denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes

Browse Source
This commit is contained in:
Andreas Steffen
2015-11-06 14:55:31 +01:00
parent 6590298dad
commit a88d958933
12 changed files with 109 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/bliss/bliss_plugin.c
+18 -6
View File
@@ -55,19 +55,31 @@ METHOD(plugin_t, get_features, int,
PLUGIN_REGISTER(PUBKEY, bliss_public_key_load, TRUE),
PLUGIN_PROVIDE(PUBKEY, KEY_ANY),
/* signature schemes, private */
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA256),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA2_256),
PLUGIN_DEPENDS(HASHER, HASH_SHA256),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA384),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA2_384),
PLUGIN_DEPENDS(HASHER, HASH_SHA384),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA512),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA2_512),
PLUGIN_DEPENDS(HASHER, HASH_SHA512),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA3_256),
PLUGIN_DEPENDS(HASHER, HASH_SHA3_256),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA3_384),
PLUGIN_DEPENDS(HASHER, HASH_SHA3_384),
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_BLISS_WITH_SHA3_512),
PLUGIN_DEPENDS(HASHER, HASH_SHA3_512),
/* signature verification schemes */
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA256),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA2_256),
PLUGIN_DEPENDS(HASHER, HASH_SHA256),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA384),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA2_384),
PLUGIN_DEPENDS(HASHER, HASH_SHA384),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA512),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA2_512),
PLUGIN_DEPENDS(HASHER, HASH_SHA512),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA3_256),
PLUGIN_DEPENDS(HASHER, HASH_SHA3_256),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA3_384),
PLUGIN_DEPENDS(HASHER, HASH_SHA3_384),
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_BLISS_WITH_SHA3_512),
PLUGIN_DEPENDS(HASHER, HASH_SHA3_512),
};
*features = f;
src/libstrongswan/plugins/bliss/bliss_private_key.c
+3 -3
View File
@@ -511,11 +511,11 @@ METHOD(private_key_t, sign, bool,
{
switch (scheme)
{
case SIGN_BLISS_WITH_SHA256:
case SIGN_BLISS_WITH_SHA2_256:
return sign_bliss(this, HASH_SHA256, data, signature);
case SIGN_BLISS_WITH_SHA384:
case SIGN_BLISS_WITH_SHA2_384:
return sign_bliss(this, HASH_SHA384, data, signature);
case SIGN_BLISS_WITH_SHA512:
case SIGN_BLISS_WITH_SHA2_512:
return sign_bliss(this, HASH_SHA512, data, signature);
case SIGN_BLISS_WITH_SHA3_256:
return sign_bliss(this, HASH_SHA3_256, data, signature);
src/libstrongswan/plugins/bliss/bliss_public_key.c
+3 -3
View File
@@ -193,11 +193,11 @@ METHOD(public_key_t, verify, bool,
{
switch (scheme)
{
case SIGN_BLISS_WITH_SHA256:
case SIGN_BLISS_WITH_SHA2_256:
return verify_bliss(this, HASH_SHA256, data, signature);
case SIGN_BLISS_WITH_SHA384:
case SIGN_BLISS_WITH_SHA2_384:
return verify_bliss(this, HASH_SHA384, data, signature);
case SIGN_BLISS_WITH_SHA512:
case SIGN_BLISS_WITH_SHA2_512:
return verify_bliss(this, HASH_SHA512, data, signature);
case SIGN_BLISS_WITH_SHA3_256:
return verify_bliss(this, HASH_SHA3_256, data, signature);
src/libstrongswan/plugins/bliss/tests/suites/test_bliss_sign.c
+5 -5
View File
@@ -36,13 +36,13 @@ START_TEST(test_bliss_sign_all)
switch (k)
{
case 1:
signature_scheme = SIGN_BLISS_WITH_SHA256;
signature_scheme = SIGN_BLISS_WITH_SHA2_256;
break;
case 2:
signature_scheme = SIGN_BLISS_WITH_SHA384;
signature_scheme = SIGN_BLISS_WITH_SHA2_384;
break;
default:
signature_scheme = SIGN_BLISS_WITH_SHA512;
signature_scheme = SIGN_BLISS_WITH_SHA2_512;
}
/* enforce BLISS-B key for k = 2, 3 */
@@ -176,14 +176,14 @@ START_TEST(test_bliss_sign_fail)
/* generate valid signature */
msg = chunk_from_str("Hello Dolly!");
ck_assert(privkey->sign(privkey, SIGN_BLISS_WITH_SHA512, msg, &signature));
ck_assert(privkey->sign(privkey, SIGN_BLISS_WITH_SHA2_512, msg, &signature));
/* verify with invalid signature scheme */
ck_assert(!pubkey->verify(pubkey, SIGN_UNKNOWN, msg, signature));
/* corrupt signature */
signature.ptr[signature.len - 1] ^= 0x80;
ck_assert(!pubkey->verify(pubkey, SIGN_BLISS_WITH_SHA512, msg, signature));
ck_assert(!pubkey->verify(pubkey, SIGN_BLISS_WITH_SHA2_512, msg, signature));
free(signature.ptr);
privkey->destroy(privkey);
src/libstrongswan/plugins/x509/x509_ocsp_request.c
+2 -2
View File
@@ -266,8 +266,8 @@ static chunk_t build_optionalSignature(private_x509_ocsp_request_t *this,
scheme = SIGN_ECDSA_WITH_SHA1_DER;
break;
case KEY_BLISS:
oid = OID_BLISS_WITH_SHA512;
scheme = SIGN_BLISS_WITH_SHA512;
oid = OID_BLISS_WITH_SHA2_512;
scheme = SIGN_BLISS_WITH_SHA2_512;
break;
default:
DBG1(DBG_LIB, "unable to sign OCSP request, %N signature not "