Skip to content

Implement asymmetric cipher support#10152

Closed
mattcaswell wants to merge 16 commits intoopenssl:masterfrom
mattcaswell:asymcipher
Closed

Implement asymmetric cipher support#10152
mattcaswell wants to merge 16 commits intoopenssl:masterfrom
mattcaswell:asymcipher

Conversation

@mattcaswell
Copy link
Member

This PR implements asymmetric cipher support for providers, and moves that aspect of RSA into the default provider.

This is WIP because there are a number of outstanding issues:

  • Test failure in CMS for unknown reasons
  • There's a weird memory issue I need to investigate
  • It currently doesn't merge with master because of @levitte moving everything around under my feet :-)
  • Needs some documentation updates

@beldmit
Copy link
Member

beldmit commented Oct 11, 2019

I strongly support your intention because I need to do the same exercise with the GOST engine. BTW, are there any guidelines available?

@mattcaswell
Copy link
Member Author

I strongly support your intention because I need to do the same exercise with the GOST engine. BTW, are there any guidelines available?

For this PR specifically? No, not yet. Documentation is not yet done (part of the reason this is WIP).

If you're after more general provider documentation I suggest you start here:

https://www.openssl.org/docs/manmaster/man7/provider.html

@levitte
Copy link
Member

levitte commented Oct 11, 2019

It currently doesn't merge with master because of @levitte moving everything around under my feet :-)

I love it when you feign innocence 😉

@levitte
Copy link
Member

levitte commented Oct 11, 2019

CMS seems to be the hardest battlefront, constantly. I've stopped counting the times I got stuck with an issue there...

@t8m
Copy link
Member

t8m commented Oct 14, 2019

CMS seems to be the hardest battlefront, constantly. I've stopped counting the times I got stuck with an issue there...

On the other hand it provides a good testing ground on what weird API calls can be expected from third party apps.

@levitte
Copy link
Member

levitte commented Oct 14, 2019

On the other hand it provides a good testing ground on what weird API calls can be expected from third party apps.

I know, right? Infuriating as it can be, it has helped to cut down a number of corner cases!

@mattcaswell
Copy link
Member Author

Rebased so that it now merges cleanly with master.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the very least, I would like to see aliases with rsa_ removed.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are legacy ctrls - so I'm not sure why we would add new aliases for them?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because -pkeyopt keys will eventually be directly used as OSSL_PARAM keys, and we might as well allow the legacy controls to be accessed with similar names (plus it's a pet peeve of mine... I have never understood why it couldn't simply be "mode", for example)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any more thoughts on this?

@levitte
Copy link
Member

levitte commented Oct 14, 2019

First quick look, looks good. I suspect that some amendment will be needed related to #9979

Copy link
Member

@levitte levitte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're doing double work... I've RSA stuff in my key generation branch 😒

@mattcaswell
Copy link
Member Author

We're doing double work... I've RSA stuff in my key generation branch

As soon as #10190 is done I'll rebase on top of that is remove any RSA export/import stuff from here.

@levitte
Copy link
Member

levitte commented Oct 16, 2019

We're doing double work... I've RSA stuff in my key generation branch

This does show that we might do well to split some of our PRs topic-wise... I often try to do that when I discover that something I'm working on contains more general components; I often end up making those into separate PRs, which also helps keep each PR in focus.

@mattcaswell
Copy link
Member Author

I've rebased this on top of latest master to pick up @levitte's work from #10190. I've also fixed various bugs, and I'm now getting a clean test run (at least locally).

The main outstanding thing is documentation now.

@levitte
Copy link
Member

levitte commented Nov 4, 2019

Please rebase this

@mattcaswell mattcaswell changed the title WIP: Implement asymmetric cipher support Implement asymmetric cipher support Nov 6, 2019
@mattcaswell
Copy link
Member Author

This has now been rebased and all missing documentation has been added. I've taken this out of WIP. Please take a look!

@mattcaswell
Copy link
Member Author

Fixup pushed to address travis failure.

Copy link
Member

@levitte levitte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, didn't we discuss EVP_PKEY_CTX_get_rsa_oaep_md_name and EVP_PKEY_CTX_get_rsa_mgf1_md_name as alternatives that return strings instead of const EVP_MD *?

@mattcaswell
Copy link
Member Author

Also, didn't we discuss EVP_PKEY_CTX_get_rsa_oaep_md_name and EVP_PKEY_CTX_get_rsa_mgf1_md_name as alternatives that return strings instead of const EVP_MD *?

Oh, yes. So we did. I forgot. Will add.

@levitte levitte added approval: review pending This pull request needs review by a committer and removed approval: done This pull request has the required number of approvals labels Nov 12, 2019
@mattcaswell
Copy link
Member Author

Fixup commits pushed addressing latest feedback.

Copy link
Member

@slontis slontis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mattcaswell
Copy link
Member Author

mattcaswell commented Nov 12, 2019

LGTM

Is that intended to be an approval?

@levitte can you reconfirm?

I cant approve as Pauli already has - I approve in theory.

@slontis slontis requested a review from levitte November 13, 2019 03:37
@levitte levitte added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Nov 13, 2019
@mattcaswell mattcaswell added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Nov 14, 2019
@mattcaswell
Copy link
Member Author

Pushed. Thanks!

openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
Sometimes it is valid to send a NULL pointer in params.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
Sometimes it is useful to be able to pass NULL/zero length strings

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
The old value of 10 for OSSL_PARAM_BLD_MAX is insufficient for multi-prime
RSA. That code has this assert:

        if (!ossl_assert(/* n, e */ 2 + /* d */ 1 + /* numprimes */ 1
                         + numprimes + numexps + numcoeffs
                         <= OSSL_PARAM_BLD_MAX))
            goto err;

So we increase OSSL_PARAM_BLD_MAX which would be enough for 7 primes
(more than you would ever reasonably want).

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
openssl-machine pushed a commit that referenced this pull request Nov 14, 2019
We have converted a number of macros to functions and made them work
with providers. We've also added some *_ex() variants that needed
documenting.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from #10152)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approval: ready to merge The 24 hour grace period has passed, ready to merge branch: master Applies to master branch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants