denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Support signing with RSASSA-PSS via RFC 7427 signature auth

Browse Source
This commit is contained in:
Tobias Brunner
2017-11-08 16:48:10 +01:00
parent a4aaef7477
commit 24b2ede283
1 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+21 -6
View File
@@ -104,18 +104,32 @@ static bool parse_signature_auth_data(chunk_t *auth_data, key_type_t *key_type,
* Build authentication data used for Signature Authentication as per RFC 7427 * Build authentication data used for Signature Authentication as per RFC 7427
*/ */
static bool build_signature_auth_data(chunk_t *auth_data, static bool build_signature_auth_data(chunk_t *auth_data,
signature_scheme_t scheme) signature_params_t *params)
{ {
chunk_t data; chunk_t data, parameters = chunk_empty;
uint8_t len; uint8_t len;
int oid; int oid;
oid = signature_scheme_to_oid(scheme); oid = signature_scheme_to_oid(params->scheme);
if (oid == OID_UNKNOWN) if (oid == OID_UNKNOWN)
{ {
chunk_free(auth_data);
return FALSE; return FALSE;
} }
data = asn1_algorithmIdentifier(oid); if (params->scheme == SIGN_RSA_EMSA_PSS &&
!rsa_pss_params_build(params->params, &parameters))
{
chunk_free(auth_data);
return FALSE;
}
if (parameters.len)
{
data = asn1_algorithmIdentifier_params(oid, parameters);
}
else
{
data = asn1_algorithmIdentifier(oid);
}
len = data.len; len = data.len;
*auth_data = chunk_cat("cmm", chunk_from_thing(len), data, *auth_data); *auth_data = chunk_cat("cmm", chunk_from_thing(len), data, *auth_data);
return TRUE; return TRUE;
@@ -253,8 +267,9 @@ static status_t sign_signature_auth(private_pubkey_authenticator_t *this,
while (enumerator->enumerate(enumerator, &params)) while (enumerator->enumerate(enumerator, &params))
{ {
scheme = params->scheme; scheme = params->scheme;
if (private->sign(private, scheme, NULL, octets, auth_data) && if (private->sign(private, scheme, params->params, octets,
build_signature_auth_data(auth_data, scheme)) auth_data) &&
build_signature_auth_data(auth_data, params))
{ {
status = SUCCESS; status = SUCCESS;
break; break;