Add TLS RSA-PSS certificate support#4368
Conversation
Recognise RSA-PSS certificate algorithm and add a new certificate type.
richsalz
left a comment
There was a problem hiding this comment.
One nit. which only proves I read the diff :) you might want to have matt look at this PR. Or not.
ssl/t1_lib.c
Outdated
There was a problem hiding this comment.
blank line; flip this with the blank line that follows
Allo RSA certificate to be used for RSA-PSS signatures: this needs to be explicit because RSA and RSA-PSS certificates are now distinct types.
ssl/ssl_lib.c
Outdated
There was a problem hiding this comment.
Interesting the (preexisting) mismatch in this function as to whether braces are used for one-line conditional bodies.
ssl/ssl_lib.c
Outdated
There was a problem hiding this comment.
It might be more clear to make this a standalone 'if' clause instead of 'else if' (and outdent the comment to match, moving it outside the braces) -- there shouldn't be any functional change from doing so.
|
Can you also add tests that fail? |
ssl/ssl_locl.h
Outdated
There was a problem hiding this comment.
Not a fan of changing all these, but it's an internal data structure, so it shouldn't matter. (No change requested.)
|
OK added a couple of failing tests: PSS with no PSS signature algorithms and attempt to use PSS with TLS 1.1. |
|
Ping, any more comments? The two original reviews are for a previous version of this PR. |
|
No further comment from me; reconfirm +1 |
Recognise RSA-PSS certificate algorithm and add a new certificate type. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from #4368)
Allo RSA certificate to be used for RSA-PSS signatures: this needs to be explicit because RSA and RSA-PSS certificates are now distinct types. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from #4368)
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from #4368)
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from #4368)
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from #4368)
|
Thanks everyone, pushed. |
Checklist
This PR adds support for RSA-PSS certificate to TLS 1.3 and 1.2 as required by the current TLS 1.3 draft.