This is needed for TLS-1.3.
Also add check for uncompressed point format for ECDHE as
the other formats are not allowed by RFC 8446.
Fixes #17667
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17678)
size_t ssl_hmac_size(const SSL_HMAC *ctx);
int ssl_get_EC_curve_nid(const EVP_PKEY *pkey);
+__owur int tls13_set_encoded_pub_key(EVP_PKEY *pkey,
+ const unsigned char *enckey,
+ size_t enckeylen);
typedef struct tls_group_info_st {
char *tlsname; /* Curve Name as in TLS specs */
return 0;
}
- if (EVP_PKEY_set1_encoded_public_key(skey, PACKET_data(&encoded_pt),
- PACKET_remaining(&encoded_pt)) <= 0) {
+ if (tls13_set_encoded_pub_key(skey, PACKET_data(&encoded_pt),
+ PACKET_remaining(&encoded_pt)) <= 0) {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
EVP_PKEY_free(skey);
return 0;
return 0;
}
- if (EVP_PKEY_set1_encoded_public_key(s->s3.peer_tmp,
- PACKET_data(&encoded_pt),
- PACKET_remaining(&encoded_pt)) <= 0) {
+ if (tls13_set_encoded_pub_key(s->s3.peer_tmp,
+ PACKET_data(&encoded_pt),
+ PACKET_remaining(&encoded_pt)) <= 0) {
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
return 0;
}
return NID_undef;
}
+
+__owur int tls13_set_encoded_pub_key(EVP_PKEY *pkey,
+ const unsigned char *enckey,
+ size_t enckeylen)
+{
+ if (EVP_PKEY_is_a(pkey, "DH")) {
+ int bits = EVP_PKEY_get_bits(pkey);
+
+ if (bits <= 0 || enckeylen != (size_t)bits / 8)
+ /* the encoded key must be padded to the length of the p */
+ return 0;
+ } else if (EVP_PKEY_is_a(pkey, "EC")) {
+ if (enckeylen < 3 /* point format and at least 1 byte for x and y */
+ || enckey[0] != 0x04)
+ return 0;
+ }
+
+ return EVP_PKEY_set1_encoded_public_key(pkey, enckey, enckeylen);
+}