Hello,

I'm mostly feature complete with my 'GOST for LibreSSL' project.
My last issue is implementing TLS 1.2 + GOST cipher suites.
The signature on Certificate Verify message uses a format
different to the signature format that is used by X.509 certificates,
CMS messages, etc.

For TLS 1.0/1.1 this is handled by converting the signature on the fly
and then passing it to the signing/verification functions. I'm considering
adding a special ctrl to control the signature format (like it is done
for RSA padding types). This would allow me to further clean up
TLS 1.0/1.1 handling.

For the TLS 1.2, the signature is created using unified code path
and opaque data types through EVP_SignInit_ex/EVP_SignUpdate/
EVP_SignFinal family of functions. I'm considering  adding a
EVP_SignFinal_ctx function that will take EVP_PKEY_CTX rather
than just EVP_PKEY (or in addition to it). Is this an acceptable
solution?

-- 
With best wishes
Dmitry

Reply via email to