X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=doc%2Fcrypto%2FRSA_set_method.pod;h=2c963d7e5bbaa0989b2572591122e26f91b4c79e;hp=8da805ff07845699c13e7cbe09e0c064c99167a6;hb=43d9e9d07fa3113203c60509c787c6fcc83bf821;hpb=2186cd8ef1c4db86109af7a38182c2bd9ddbbb32 diff --git a/doc/crypto/RSA_set_method.pod b/doc/crypto/RSA_set_method.pod index 8da805ff07..2c963d7e5b 100644 --- a/doc/crypto/RSA_set_method.pod +++ b/doc/crypto/RSA_set_method.pod @@ -3,60 +3,71 @@ =head1 NAME RSA_set_default_method, RSA_get_default_method, RSA_set_method, -RSA_get_method, RSA_PKCS1_SSLeay, RSA_PKCS1_RSAref, -RSA_PKCS1_null_method, RSA_flags, RSA_new_method - Select RSA method +RSA_get_method, RSA_PKCS1_SSLeay, RSA_null_method, RSA_flags, +RSA_new_method - select RSA method =head1 SYNOPSIS #include - void RSA_set_default_method(RSA_METHOD *meth); + void RSA_set_default_method(const RSA_METHOD *meth); RSA_METHOD *RSA_get_default_method(void); - RSA_METHOD *RSA_set_method(RSA *rsa, RSA_METHOD *meth); + int RSA_set_method(RSA *rsa, const RSA_METHOD *meth); - RSA_METHOD *RSA_get_method(RSA *rsa); + RSA_METHOD *RSA_get_method(const RSA *rsa); RSA_METHOD *RSA_PKCS1_SSLeay(void); - RSA_METHOD *RSA_PKCS1_RSAref(void); - RSA_METHOD *RSA_null_method(void); - int RSA_flags(RSA *rsa); + int RSA_flags(const RSA *rsa); RSA *RSA_new_method(RSA_METHOD *method); =head1 DESCRIPTION An B specifies the functions that OpenSSL uses for RSA -operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. - -Initially, the default is to use the OpenSSL internal implementation, -unless OpenSSL was configured with the C or C<-DRSA_NULL> -options. RSA_PKCS1_SSLeay() returns a pointer to that method. +operations. By modifying the method, alternative implementations such as +hardware accelerators may be used. IMPORTANT: See the NOTES section for +important information about how these RSA API functions are affected by the +use of B API calls. -RSA_PKCS1_RSAref() returns a pointer to a method that uses the RSAref -library. This is the default method in the C configuration; -the function is not available in other configurations. -RSA_null_method() returns a pointer to a method that does not support -the RSA transformation. It is the default if OpenSSL is compiled with -C<-DRSA_NULL>. These methods may be useful in the USA because of a -patent on the RSA cryptosystem. +Initially, the default RSA_METHOD is the OpenSSL internal implementation, +as returned by RSA_PKCS1_SSLeay(). -RSA_set_default_method() makes B the default method for all B -structures created later. +RSA_set_default_method() makes B the default method for all RSA +structures created later. B: This is true only whilst no ENGINE has +been set as a default for RSA, so this function is no longer recommended. RSA_get_default_method() returns a pointer to the current default -method. - -RSA_set_method() selects B for all operations using the key -B. - -RSA_get_method() returns a pointer to the method currently selected -for B. +RSA_METHOD. However, the meaningfulness of this result is dependent on +whether the ENGINE API is being used, so this function is no longer +recommended. + +RSA_set_method() selects B to perform all operations using the key +B. This will replace the RSA_METHOD used by the RSA key and if the +previous method was supplied by an ENGINE, the handle to that ENGINE will +be released during the change. It is possible to have RSA keys that only +work with certain RSA_METHOD implementations (eg. from an ENGINE module +that supports embedded hardware-protected keys), and in such cases +attempting to change the RSA_METHOD for the key can have unexpected +results. + +RSA_get_method() returns a pointer to the RSA_METHOD being used by B. +This method may or may not be supplied by an ENGINE implementation, but if +it is, the return value can only be guaranteed to be valid as long as the +RSA key itself is valid and does not have its implementation changed by +RSA_set_method(). + +RSA_flags() returns the B that are set for B's current +RSA_METHOD. See the BUGS section. + +RSA_new_method() allocates and initializes an RSA