wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Only allow PSS signatures with RSA keys and TLS 1.3

Browse source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
This commit is contained in:
Dr. Stephen Henson 2017-01-30 13:53:54 +00:00
parent f742cda820
commit 2b4418ebd6
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ssl/t1_lib.c
View file

@ -835,6 +835,9 @@ int tls12_check_peer_sigalg(SSL *s, uint16_t sig, EVP_PKEY *pkey)
/* Should never happen */
if (pkeyid == -1)
return -1;
/* Only allow PSS for TLS 1.3 */
if (SSL_IS_TLS13(s) && pkeyid == EVP_PKEY_RSA)
pkeyid = EVP_PKEY_RSA_PSS;
lu = tls1_lookup_sigalg(sig);
/*
* Check sigalgs is known and key type is consistent with signature: