First of all the ECDSA_METHOD and ECDH_METHOD in 1.0.2 are combined into EC_KEY_METHOD on 1.1. Both versions have a *_new and *_set_verify.
"static ECDSA_METHOD my_own_openssl_ecdsa_meth" will not work anymore. Have a look at: https://github.com/OpenSC/libp11/blob/master/src/p11_ec.c It uses either: ops = ECDSA_METHOD_new((ECDSA_METHOD *)ECDSA_OpenSSL()); or ops = EC_KEY_METHOD_new((EC_KEY_METHOD *)EC_KEY_OpenSSL()); which copy the default structure to the new opaque structure. It then sets the routines it wants to change. On 7/21/2017 4:41 AM, Johannes Bauer wrote:
Hi list, I'm having the *exact* same issue that Jacques had 2 years ago: https://mta.openssl.org/pipermail/openssl-users/2015-June/001584.html I.e., I'm writing an OpenSSL 1.0.2 engine that does ECDSA signing. In my signing function, I want to verify the signature before leaving the callback. For that I need to use the *default* verification function. The problem is that ECDSA_METHOD is an opaque structure. It's only ever passed through reference (and has been forward-declared), but it's internal structure is defined in a localized crypto/ecdsa/ecs_locl.h header file. So two questions: When OpenSSL sees that the do_verify function in the callback has not been set, why does it not default to the internal definition instead of segfaulting? How do I get the function pointer to the default method do_verify? I.e., how do I do something like: ECDSA_METHOD_set_verify(ecdsa_method, ECDSA_get_default_method()->ecdsa_do_verify); Which currently (because of the opaque structure) results in: usockeng.c: In function ‘bind_fn’: usockeng.c:341:66: error: dereferencing pointer to incomplete type ‘ECDSA_METHOD {aka const struct ecdsa_method}’ There were two replies two years ago, both which don't help me: Rémy suggests (https://mta.openssl.org/pipermail/openssl-users/2015-June/001585.html) to define the engine's ECDSA_METHOD structure explicitly, like so: static ECDSA_METHOD my_own_openssl_ecdsa_meth = { "OpenSSL ECDSA method", my_own_ecdsa_do_sign_function, ecdsa_sign_setup_no_digest, ecdsa_do_verify, ... } This does not work (anymore?) because the stucture is opaque. Dmitry suggests (https://mta.openssl.org/pipermail/openssl-users/2015-June/001586.html) to use ECDSA_METHOD_set_sign_setup/ECDSA_METHOD_set_sign -- I don't understand this, since I did define set_sign (and it already works), but I need *verification*. Of course, the butt-ugly workaround would be to copy/paste the local structure definition in my engine code, creating a horribly unportable mess. But what's the *intended* way to solve this issue? Best regards, Johannes
-- Douglas E. Engert <deeng...@gmail.com> -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev