPCnPgmqOCJdOnixLtRxYCYJoKLMTKpVRHg1toZa5hst1EmlfcIJ2q
+0mwDj2N7MZxHCQKrY7h2ussdSuujgYAwfjAdBgNVHQ4EFgQUXkNyi959A0GuCidm
+beH0E4OStLYwHwYDVR0jBBgwFoAUJtCPHXtf3B5/QYB9Y8ocdYHWhWkwCQYDVR0T
+BAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAcBgNVHREEFTATghFQLTI1NiBTZXJ2
+ZXIgQ2VydDAKBggqhkjOPQQDAgNpADBmAjEA5Bli9loRg3x9jCo/Xyu6pxN9xmaA
+GzGrJ+sVfAoKCDPjfvXR3VA+auFR7c65R3lvAjEAuNC6+SIYdp0kOXB9W0s5RcMl
+e9e1+PVLCMU9PG1+lfy8cJV4iDymomx/+jX2f0R0
+-----END CERTIFICATE-----
diff --git a/test/certs/p256-server-key.pem b/test/certs/p256-server-key.pem
new file mode 100644
index 0000000..b2ebd69
--- /dev/null
+++ b/test/certs/p256-server-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgJ51ke8aiotgRnxNb
+le4OYpOA/E5Cuj0+yU8lbeg0GgOhRANCAAQULZ3lzwpz4JqjgiXTp4sS7UcWAmCa
+CizEyqVUR4NbaGWuYbLdRJpX3CCdqtJsA49jezGcRwkCq2O4drrLHUrr
+-----END PRIVATE KEY-----
diff --git a/test/certs/p384-root-key.pem b/test/certs/p384-root-key.pem
new file mode 100644
index 0000000..6556c56
--- /dev/null
+++ b/test/certs/p384-root-key.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAp+VkMpwM7uCJWk+fo
+bSxLtiF2nd/4YDJy2IjO+IjzoEDGJB4Ekr1AGxYmiS57IVWhZANiAAS/4vfY5YBd
+dvcJs81VXvm3gqwIvzycNtT48ZQ9bqGJBERMAXkmOgzPVz4cSIr33KfIKGhfgjVK
+xSAorUKfc0cWf0dZZh3UxpXeN1x3dxtK3hED1y8pemwuz3tYuuOBbtw=
+-----END PRIVATE KEY-----
diff --git a/test/certs/p384-root.pem b/test/certs/p384-root.pem
new file mode 100644
index 0000000..df5057f
--- /dev/null
+++ b/test/certs/p384-root.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBtzCCAT2gAwIBAgIBATAKBggqhkjOPQQDAjAbMRkwFwYDVQQDDBBFQ0RTQSBQ
+LTM4NCByb290MCAXDTE3MDIxODEzNDUzN1oYDzIxMTcwMjE5MTM0NTM3WjAbMRkw
+FwYDVQQDDBBFQ0RTQSBQLTM4NCByb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE
+v+L32OWAXXb3CbPNVV75t4KsCL88nDbU+PGUPW6hiQRETAF5JjoMz1c+HEiK99yn
+yChoX4I1SsUgKK1Cn3NHFn9HWWYd1MaV3jdcd3cbSt4RA9cvKXpsLs97WLrjgW7c
+o1MwUTAdBgNVHQ4EFgQUJtCPHXtf3B5/QYB9Y8ocdYHWhWkwHwYDVR0jBBgwFoAU
+JtCPHXtf3B5/QYB9Y8ocdYHWhWkwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQD
+AgNoADBlAjEA9ZGtIjZhUPqqyjB2YdfXh7K+AUIXdxmtHmioVNbksIApEzbZ25rI
+o1WkqRowwbkNAjAw0TzgEv0q4MtQN0G5Lh/z0aVdaFICpXI6UhDXZyiZeRjt2Lbi
+3Da3rKRZdHHswY4=
+-----END CERTIFICATE-----
diff --git a/test/certs/p384-server-cert.pem b/test/certs/p384-server-cert.pem
new file mode 100644
index 0000000..c643512
--- /dev/null
+++ b/test/certs/p384-server-cert.pem
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB5jCCAWygAwIBAgIBAjAKBggqhkjOPQQDAjAbMRkwFwYDVQQDDBBFQ0RTQSBQ
+LTM4NCByb290MCAXDTE3MDIxODE4NDk1NFoYDzIxMTcwMjE5MTg0OTU0WjAcMRow
+GAYDVQQDDBFQLTM4NCBTZXJ2ZXIgQ2VydDB2MBAGByqGSM49AgEGBSuBBAAiA2IA
+BNgfdX1zL/wbUQekHkIYpI9KKBDH5oxUbjeHqc0EkEDOLHs7zb3f7UdsqaZ/4Ukn
+Wqm8Kmcz5TOYpvg7gn+jPmtVpI2BCfxqYD2WceePkllWENoJFtt/VwOPMGMymeUH
