wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix for PKCS7 sign to allow providing a public key only if using crypto callback w/devId. ZD13949.

Browse Source
This commit is contained in:
David Garske
2022-04-22 14:29:43 -07:00
parent ed58cfdc0f
commit 9cbf92df01
1 changed files with 42 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
wolfcrypt/src/pkcs7.c
View File

@ -1762,14 +1762,9 @@ static int wc_PKCS7_RsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
idx = 0;
ret = wc_RsaPrivateKeyDecode(pkcs7->privateKey, &idx, privKey,
pkcs7->privateKeySz);
}
else if (pkcs7->devId == INVALID_DEVID) {
ret = BAD_FUNC_ARG;
}
}
/* If not using old FIPS or CAVP selftest, or not using FAST,
or USER RSA, able to check RSA key. */
* or USER RSA, able to check RSA key. */
if (ret == 0) {
#if !defined(WOLFSSL_RSA_PUBLIC_ONLY) && !defined(HAVE_FAST_RSA) && \
!defined(HAVE_USER_RSA) && (!defined(HAVE_FIPS) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2))) && \
@ -1777,14 +1772,27 @@ static int wc_PKCS7_RsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
#if defined(WOLFSSL_KEY_GEN) && !defined(WOLFSSL_NO_RSA_KEY_CHECK)
/* verify imported private key is a valid key before using it */
if (ret == 0) {
ret = wc_CheckRsaKey(privKey);
if (ret != 0) {
WOLFSSL_MSG("Invalid RSA private key, check pkcs7->privateKey");
}
WOLFSSL_MSG("Invalid RSA private key, check "
"pkcs7->privateKey");
}
#endif
#endif
}
#ifdef WOLF_CRYPTO_CB
else if (ret == ASN_PARSE_E && pkcs7->devId != INVALID_DEVID) {
/* if using crypto callbacks, try public key decode */
idx = 0;
ret = wc_RsaPublicKeyDecode(pkcs7->privateKey, &idx, privKey,
pkcs7->privateKeySz);
}
#endif
}
else if (pkcs7->devId == INVALID_DEVID) {
ret = BAD_FUNC_ARG;
}
}
if (ret == 0) {
#ifdef WOLFSSL_ASYNC_CRYPT
@ -1844,17 +1852,25 @@ static int wc_PKCS7_EcdsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
idx = 0;
ret = wc_EccPrivateKeyDecode(pkcs7->privateKey, &idx, privKey,
pkcs7->privateKeySz);
}
else if (pkcs7->devId == INVALID_DEVID) {
ret = BAD_FUNC_ARG;
}
}
/* verify imported private key is a valid key before using it */
if (ret == 0) {
ret = wc_ecc_check_key(privKey);
if (ret != 0) {
WOLFSSL_MSG("Invalid ECC private key, check pkcs7->privateKey");
WOLFSSL_MSG("Invalid ECC private key, check "
"pkcs7->privateKey");
}
}
#ifdef WOLF_CRYPTO_CB
else if (ret == ASN_PARSE_E && pkcs7->devId != INVALID_DEVID) {
/* if using crypto callbacks, try public key decode */
idx = 0;
ret = wc_EccPublicKeyDecode(pkcs7->privateKey, &idx, privKey,
pkcs7->privateKeySz);
}
#endif
}
else if (pkcs7->devId == INVALID_DEVID) {
ret = BAD_FUNC_ARG;
}
}