From a925f827ebbd25236c7449e179cfcd716af60379 Mon Sep 17 00:00:00 2001 From: rpm-build Date: Wed, 6 Mar 2024 19:17:15 +0100 Subject: [PATCH 10/57] RH: Disable explicit ec curves Patch-name: 0012-Disable-explicit-ec.patch Patch-id: 12 Patch-status: | # # Disable explicit EC curves # # https://bugzilla.redhat.com/show_bug.cgi?id=2066412 From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- crypto/ec/ec_asn1.c | 11 +++++++ crypto/ec/ec_lib.c | 8 ++++- test/ectest.c | 22 +++++++------- test/endecode_test.c | 30 +++++++++---------- .../30-test_evp_data/evppkey_ecdsa.txt | 12 -------- 5 files changed, 45 insertions(+), 38 deletions(-) diff --git a/crypto/ec/ec_asn1.c b/crypto/ec/ec_asn1.c index bfd0242c6f..bb462121b5 100644 --- a/crypto/ec/ec_asn1.c +++ b/crypto/ec/ec_asn1.c @@ -889,6 +889,12 @@ EC_GROUP *d2i_ECPKParameters(EC_GROUP **a, const unsigned char **in, long len) if (params->type == ECPKPARAMETERS_TYPE_EXPLICIT) group->decoded_from_explicit_params = 1; + if (EC_GROUP_check_named_curve(group, 0, NULL) == NID_undef) { + EC_GROUP_free(group); + ECPKPARAMETERS_free(params); + return NULL; + } + if (a) { EC_GROUP_free(*a); *a = group; @@ -948,6 +954,11 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len) goto err; } + if (EC_GROUP_check_named_curve(ret->group, 0, NULL) == NID_undef) { + ERR_raise(ERR_LIB_EC, EC_R_UNKNOWN_GROUP); + goto err; + } + ret->version = priv_key->version; if (priv_key->privateKey) { diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c index 13dcd29b11..de21cb2f10 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c @@ -1551,7 +1551,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], int is_prime_field = 1; BN_CTX *bnctx = NULL; const unsigned char *buf = NULL; - int encoding_flag = -1; + /* int encoding_flag = -1; */ #endif /* This is the simple named group case */ @@ -1726,6 +1726,11 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], goto err; } if (named_group == group) { + if (EC_GROUP_check_named_curve(group, 0, NULL) == NID_undef) { + ERR_raise(ERR_LIB_EC, EC_R_UNKNOWN_GROUP); + goto err; + } +#if 0 /* * If we did not find a named group then the encoding should be explicit * if it was specified @@ -1741,6 +1746,7 @@ EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[], goto err; } EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE); +#endif } else { EC_GROUP_free(group); group = named_group; diff --git a/test/ectest.c b/test/ectest.c index f243f6fb3c..d8246524f3 100644 --- a/test/ectest.c +++ b/test/ectest.c @@ -2791,11 +2791,12 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx, if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld)) || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL)) || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0) - || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkeyparam, + || !TEST_int_le(EVP_PKEY_fromdata(pctx, &pkeyparam, EVP_PKEY_KEY_PARAMETERS, params), 0)) goto err; - +/* As creating the key should fail, the rest of the test is pointless */ +# if 0 /*- Check that all the set values are retrievable -*/ /* There should be no match to a group name since the generator changed */ @@ -2924,6 +2925,7 @@ static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx, #endif ) goto err; +#endif ret = 1; err: BN_free(order_out); @@ -3217,21 +3219,21 @@ static int custom_params_test(int id) /* Compute keyexchange in both directions */ if (!TEST_ptr(pctx1 = EVP_PKEY_CTX_new(pkey1, NULL)) - || !TEST_int_eq(EVP_PKEY_derive_init(pctx1), 1) - || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx1, pkey2), 1) + || !TEST_int_le(EVP_PKEY_derive_init(pctx1), 0) +/* || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx1, pkey2), 1) || !TEST_int_eq(EVP_PKEY_derive(pctx1, NULL, &sslen), 1) || !TEST_int_gt(bsize, sslen) - || !TEST_int_eq(EVP_PKEY_derive(pctx1, buf1, &sslen), 1)) + || !TEST_int_eq(EVP_PKEY_derive(pctx1, buf1, &sslen), 1)*/) goto err; if (!TEST_ptr(pctx2 = EVP_PKEY_CTX_new(pkey2, NULL)) - || !TEST_int_eq(EVP_PKEY_derive_init(pctx2), 1) - || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx2, pkey1), 1) + || !TEST_int_le(EVP_PKEY_derive_init(pctx2), 1) +/* || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx2, pkey1), 1) || !TEST_int_eq(EVP_PKEY_derive(pctx2, NULL, &t), 1) || !TEST_int_gt(bsize, t) || !TEST_int_le(sslen, t) - || !TEST_int_eq(EVP_PKEY_derive(pctx2, buf2, &t), 1)) + || !TEST_int_eq(EVP_PKEY_derive(pctx2, buf2, &t), 1) */) goto err; - +#if 0 /* Both sides should expect the same shared secret */ if (!TEST_mem_eq(buf1, sslen, buf2, t)) goto err; @@ -3286,7 +3288,7 @@ static int custom_params_test(int id) /* compare with previous result */ || !TEST_mem_eq(buf1, t, buf2, sslen)) goto err; - +#endif ret = 1; err: diff --git a/test/endecode_test.c b/test/endecode_test.c index 3f8ed7f392..c3b55af3e7 100644 --- a/test/endecode_test.c +++ b/test/endecode_test.c @@ -63,7 +63,7 @@ static BN_CTX *bnctx = NULL; static OSSL_PARAM_BLD *bld_prime_nc = NULL; static OSSL_PARAM_BLD *bld_prime = NULL; static OSSL_PARAM *ec_explicit_prime_params_nc = NULL; -static OSSL_PARAM *ec_explicit_prime_params_explicit = NULL; +/*static OSSL_PARAM *ec_explicit_prime_params_explicit = NULL;*/ #ifndef OPENSSL_NO_EC2M static OSSL_PARAM_BLD *bld_tri_nc = NULL; @@ -1013,10 +1013,10 @@ IMPLEMENT_TEST_SUITE_LEGACY(EC, "EC") DOMAIN_KEYS(ECExplicitPrimeNamedCurve); IMPLEMENT_TEST_SUITE(ECExplicitPrimeNamedCurve, "EC", 1) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve, "EC") -DOMAIN_KEYS(ECExplicitPrime2G); -IMPLEMENT_TEST_SUITE(ECExplicitPrime2G, "EC", 0) -IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrime2G, "EC") -#ifndef OPENSSL_NO_EC2M +/*DOMAIN_KEYS(ECExplicitPrime2G);*/ +/*IMPLEMENT_TEST_SUITE(ECExplicitPrime2G, "EC", 0)*/ +/*IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitPrime2G, "EC")*/ +# ifndef OPENSSL_NO_EC2M DOMAIN_KEYS(ECExplicitTriNamedCurve); IMPLEMENT_TEST_SUITE(ECExplicitTriNamedCurve, "EC", 1) IMPLEMENT_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve, "EC") @@ -1458,8 +1458,8 @@ int setup_tests(void) || !create_ec_explicit_prime_params_namedcurve(bld_prime_nc) || !create_ec_explicit_prime_params(bld_prime) || !TEST_ptr(ec_explicit_prime_params_nc = OSSL_PARAM_BLD_to_param(bld_prime_nc)) - || !TEST_ptr(ec_explicit_prime_params_explicit = OSSL_PARAM_BLD_to_param(bld_prime)) -#ifndef