+3KOBgDB+MB0GA1UdDgQWBBSY+ffqAKeBpiQl4b6hjUOXuBbIljAfBgNVHSMEGDAW
+gBQm0I8de1/cHn9BgH1jyhx1gdaFaTAJBgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMBwGA1UdEQQVMBOCEVAtMzg0IFNlcnZlciBDZXJ0MAoGCCqGSM49BAMC
+A2gAMGUCMQDD1uzmDMxAmkyokImzX4hW6f2Hxt/iZJhT6C15zCjYfoWcBdP/EiF5
+m2FMPUvxq+0CMAmKOndcfOwQ7OoaEUySx2q10iXgrkE42HsTvFER8FUN7repOUnD
+JhC9UKJW7I5A9w==
+-----END CERTIFICATE-----
diff --git a/test/certs/p384-server-key.pem b/test/certs/p384-server-key.pem
new file mode 100644
index 0000000..438e8f4
--- /dev/null
+++ b/test/certs/p384-server-key.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBg3D9RcSwjYqyeLmW+
+nw3mGtBTeNFH2heMO4uOl3EAzJAB8Q+1DjD9Prlrsc+JX7yhZANiAATYH3V9cy/8
+G1EHpB5CGKSPSigQx+aMVG43h6nNBJBAzix7O8293+1HbKmmf+FJJ1qpvCpnM+Uz
+mKb4O4J/oz5rVaSNgQn8amA9lnHnj5JZVhDaCRbbf1cDjzBjMpnlB9w=
+-----END PRIVATE KEY-----
diff --git a/test/ssl-tests/20-cert-select.conf b/test/ssl-tests/20-cert-select.conf
index 1598dad..290bb87 100644
--- a/test/ssl-tests/20-cert-select.conf
+++ b/test/ssl-tests/20-cert-select.conf
@@ -1,6 +1,6 @@
# Generated with generate_ssl_tests.pl
-num_tests = 9
+num_tests = 11
test-0 = 0-ECDSA CipherString Selection
test-1 = 1-RSA CipherString Selection
@@ -10,7 +10,9 @@ test-4 = 4-ECDSA Signature Algorithm Selection SHA384
test-5 = 5-ECDSA Signature Algorithm Selection, no ECDSA certificate
test-6 = 6-RSA Signature Algorithm Selection
test-7 = 7-RSA-PSS Signature Algorithm Selection
-test-8 = 8-TLS 1.2 DSA Certificate Test
+test-8 = 8-Suite B P-256 Hash Algorithm Selection
+test-9 = 9-Suite B P-384 Hash Algorithm Selection
+test-10 = 10-TLS 1.2 DSA Certificate Test
# ===========================================================
[0-ECDSA CipherString Selection]
@@ -238,14 +240,74 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
-[8-TLS 1.2 DSA Certificate Test]
-ssl_conf = 8-TLS 1.2 DSA Certificate Test-ssl
+[8-Suite B P-256 Hash Algorithm Selection]
+ssl_conf = 8-Suite B P-256 Hash Algorithm Selection-ssl
-[8-TLS 1.2 DSA Certificate Test-ssl]
-server = 8-TLS 1.2 DSA Certificate Test-server
-client = 8-TLS 1.2 DSA Certificate Test-client
+[8-Suite B P-256 Hash Algorithm Selection-ssl]
+server = 8-Suite B P-256 Hash Algorithm Selection-server
+client = 8-Suite B P-256 Hash Algorithm Selection-client
-[8-TLS 1.2 DSA Certificate Test-server]
+[8-Suite B P-256 Hash Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = SUITEB128
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[8-Suite B P-256 Hash Algorithm Selection-client]
+CipherString = DEFAULT
+SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
+VerifyMode = Peer
+
+[test-8]
+ExpectedResult = Success
+ExpectedServerCertType = P-256
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[9-Suite B P-384 Hash Algorithm Selection]
