denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Enumerate RSA/PSS schemes and use them if enabled

Browse Source
This commit is contained in:
Tobias Brunner
2017-11-08 16:48:10 +01:00
parent 24b2ede283
commit 6f97c0d50b
6 changed files with 68 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/keys/public_key.c
+32 -15
View File
@@ -18,6 +18,7 @@
#include <asn1/oid.h>
#include "public_key.h"
#include "signature_params.h"
ENUM(key_type_names, KEY_ANY, KEY_BLISS,
"ANY",
@@ -243,27 +244,43 @@ int signature_scheme_to_oid(signature_scheme_t scheme)
return OID_UNKNOWN;
}
/**
* Parameters for RSA/PSS signature schemes
*/
#define PSS_PARAMS(bits) static rsa_pss_params_t pss_params_sha##bits = { \
.hash = HASH_SHA##bits, \
.mgf1_hash = HASH_SHA##bits, \
.salt_len = RSA_PSS_SALT_LEN_DEFAULT, \
}
PSS_PARAMS(256);
PSS_PARAMS(384);
PSS_PARAMS(512);
/**
* Map for signature schemes to the key type and maximum key size allowed.
* We only cover schemes with hash algorithms supported by IKEv2 signature
* authentication.
*/
static struct {
signature_scheme_t scheme;
key_type_t type;
int max_keysize;
signature_params_t params;
} scheme_map[] = {
{ SIGN_RSA_EMSA_PKCS1_SHA2_256, KEY_RSA, 3072 },
{ SIGN_RSA_EMSA_PKCS1_SHA2_384, KEY_RSA, 7680 },
{ SIGN_RSA_EMSA_PKCS1_SHA2_512, KEY_RSA, 0 },
{ SIGN_ECDSA_WITH_SHA256_DER, KEY_ECDSA, 256 },
{ SIGN_ECDSA_WITH_SHA384_DER, KEY_ECDSA, 384 },
{ SIGN_ECDSA_WITH_SHA512_DER, KEY_ECDSA, 0 },
{ SIGN_ED25519, KEY_ED25519, 0 },
{ SIGN_ED448, KEY_ED448, 0 },
{ SIGN_BLISS_WITH_SHA2_256, KEY_BLISS, 128 },
{ SIGN_BLISS_WITH_SHA2_384, KEY_BLISS, 192 },
{ SIGN_BLISS_WITH_SHA2_512, KEY_BLISS, 0 }
{ KEY_RSA, 3072, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha256, }},
{ KEY_RSA, 7680, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha384, }},
{ KEY_RSA, 0, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha512, }},
{ KEY_RSA, 3072, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_256 }},
{ KEY_RSA, 7680, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_384 }},
{ KEY_RSA, 0, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_512 }},
{ KEY_ECDSA, 256, { .scheme = SIGN_ECDSA_WITH_SHA256_DER }},
{ KEY_ECDSA, 384, { .scheme = SIGN_ECDSA_WITH_SHA384_DER }},
{ KEY_ECDSA, 0, { .scheme = SIGN_ECDSA_WITH_SHA512_DER }},
{ KEY_ED25519, 0, { .scheme = SIGN_ED25519 }},
{ KEY_ED448, 0, { .scheme = SIGN_ED448 }},
{ KEY_BLISS, 128, { .scheme = SIGN_BLISS_WITH_SHA2_256 }},
{ KEY_BLISS, 192, { .scheme = SIGN_BLISS_WITH_SHA2_384 }},
{ KEY_BLISS, 0, { .scheme = SIGN_BLISS_WITH_SHA2_512 }},
};
/**
@@ -279,9 +296,9 @@ typedef struct {
METHOD(enumerator_t, signature_schemes_enumerate, bool,
private_enumerator_t *this, va_list args)
{
signature_scheme_t *scheme;
signature_params_t **params;
VA_ARGS_VGET(args, scheme);
VA_ARGS_VGET(args, params);
while (++this->index < countof(scheme_map))
{
@@ -289,7 +306,7 @@ METHOD(enumerator_t, signature_schemes_enumerate, bool,
(this->size <= scheme_map[this->index].max_keysize ||
!scheme_map[this->index].max_keysize))
{
*scheme = scheme_map[this->index].scheme;
*params = &scheme_map[this->index].params;
return TRUE;
}
}
src/libstrongswan/credentials/keys/public_key.h
+2 -2
View File
@@ -281,11 +281,11 @@ int signature_scheme_to_oid(signature_scheme_t scheme);
/**
* Enumerate signature schemes that are appropriate for a key of the given type
* and size|strength.
* and size|strength ordered by increasing strength.
*
* @param type type of the key
* @param size size or strength of the key
* @return enumerator over signature_scheme_t (increasing strength)
* @return enumerator over signature_params_t* (by strength)
*/
enumerator_t *signature_schemes_for_key(key_type_t type, int size);