OPENSSL_NO_EC2M +/* || !TEST_ptr(ec_explicit_prime_params_explicit = OSSL_PARAM_BLD_to_param(bld_prime))*/ +# ifndef OPENSSL_NO_EC2M || !TEST_ptr(bld_tri_nc = OSSL_PARAM_BLD_new()) || !TEST_ptr(bld_tri = OSSL_PARAM_BLD_new()) || !create_ec_explicit_trinomial_params_namedcurve(bld_tri_nc) @@ -1486,8 +1486,8 @@ int setup_tests(void) TEST_info("Generating EC keys..."); MAKE_DOMAIN_KEYS(EC, "EC", EC_params); MAKE_DOMAIN_KEYS(ECExplicitPrimeNamedCurve, "EC", ec_explicit_prime_params_nc); - MAKE_DOMAIN_KEYS(ECExplicitPrime2G, "EC", ec_explicit_prime_params_explicit); -#ifndef OPENSSL_NO_EC2M +/* MAKE_DOMAIN_KEYS(ECExplicitPrime2G, "EC", ec_explicit_prime_params_explicit);*/ +# ifndef OPENSSL_NO_EC2M MAKE_DOMAIN_KEYS(ECExplicitTriNamedCurve, "EC", ec_explicit_tri_params_nc); MAKE_DOMAIN_KEYS(ECExplicitTri2G, "EC", ec_explicit_tri_params_explicit); #endif @@ -1566,9 +1566,9 @@ int setup_tests(void) ADD_TEST_SUITE_LEGACY(EC); ADD_TEST_SUITE(ECExplicitPrimeNamedCurve); ADD_TEST_SUITE_LEGACY(ECExplicitPrimeNamedCurve); - ADD_TEST_SUITE(ECExplicitPrime2G); - ADD_TEST_SUITE_LEGACY(ECExplicitPrime2G); -#ifndef OPENSSL_NO_EC2M +/* ADD_TEST_SUITE(ECExplicitPrime2G);*/ +/* ADD_TEST_SUITE_LEGACY(ECExplicitPrime2G);*/ +# ifndef OPENSSL_NO_EC2M ADD_TEST_SUITE(ECExplicitTriNamedCurve); ADD_TEST_SUITE_LEGACY(ECExplicitTriNamedCurve); ADD_TEST_SUITE(ECExplicitTri2G); @@ -1644,7 +1644,7 @@ void cleanup_tests(void) { #ifndef OPENSSL_NO_EC OSSL_PARAM_free(ec_explicit_prime_params_nc); - OSSL_PARAM_free(ec_explicit_prime_params_explicit); +/* OSSL_PARAM_free(ec_explicit_prime_params_explicit);*/ OSSL_PARAM_BLD_free(bld_prime_nc); OSSL_PARAM_BLD_free(bld_prime); #ifndef OPENSSL_NO_EC2M @@ -1666,8 +1666,8 @@ void cleanup_tests(void) #ifndef OPENSSL_NO_EC FREE_DOMAIN_KEYS(EC); FREE_DOMAIN_KEYS(ECExplicitPrimeNamedCurve); - FREE_DOMAIN_KEYS(ECExplicitPrime2G); -#ifndef OPENSSL_NO_EC2M +/* FREE_DOMAIN_KEYS(ECExplicitPrime2G);*/ +# ifndef OPENSSL_NO_EC2M FREE_DOMAIN_KEYS(ECExplicitTriNamedCurve); FREE_DOMAIN_KEYS(ECExplicitTri2G); #endif diff --git a/test/recipes/30-test_evp_data/evppkey_ecdsa.txt b/test/recipes/30-test_evp_data/evppkey_ecdsa.txt index 07dc4b4298..4c47fa68c2 100644 --- a/test/recipes/30-test_evp_data/evppkey_ecdsa.txt +++ b/test/recipes/30-test_evp_data/evppkey_ecdsa.txt @@ -133,18 +133,6 @@ AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQgiUTxtr5vLVjj 3ev1gTwRBduzqqlwd54AUSgI+pjttW8zrWNitO8H1sf59MPWOESKxNtZ1+Nl -----END PRIVATE KEY----- -PrivateKey = EC_EXPLICIT ------BEGIN PRIVATE KEY----- -MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB -AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA -///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV -AMSdNgiG5wSTamZ44ROdJreBn36QBEEE5JcIvn36opqjEm/k59Al40rBAxWM2TPG -l0L13Je51zHpfXQ9Z2o7IQicMXP4wSfJ0qCgg2bgydqoxlYrlLGuVQIhAP////8A -AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQgec92jwduadCk -OjoNRI+YT5Be5TkzZXzYCyTLkMOikDmhRANCAATtECEhQbLEaiUj/Wu0qjcr81lL -46dx5zYgArz/iaSNJ3W80oO+F7v04jlQ7wxQzg96R0bwKiMeq5CcW9ZFt6xg ------END PRIVATE KEY----- - PrivateKey = B-163 -----BEGIN PRIVATE KEY----- MGMCAQAwEAYHKoZIzj0CAQYFK4EEAA8ETDBKAgEBBBUDnQW0mLiHVha/jqFznX/K -- 2.52.0