+ssl_conf = 9-Suite B P-384 Hash Algorithm Selection-ssl
+
+[9-Suite B P-384 Hash Algorithm Selection-ssl]
+server = 9-Suite B P-384 Hash Algorithm Selection-server
+client = 9-Suite B P-384 Hash Algorithm Selection-client
+
+[9-Suite B P-384 Hash Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = SUITEB128
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[9-Suite B P-384 Hash Algorithm Selection-client]
+CipherString = DEFAULT
+SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
+VerifyMode = Peer
+
+[test-9]
+ExpectedResult = Success
+ExpectedServerCertType = P-384
+ExpectedServerSignHash = SHA384
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[10-TLS 1.2 DSA Certificate Test]
+ssl_conf = 10-TLS 1.2 DSA Certificate Test-ssl
+
+[10-TLS 1.2 DSA Certificate Test-ssl]
+server = 10-TLS 1.2 DSA Certificate Test-server
+client = 10-TLS 1.2 DSA Certificate Test-client
+
+[10-TLS 1.2 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
@@ -255,13 +317,13 @@ MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[8-TLS 1.2 DSA Certificate Test-client]
+[10-TLS 1.2 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA256:DSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-8]
+[test-10]
ExpectedResult = Success
diff --git a/test/ssl-tests/20-cert-select.conf.in b/test/ssl-tests/20-cert-select.conf.in
index 7edfed6..e33b3d6 100644
--- a/test/ssl-tests/20-cert-select.conf.in
+++ b/test/ssl-tests/20-cert-select.conf.in
@@ -115,6 +115,44 @@ our @tests = (
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
+ },
+ {
+ name => "Suite B P-256 Hash Algorithm Selection",
+ server => {
+ "ECDSA.Certificate" => test_pem("p256-server-cert.pem"),
+ "ECDSA.PrivateKey" => test_pem("p256-server-key.pem"),
+ "MaxProtocol" => "TLSv1.2",
+ "CipherString" => "SUITEB128"
+ },
+ client => {
+ "VerifyCAFile" => test_pem("p384-root.pem"),
+ "SignatureAlgorithms" => "ECDSA+SHA384:ECDSA+SHA256"
+ },
+ test => {
+ "ExpectedServerCertType" => "P-256",
+ "ExpectedServerSignHash" => "SHA256",
+ "ExpectedServerSignType" => "EC",
+ "ExpectedResult" => "Success"
+ },
+ },
+ {
+ name => "Suite B P-384 Hash Algorithm Selection",
+ server => {
+ "ECDSA.Certificate" => test_pem("p384-server-cert.pem"),
+ "ECDSA.PrivateKey" => test_pem("p384-server-key.pem"),
+ "MaxProtocol" => "TLSv1.2",
+ "CipherString" => "SUITEB128"
+ },
+ client => {
+ "VerifyCAFile" => test_pem("p384-root.pem"),
+ "SignatureAlgorithms" => "ECDSA+SHA256:ECDSA+SHA384"
+ },
+ test => {
+ "ExpectedServerCertType" => "P-384",
+ "ExpectedServerSignHash" => "SHA384",
+ "ExpectedServerSignType" => "EC",
+ "ExpectedResult" => "Success"
+ },
}
);
More information about the openssl-commits
mailing list