[openssl-dev] [openssl.org #3922] Bug: EVP_get_digestbynid() does not support ECDSA
Ah, the endless confusion of cipher vs signature NID's :) closing ticket. -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=3922 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] [openssl.org #3922] Bug: EVP_get_digestbynid() does not support ECDSA
Thanks a lot Steve for your constructive comments. > That's expected behaviour. The EVP_get_digestbynid funtion expects a digest > NID > whereas you are passing a signature NID instead. It does accept some signature > NIDs for historical compatibility reasons. I now understand that the code I extended for EC support was abusing EVP_get_digestbynid(), which worked just for compatibility reasons for RSA (only). Yet why not broaden this function (or better its underlying mapping) to handle ECDSA (and possibly any other types of) signatures. > The thread you mention shows you how to convert a signature NID into the > digest > and public key algorithm NID. The hint you gave in that thread was to use OBJ_find_sigid_algs() and this indeed works fine and is cleaner :-) > However I suspect you shouldn't be trying to do things at that level for > signatures. If you need to sign or verify ASN.1 data you can use > ASN1_item_sign > or ASN1_item_verify and key and digest handling and lookup is handled > automatically. Good point that they better should have used a more high-level signature/verification function. Yet the proposed functions, as well as ASN1_sign and ASN1_verify, still require the (plain) md parameter. And for instance the more abstract function int PKCS7_SIGNER_INFO_sign(PKCS7_SIGNER_INFO *si) uses again md = EVP_get_digestbyobj(si->digest_alg->algorithm); such that the use of OBJ_find_sigid_algs() appears indispensable. David. ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #3922] Bug: EVP_get_digestbynid() does not support ECDSA
On Mon Jun 22 20:07:43 2015, david.von.ohe...@siemens.com wrote: > Hi OpenSSL maintainers, > > I tried checking the status of the EVP_get_digestbynid issue via > http://rt.openssl.org/Install/index.html > but the server appears currently misconfigured: > > Config file /etc/request-tracker4/RT_SiteConfig.pm is locked > > Yet I found an old conversation on this topic: > http://openssl.6102.n7.nabble.com/Question-about-EVP-get-digestbynid- > and-ECDSA-td28312.html > > With OpenSSL 1.0.2 one still gets NULL when giving ECDSA NIDs as > input. > Here is the workaround we currently use for EC support in > CMPforOpenSSL: > That's expected behaviour. The EVP_get_digestbynid funtion expects a digest NID whereas you are passing a signature NID instead. It does accept some signature NIDs for historical compatibility reasons. The thread you mention shows you how to convert a signature NID into the digest and public key algorithm NID. However I suspect you shouldn't be trying to do things at that level for signatures. If you need to sign or verify ASN.1 data you can use ASN1_item_sign or ASN1_item_verify and key and digest handling and lookup is handled automatically. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ___ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #3922] Bug: EVP_get_digestbynid() does not support ECDSA
Hi OpenSSL maintainers,
I tried checking the status of the EVP_get_digestbynid issue via
http://rt.openssl.org/Install/index.html
but the server appears currently misconfigured:
> Config file /etc/request-tracker4/RT_SiteConfig.pm is locked
Yet I found an old conversation on this topic:
http://openssl.6102.n7.nabble.com/Question-about-EVP-get-digestbynid-and-ECDSA-td28312.html
With OpenSSL 1.0.2 one still gets NULL when giving ECDSA NIDs as input.
Here is the workaround we currently use for EC support in CMPforOpenSSL:
> const EVP_MD *extended_EVP_get_digestbynid(int nid) {
> switch (nid) {
> case NID_ecdsa_with_SHA1:
> return EVP_sha1();
> case NID_ecdsa_with_SHA224:
> return EVP_sha224();
> case NID_ecdsa_with_SHA256:
> return EVP_sha256();
> case NID_ecdsa_with_SHA384:
> return EVP_sha384();
> case NID_ecdsa_with_SHA512:
> return EVP_sha512();
> default:
> return EVP_get_digestbynid(nid);
> }
> }
I just commented on this issue also at
https://sourceforge.net/p/cmpforopenssl/bugs/14/
Regards,
David
--
+--<><-+
| Dr. David von OheimbSenior Key Expert Research Scientist|
| Siemens CT RTC ITS SEA-DE Phone: +49 89 636 41173 |
| Otto-Hahn-Ring 6Fax : +49 89 636 48000 |
| D-81739 München, GermanyEMail: david.von.ohe...@siemens.com |
| http://scd.siemens.de/db4/lookUp?tcgid=Z000ECRO http://ddvo.net/ |
+--+
___
openssl-bugs-mod mailing list
openssl-bugs-...@openssl.org
https://mta.openssl.org/mailman/listinfo/openssl-bugs-mod
___
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
