DESERIALIZER: Rethink password handling
authorRichard Levitte <levitte@openssl.org>
Mon, 27 Jul 2020 16:39:58 +0000 (18:39 +0200)
committerPauli <paul.dale@oracle.com>
Sat, 1 Aug 2020 01:51:18 +0000 (11:51 +1000)
commit4701f0a9a0ff08b354142c9f3b4797ff225d7c84
tree2fa4c9cc64badbf7499b41e9f333dcc95c1a53a5
parenta6495479adfb8dc0b500030d4eeb007d9af4572a
DESERIALIZER: Rethink password handling

The OSSL_DESERIALIZER API makes the incorrect assumption that the
caller must cipher and other pass phrase related parameters to the
individual desserializer implementations, when the reality is that
they only need a passphrase callback, and will be able to figure out
the rest themselves from the input they get.

We simplify it further by never passing any explicit passphrase to the
provider implementation, and simply have them call the passphrase
callback unconditionally when they need, leaving it to libcrypto code
to juggle explicit passphrases, cached passphrases and actual
passphrase callback calls.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12544)
13 files changed:
crypto/serializer/deserializer_lib.c
crypto/serializer/deserializer_meth.c
crypto/serializer/deserializer_pkey.c
crypto/serializer/serdes_pass.c
crypto/serializer/serializer_local.h
doc/man3/OSSL_DESERIALIZER_CTX_new_by_EVP_PKEY.pod
include/openssl/deserializer.h
providers/implementations/serializers/deserialize_common.c
providers/implementations/serializers/deserialize_der2rsa.c
providers/implementations/serializers/deserialize_pem2der.c
providers/implementations/serializers/serializer_local.h
test/serdes_test.c
util/libcrypto.num