|
 |
f57b16 |
diff -up openssl-3.0.1/crypto/ec/ec_lib.c.disable_explicit_ec openssl-3.0.1/crypto/ec/ec_lib.c
|
|
|
f57b16 |
--- openssl-3.0.1/crypto/ec/ec_lib.c.disable_explicit_ec 2022-02-22 09:08:48.557823665 +0100
|
|
|
f57b16 |
+++ openssl-3.0.1/crypto/ec/ec_lib.c 2022-02-22 09:09:26.634133847 +0100
|
|
|
f57b16 |
@@ -1458,7 +1458,7 @@ static EC_GROUP *ec_group_explicit_to_na
|
|
|
f57b16 |
goto err;
|
|
|
f57b16 |
}
|
|
|
f57b16 |
} else {
|
|
|
f57b16 |
- ret_group = (EC_GROUP *)group;
|
|
|
f57b16 |
+ goto err;
|
|
|
f57b16 |
}
|
|
|
f57b16 |
EC_GROUP_free(dup);
|
|
|
f57b16 |
return ret_group;
|
|
|
f57b16 |
diff -up openssl-3.0.1/providers/implementations/keymgmt/ec_kmgmt.c.disable_explicit_ec openssl-3.0.1/providers/implementations/keymgmt/ec_kmgmt.c
|
|
|
f57b16 |
--- openssl-3.0.1/providers/implementations/keymgmt/ec_kmgmt.c.disable_explicit_ec 2022-02-22 13:04:16.850856612 +0100
|
|
|
f57b16 |
+++ openssl-3.0.1/providers/implementations/keymgmt/ec_kmgmt.c 2022-02-22 14:16:19.848369641 +0100
|
|
|
f57b16 |
@@ -936,11 +936,8 @@ int ec_validate(const void *keydata, int
|
|
|
f57b16 |
if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0) {
|
|
|
f57b16 |
int flags = EC_KEY_get_flags(eck);
|
|
|
f57b16 |
|
|
|
f57b16 |
- if ((flags & EC_FLAG_CHECK_NAMED_GROUP) != 0)
|
|
|
f57b16 |
- ok = ok && EC_GROUP_check_named_curve(EC_KEY_get0_group(eck),
|
|
|
f57b16 |
- (flags & EC_FLAG_CHECK_NAMED_GROUP_NIST) != 0, ctx);
|
|
|
f57b16 |
- else
|
|
|
f57b16 |
- ok = ok && EC_GROUP_check(EC_KEY_get0_group(eck), ctx);
|
|
|
f57b16 |
+ ok = ok && EC_GROUP_check_named_curve(EC_KEY_get0_group(eck),
|
|
|
f57b16 |
+ (flags & EC_FLAG_CHECK_NAMED_GROUP_NIST) != 0, ctx);
|
|
|
f57b16 |
}
|
|
|
f57b16 |
|
|
|
f57b16 |
if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
|
|
|
f57b16 |
@@ -1217,6 +1214,10 @@ static int ec_gen_assign_group(EC_KEY *e
|
|
|
f57b16 |
ERR_raise(ERR_LIB_PROV, PROV_R_NO_PARAMETERS_SET);
|
|
|
f57b16 |
return 0;
|
|
|
f57b16 |
}
|
|
|
f57b16 |
+ if (EC_GROUP_get_curve_name(group) == NID_undef) {
|
|
|
f57b16 |
+ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_CURVE);
|
|
|
f57b16 |
+ return 0;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
return EC_KEY_set_group(ec, group) > 0;
|
|
|
f57b16 |
}
|
|
|
f57b16 |
|
|
|
f57b16 |
diff -up openssl-3.0.1/providers/common/securitycheck.c.disable_explicit_ec openssl-3.0.1/providers/common/securitycheck.c
|
|
|
f57b16 |
--- openssl-3.0.1/providers/common/securitycheck.c.disable_explicit_ec 2022-02-25 11:44:19.554673396 +0100
|
|
|
f57b16 |
+++ openssl-3.0.1/providers/common/securitycheck.c 2022-02-25 12:16:38.168610089 +0100
|
|
|
f57b16 |
@@ -93,22 +93,22 @@ int ossl_rsa_check_key(OSSL_LIB_CTX *ctx
|
|
|
f57b16 |
int ossl_ec_check_key(OSSL_LIB_CTX *ctx, const EC_KEY *ec, int protect)
|
|
|
f57b16 |
{
|
|
|
f57b16 |
# if !defined(OPENSSL_NO_FIPS_SECURITYCHECKS)
|
|
|
f57b16 |
- if (ossl_securitycheck_enabled(ctx)) {
|
|
|
f57b16 |
- int nid, strength;
|
|
|
f57b16 |
- const char *curve_name;
|
|
|
f57b16 |
- const EC_GROUP *group = EC_KEY_get0_group(ec);
|
|
|
f57b16 |
+ int nid, strength;
|
|
|
f57b16 |
+ const char *curve_name;
|
|
|
f57b16 |
+ const EC_GROUP *group = EC_KEY_get0_group(ec);
|
|
|
f57b16 |
|
|
|
f57b16 |
- if (group == NULL) {
|
|
|
f57b16 |
- ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_CURVE, "No group");
|
|
|
f57b16 |
- return 0;
|
|
|
f57b16 |
- }
|
|
|
f57b16 |
- nid = EC_GROUP_get_curve_name(group);
|
|
|
f57b16 |
- if (nid == NID_undef) {
|
|
|
f57b16 |
- ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_CURVE,
|
|
|
f57b16 |
- "Explicit curves are not allowed in fips mode");
|
|
|
f57b16 |
- return 0;
|
|
|
f57b16 |
- }
|
|
|
f57b16 |
+ if (group == NULL) {
|
|
|
f57b16 |
+ ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_CURVE, "No group");
|
|
|
f57b16 |
+ return 0;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
+ nid = EC_GROUP_get_curve_name(group);
|
|
|
f57b16 |
+ if (nid == NID_undef) {
|
|
|
f57b16 |
+ ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_CURVE,
|
|
|
f57b16 |
+ "Explicit curves are not allowed in this build");
|
|
|
f57b16 |
+ return 0;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
|
|
|
f57b16 |
+ if (ossl_securitycheck_enabled(ctx)) {
|
|
|
f57b16 |
curve_name = EC_curve_nid2nist(nid);
|
|
|
f57b16 |
if (curve_name == NULL) {
|
|
|
f57b16 |
ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_CURVE,
|