I have a doubt.
Reading rfc 3447 I see this definition
RSASSA-PSS-params ::= SEQUENCE {
hashAlgorithm [0] HashAlgorithm DEFAULT sha1,
maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1,
saltLength [2] INTEGER DEFAULT 20,
trailerField [3] TrailerField DEFAULT trailerFieldBC
}
And I think the params definition in the patch must be changed in
ASN1_SEQUENCE(RSASSA_PSS_PARAMS) = {
ASN1_EXP_OPT(RSASSA_PSS_PARAMS, hashAlgorithm, X509_ALGOR,0),
ASN1_EXP_OPT(RSASSA_PSS_PARAMS, maskGenAlgorithm, X509_ALGOR,1),
ASN1_EXP_OPT(RSASSA_PSS_PARAMS, saltLength, ASN1_INTEGER,2),
ASN1_EXP_OPT(RSASSA_PSS_PARAMS, trailerField, ASN1_INTEGER,3)
} ASN1_SEQUENCE_END(RSASSA_PSS_PARAMS)
ASN1_EXP_OPT for ASN1_OPT
Francesco Petruzzi francesco.petru...@innovery.it
-----Messaggio originale-----
Da: owner-openssl-...@openssl.org [mailto:owner-openssl-...@openssl.org] Per
conto di Martin Kaiser via RT
Inviato: domenica 7 febbraio 2010 20.31
Cc: openssl-dev@openssl.org
Oggetto: Re: [openssl.org #1951] [patch] verification of X.509 certificates
that contain an RSASSA-PSS signature
Dear OpenSSL team and all,
finally, here's my patch (against today's 1.1 snapshot) for verification
of X.509 certificates using an RSASSA-PSS signature. I believe it is
fairly complete in terms of checking parameters.
The patch follows the idea that I outlined in previous posts
- two new ASN.1 objects for pss, mgf1
- in obj_xref.txt, pss uses digest undef
-> verify routine has to determine the digest by itself
- ASN1_item_verify() uses EVP_DigestVerify... API
- rsa_st gets two new elements
- param_decode method for rsa parses rsa key's parameters in the
certificate
- at verification time, pss parameters are copied into EVP_PKEY_CTX
This time, I really do hope to get some feedback. Reviewing this won't
be wasted time, I'm happy to improve the code until it is ready for
merging.
As such pss certificates are now being deployed by the millions for
digital pay-tv in Europe (www.ci-plus.com), I feel that OpenSSL should
support them.
Best regards,
Martin
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List openssl-dev@openssl.org
Automated List Manager majord...@openssl.org
