wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-05 05:34:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Only allow TLS ECDH key sizes < 160-bits if ECC_WEAK_CURVES is defined.

Browse Source
This commit is contained in:
David Garske
2020-10-16 15:31:57 -07:00
parent c697520826
commit 6bd98afdd0
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/ssl.c
View File

@@ -10151,12 +10151,13 @@ int wolfSSL_use_certificate_chain_file_format(WOLFSSL* ssl, const char* file,
#ifdef HAVE_ECC #ifdef HAVE_ECC
/* Set Temp CTX EC-DHE size in octets, should be 14 - 66 for 112 - 521 bit */ /* Set Temp CTX EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz) int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
{ {
if (ctx == NULL) if (ctx == NULL)
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
/* if 0 then get from loaded private key */
if (sz == 0) { if (sz == 0) {
/* applies only to ECDSA */ /* applies only to ECDSA */
if (ctx->privateKeyType != ecc_dsa_sa_algo) if (ctx->privateKeyType != ecc_dsa_sa_algo)
@@ -10180,10 +10181,14 @@ int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
} }
/* Set Temp SSL EC-DHE size in octets, should be 14 - 66 for 112 - 521 bit */ /* Set Temp SSL EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL* ssl, word16 sz) int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL* ssl, word16 sz)
{ {
if (ssl == NULL || sz < ECC_MINSIZE || sz > ECC_MAXSIZE) if (ssl == NULL)
return BAD_FUNC_ARG;
/* check size */
if (sz < ECC_MINSIZE || sz > ECC_MAXSIZE)
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
ssl->eccTempKeySz = sz; ssl->eccTempKeySz = sz;

4
wolfssl/wolfcrypt/ecc.h
View File

@@ -125,7 +125,11 @@ enum {
ECC_MAXNAME = 16, /* MAX CURVE NAME LENGTH */ ECC_MAXNAME = 16, /* MAX CURVE NAME LENGTH */
SIG_HEADER_SZ = 7, /* ECC signature header size (30 81 87 02 42 [R] 02 42 [S]) */ SIG_HEADER_SZ = 7, /* ECC signature header size (30 81 87 02 42 [R] 02 42 [S]) */
ECC_BUFSIZE = 256, /* for exported keys temp buffer */ ECC_BUFSIZE = 256, /* for exported keys temp buffer */
#ifdef ECC_WEAK_CURVES
ECC_MINSIZE = 14, /* MIN Private Key size */ ECC_MINSIZE = 14, /* MIN Private Key size */
#else
ECC_MINSIZE = 20, /* MIN Private Key size */
#endif
ECC_MAXSIZE = 66, /* MAX Private Key size */ ECC_MAXSIZE = 66, /* MAX Private Key size */
ECC_MAXSIZE_GEN = 74, /* MAX Buffer size required when generating ECC keys*/ ECC_MAXSIZE_GEN = 74, /* MAX Buffer size required when generating ECC keys*/
ECC_MAX_OID_LEN = 16, ECC_MAX_OID_LEN = 16,