structure so that +B will be used for the RSA operations. If B is NULL, the +default ENGINE for RSA operations is used, and if no default ENGINE is set, +the RSA_METHOD controlled by RSA_set_default_method() is used. RSA_flags() returns the B that are set for B's current method. @@ -87,10 +98,11 @@ the default method is used. int (*rsa_priv_dec)(int flen, unsigned char *from, unsigned char *to, RSA *rsa, int padding); - /* compute r0 = r0 ^ I mod rsa->n. May be NULL */ + /* compute r0 = r0 ^ I mod rsa->n (May be NULL for some + implementations) */ int (*rsa_mod_exp)(BIGNUM *r0, BIGNUM *I, RSA *rsa); - /* compute r = a ^ p mod m. May be NULL */ + /* compute r = a ^ p mod m (May be NULL for some implementations) */ int (*bn_mod_exp)(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); @@ -126,22 +138,48 @@ the default method is used. =head1 RETURN VALUES -RSA_PKCS1_SSLeay(), RSA_PKCS1_RSAref(), RSA_PKCS1_null_method(), -RSA_get_default_method() and RSA_get_method() return pointers to the -respective Bs. +RSA_PKCS1_SSLeay(), RSA_PKCS1_null_method(), RSA_get_default_method() +and RSA_get_method() return pointers to the respective RSA_METHODs. RSA_set_default_method() returns no value. -RSA_set_method() returns a pointer to the B previously -associated with B. - -RSA_new_method() returns B and sets an error code that can be -obtained by ERR_get_error(3) if the allocation fails. Otherwise it -returns a pointer to the newly allocated structure. +RSA_set_method() returns a pointer to the old RSA_METHOD implementation +that was replaced. However, this return value should probably be ignored +because if it was supplied by an ENGINE, the pointer could be invalidated +at any time if the ENGINE is unloaded (in fact it could be unloaded as a +result of the RSA_set_method() function releasing its handle to the +ENGINE). For this reason, the return type may be replaced with a B +declaration in a future release. + +RSA_new_method() returns NULL and sets an error code that can be obtained +by L if the allocation fails. Otherwise +it returns a pointer to the newly allocated structure. + +=head1 NOTES + +As of version 0.9.7, RSA_METHOD implementations are grouped together with +other algorithmic APIs (eg. DSA_METHOD, EVP_CIPHER, etc) into B +modules. If a default ENGINE is specified for RSA functionality using an +ENGINE API function, that will override any RSA defaults set using the RSA +API (ie. RSA_set_default_method()). For this reason, the ENGINE API is the +recommended way to control default implementations for use in RSA and other +cryptographic algorithms. + +=head1 BUGS + +The behaviour of RSA_flags() is a mis-feature that is left as-is for now +to avoid creating compatibility problems. RSA functionality, such as the +encryption functions, are controlled by the B value in the RSA key +itself, not by the B value in the RSA_METHOD attached to the RSA key +(which is what this function returns). If the flags element of an RSA key +is changed, the changes will be honoured by RSA functionality but will not +be reflected in the return value of the RSA_flags() function - in effect +RSA_flags() behaves more like an RSA_default_flags() function (which does +not currently exist). =head1 SEE ALSO -rsa(3), RSA_new(3) +L, L =head1 HISTORY @@ -150,4 +188,15 @@ RSA_get_default_method(), RSA_set_method() and RSA_get_method() as well as the rsa_sign and rsa_verify components of RSA_METHOD were added in OpenSSL 0.9.4. +RSA_set_default_openssl_method() and RSA_get_default_openssl_method() +replaced RSA_set_default_method() and RSA_get_default_method() +respectively, and RSA_set_method() and RSA_new_method() were altered to use +Bs rather than Bs during development of the engine +version of OpenSSL 0.9.6. For 0.9.7, the handling of defaults in the ENGINE +API was restructured so that this change was reversed, and behaviour of the +other functions resembled more closely the previous behaviour. The +behaviour of defaults in the ENGINE API now transparently overrides the +behaviour of defaults in the RSA API without requiring changing these +function prototypes. + =cut