diff options
| author | Joe Truba <joe@bannable.net> | 2022-11-20 00:54:32 +0000 |
|---|---|---|
| committer | Kazuki Yamaguchi <k@rhe.jp> | 2022-12-23 09:39:15 +0900 |
| commit | 0e11d2c3f8a74d2310efa67179b50c12acb3fa42 (patch) | |
| tree | b100e2961fb88997a25aa0480237e5bd18a61532 /ext/openssl/ossl_pkey_ec.c | |
| parent | 782777a803f990f688579db50c938d1a80a5f24a (diff) | |
[ruby/openssl] pkey/ec: check private key validity with OpenSSL 3
The behavior of EVP_PKEY_public_check changed between OpenSSL 1.1.1
and 3.0 so that it no longer validates the private key. Instead, private
keys can be validated through EVP_PKEY_private_check and
EVP_PKEY_pairwise_check.
[ky: simplified condition to use either EVP_PKEY_check() or
EVP_PKEY_public_check().]
https://github.com/ruby/openssl/commit/e38a63ab3d
Diffstat (limited to 'ext/openssl/ossl_pkey_ec.c')
| -rw-r--r-- | ext/openssl/ossl_pkey_ec.c | 22 |
1 files changed, 17 insertions, 5 deletions
diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c index 2ae1ee32d3..a59849f719 100644 --- a/ext/openssl/ossl_pkey_ec.c +++ b/ext/openssl/ossl_pkey_ec.c @@ -483,16 +483,28 @@ static VALUE ossl_ec_key_check_key(VALUE self) #ifdef HAVE_EVP_PKEY_CHECK EVP_PKEY *pkey; EVP_PKEY_CTX *pctx; - int ret; + EC_KEY *ec; GetPKey(self, pkey); + GetEC(self, ec); pctx = EVP_PKEY_CTX_new(pkey, /* engine */NULL); if (!pctx) - ossl_raise(eDHError, "EVP_PKEY_CTX_new"); - ret = EVP_PKEY_public_check(pctx); + ossl_raise(eECError, "EVP_PKEY_CTX_new"); + + if (EC_KEY_get0_private_key(ec) != NULL) { + if (EVP_PKEY_check(pctx) != 1) { + EVP_PKEY_CTX_free(pctx); + ossl_raise(eECError, "EVP_PKEY_check"); + } + } + else { + if (EVP_PKEY_public_check(pctx) != 1) { + EVP_PKEY_CTX_free(pctx); + ossl_raise(eECError, "EVP_PKEY_public_check"); + } + } + EVP_PKEY_CTX_free(pctx); - if (ret != 1) - ossl_raise(eECError, "EVP_PKEY_public_check"); #else EC_KEY *ec; |