feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #3413 from cconlon/zd11011

Browse Source 
PKCS#7: check PKCS7 SignedData private key is valid before using it
This commit is contained in:
JacobBarthelmeh
2020-11-11 22:55:03 +07:00
committed by GitHub
parent 68209f91fb 1ced948391
commit fe2dcf76fe
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
wolfcrypt/src/pkcs7.c
View File

@@ -1605,6 +1605,25 @@ static int wc_PKCS7_RsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
ret = BAD_FUNC_ARG; ret = BAD_FUNC_ARG;
} }
} }
/* If not using old FIPS or CAVP selftest, or not using FAST,
or USER RSA, able to check RSA key. */
#if !defined(WOLFSSL_RSA_PUBLIC_ONLY) && !defined(HAVE_FAST_RSA) && \
!defined(HAVE_USER_RSA) && (!defined(HAVE_FIPS) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2))) && \
!defined(HAVE_SELFTEST) && !defined(HAVE_INTEL_QA)
#if defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_RSA_KEY_CHECK)
/* verify imported private key is a valid key before using it */
if (ret == 0) {
ret = wc_CheckRsaKey(privKey);
if (ret != 0) {
WOLFSSL_MSG("Invalid RSA private key, check pkcs7->privateKey");
}
}
#endif
#endif
if (ret == 0) { if (ret == 0) {
#ifdef WOLFSSL_ASYNC_CRYPT #ifdef WOLFSSL_ASYNC_CRYPT
do { do {
@@ -1668,6 +1687,15 @@ static int wc_PKCS7_EcdsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
ret = BAD_FUNC_ARG; ret = BAD_FUNC_ARG;
} }
} }
/* verify imported private key is a valid key before using it */
if (ret == 0) {
ret = wc_ecc_check_key(privKey);
if (ret != 0) {
WOLFSSL_MSG("Invalid ECC private key, check pkcs7->privateKey");
}
}
if (ret == 0) { if (ret == 0) {
outSz = sizeof(esd->encContentDigest); outSz = sizeof(esd->encContentDigest);
#ifdef WOLFSSL_ASYNC_CRYPT #ifdef WOLFSSL_ASYNC_CRYPT