public/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

apps/pkeyutl: Fix checks and documentation regarding -peerkey

Browse source 
Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25958)
This commit is contained in:
Dr. David von Oheimb 2024-11-14 09:28:16 +01:00 • committed by Tomas Mraz
parent 563f6b6573
commit ddae593a92
2 changed files with 30 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

21
apps/pkeyutl.c
View file

@ -81,7 +81,7 @@ const OPTIONS pkeyutl_options[] = {
{"verify", OPT_VERIFY, '-', "Verify with public key"}, {"verify", OPT_VERIFY, '-', "Verify with public key"},
{"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"}, {"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"},
{"decrypt", OPT_DECRYPT, '-', "Decrypt input data with private key"}, {"decrypt", OPT_DECRYPT, '-', "Decrypt input data with private key"},
{"derive", OPT_DERIVE, '-', "Derive shared secret"}, {"derive", OPT_DERIVE, '-', "Derive shared secret from own and peer (EC)DH keys"},
{"decap", OPT_DECAP, '-', "Decapsulate shared secret"}, {"decap", OPT_DECAP, '-', "Decapsulate shared secret"},
{"encap", OPT_ENCAP, '-', "Encapsulate shared secret"}, {"encap", OPT_ENCAP, '-', "Encapsulate shared secret"},
OPT_CONFIG_OPTION, OPT_CONFIG_OPTION,
@ -310,7 +310,11 @@ int pkeyutl_main(int argc, char **argv)
goto opthelp; goto opthelp;
} else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) { } else if (peerkey != NULL && pkey_op != EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err, BIO_printf(bio_err,
"%s: no peer key given (-peerkey parameter).\n", prog); "%s: -peerkey option not allowed without -derive.\n", prog);
goto opthelp;
} else if (peerkey == NULL && pkey_op == EVP_PKEY_OP_DERIVE) {
BIO_printf(bio_err,
"%s: missing -peerkey option for -derive operation.\n", prog);
goto opthelp; goto opthelp;
} }
@ -739,9 +743,10 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file, static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
ENGINE *e) ENGINE *e)
{ {
EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx);
EVP_PKEY *peer = NULL; EVP_PKEY *peer = NULL;
ENGINE *engine = NULL; ENGINE *engine = NULL;
int ret; int ret = 1;
if (peerform == FORMAT_ENGINE) if (peerform == FORMAT_ENGINE)
engine = e; engine = e;
@ -750,8 +755,14 @@ static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
BIO_printf(bio_err, "Error reading peer key %s\n", file); BIO_printf(bio_err, "Error reading peer key %s\n", file);
return 0; return 0;
} }
if (strcmp(EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey)) != 0) {
ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0; BIO_printf(bio_err,
"Type of peer public key: %s does not match type of private key: %s\n",
EVP_PKEY_get0_type_name(peer), EVP_PKEY_get0_type_name(pkey));
ret = 0;
} else {
ret = EVP_PKEY_derive_set_peer(ctx, peer) > 0;
}
EVP_PKEY_free(peer); EVP_PKEY_free(peer);
return ret; return ret;

26
doc/man1/openssl-pkeyutl.pod.in
View file

@ -18,8 +18,6 @@ B<openssl> B<pkeyutl>
[B<-inkey> I<filename>|I<uri>] [B<-inkey> I<filename>|I<uri>]
[B<-keyform> B<DER>|B<PEM>|B<P12>|B<ENGINE>] [B<-keyform> B<DER>|B<PEM>|B<P12>|B<ENGINE>]
[B<-passin> I<arg>] [B<-passin> I<arg>]
[B<-peerkey> I<file>]
[B<-peerform> B<DER>|B<PEM>|B<P12>|B<ENGINE>]
[B<-pubin>] [B<-pubin>]
[B<-certin>] [B<-certin>]
[B<-rev>] [B<-rev>]
@ -29,6 +27,8 @@ B<openssl> B<pkeyutl>
[B<-encrypt>] [B<-encrypt>]
[B<-decrypt>] [B<-decrypt>]
[B<-derive>] [B<-derive>]
[B<-peerkey> I<file>]
[B<-peerform> B<DER>|B<PEM>|B<P12>|B<ENGINE>]
[B<-encap>] [B<-encap>]
[B<-decap>] [B<-decap>]
[B<-kdf> I<algorithm>] [B<-kdf> I<algorithm>]
@ -120,15 +120,6 @@ See L<openssl-format-options(1)> for details.
The input key password source. For more information about the format of I<arg> The input key password source. For more information about the format of I<arg>
see L<openssl-passphrase-options(1)>. see L<openssl-passphrase-options(1)>.
=item B<-peerkey> I<file>
The peer key file, used by key derivation (agreement) operations.
=item B<-peerform> B<DER>|B<PEM>|B<P12>|B<ENGINE>
The peer key format; unspecified by default.
See L<openssl-format-options(1)> for details.
=item B<-pubin> =item B<-pubin>
By default a private key is read from the key input. By default a private key is read from the key input.
@ -189,7 +180,18 @@ Decrypt the input data using a private key.
=item B<-derive> =item B<-derive>
Derive a shared secret using the peer key. Derive a shared secret using own private (EC)DH key and peer key.
=item B<-peerkey> I<file>
File containing the peer public or private (EC)DH key
to use with the key derivation (agreement) operation.
Its type must match the type of the own private key given with B<-inkey>.
=item B<-peerform> B<DER>|B<PEM>|B<P12>|B<ENGINE>
The peer key format; unspecified by default.
See L<openssl-format-options(1)> for details.
=item B<-encap> =item B<-encap>