From e34dda9383516be5cc66d3ccf61d6dfedd4d8a54 Mon Sep 17 00:00:00 2001 From: David Garske Date: Wed, 15 Jun 2022 15:56:03 -0700 Subject: [PATCH 1/2] Fix to expose the RSA public DER export function with certgen. The core function `SetRsaPublicKey` was being compiled, but the wrappers `wc_RsaKeyToPublicDer` and `wc_RsaKeyToPublicDer_ex` were not included. --- wolfcrypt/src/asn.c | 57 +++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 30 deletions(-) diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c index 1c4ced07d..42fcfd785 100644 --- a/wolfcrypt/src/asn.c +++ b/wolfcrypt/src/asn.c @@ -20927,10 +20927,6 @@ static int SetRsaPublicKey(byte* output, RsaKey* key, int outLen, #endif /* WOLFSSL_ASN_TEMPLATE */ } -#endif /* !NO_RSA && (WOLFSSL_CERT_GEN || (WOLFSSL_KEY_GEN && - !HAVE_USER_RSA))) */ - -#if !defined(NO_RSA) && (defined(WOLFSSL_CERT_GEN) || defined(OPENSSL_EXTRA)) /* Calculate size of encoded public RSA key in bytes. * * X.509: RFC 5280, 4.1 - SubjectPublicKeyInfo @@ -20950,7 +20946,33 @@ int wc_RsaPublicKeyDerSize(RsaKey* key, int with_header) return SetRsaPublicKey(NULL, key, 0, with_header); } -#endif /* !NO_RSA && WOLFSSL_CERT_GEN */ +/* Encode public RSA key in DER format. + * + * X.509: RFC 5280, 4.1 - SubjectPublicKeyInfo + * PKCS #1: RFC 8017, A.1.1 - RSAPublicKey + * + * @param [in] key RSA key object. + * @param [out] output Buffer to put encoded data in. + * @param [in] inLen Size of buffer in bytes. + * @return Size of encoded data in bytes on success. + * @return BAD_FUNC_ARG when key or output is NULL. + * @return MEMORY_E when dynamic memory allocation failed. + */ +int wc_RsaKeyToPublicDer(RsaKey* key, byte* output, word32 inLen) +{ + return SetRsaPublicKey(output, key, inLen, 1); +} + +/* Returns public DER version of the RSA key. If with_header is 0 then only a + * seq + n + e is returned in ASN.1 DER format */ +int wc_RsaKeyToPublicDer_ex(RsaKey* key, byte* output, word32 inLen, + int with_header) +{ + return SetRsaPublicKey(output, key, inLen, with_header); +} + +#endif /* !NO_RSA && (WOLFSSL_CERT_GEN || WOLFSSL_KCAPI_RSA || + ((OPENSSL_EXTRA || WOLFSSL_KEY_GEN) && !HAVE_USER_RSA))) */ #if (defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || \ defined(WOLFSSL_KCAPI_RSA)) && !defined(NO_RSA) && !defined(HAVE_USER_RSA) @@ -21079,31 +21101,6 @@ int wc_RsaKeyToDer(RsaKey* key, byte* output, word32 inLen) #endif } - -/* Encode public RSA key in DER format. - * - * X.509: RFC 5280, 4.1 - SubjectPublicKeyInfo - * PKCS #1: RFC 8017, A.1.1 - RSAPublicKey - * - * @param [in] key RSA key object. - * @param [out] output Buffer to put encoded data in. - * @param [in] inLen Size of buffer in bytes. - * @return Size of encoded data in bytes on success. - * @return BAD_FUNC_ARG when key or output is NULL. - * @return MEMORY_E when dynamic memory allocation failed. - */ -int wc_RsaKeyToPublicDer(RsaKey* key, byte* output, word32 inLen) -{ - return SetRsaPublicKey(output, key, inLen, 1); -} - -/* Returns public DER version of the RSA key. If with_header is 0 then only a - * seq + n + e is returned in ASN.1 DER format */ -int wc_RsaKeyToPublicDer_ex(RsaKey* key, byte* output, word32 inLen, - int with_header) -{ - return SetRsaPublicKey(output, key, inLen, with_header); -} #endif /* (WOLFSSL_KEY_GEN || OPENSSL_EXTRA) && !NO_RSA && !HAVE_USER_RSA */ From 6795e1bf21035a8e02458b46b189ce22c7dc2658 Mon Sep 17 00:00:00 2001 From: David Garske Date: Wed, 15 Jun 2022 17:01:30 -0700 Subject: [PATCH 2/2] Attempt to fix issue with duplicate prototype `wc_RsaKeyToPublicDer` with FIPS v2 selftest. --- wolfssl/wolfcrypt/asn_public.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/wolfssl/wolfcrypt/asn_public.h b/wolfssl/wolfcrypt/asn_public.h index ac55d3be9..bafbd24d6 100644 --- a/wolfssl/wolfcrypt/asn_public.h +++ b/wolfssl/wolfcrypt/asn_public.h @@ -607,7 +607,10 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer); WOLFSSL_API int wc_RsaPublicKeyDecode_ex(const byte* input, word32* inOutIdx, word32 inSz, const byte** n, word32* nSz, const byte** e, word32* eSz); /* For FIPS v1/v2 and selftest this is in rsa.h */ - #if !defined(HAVE_SELFTEST) && (!defined(HAVE_FIPS) || \ + #if (!defined(HAVE_SELFTEST) || \ + (defined(HAVE_SELFTEST) && defined(WOLFSSL_CERT_GEN) && \ + !defined(WOLFSSL_KEY_GEN))) && \ + (!defined(HAVE_FIPS) || \ !defined(HAVE_FIPS_VERSION) || \ ((HAVE_FIPS_VERSION > 2) && \ (! ((HAVE_FIPS_VERSION == 5) && (HAVE_FIPS_VERSION_MINOR == 0)))))