root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity
openssl/providers/encoders.inc

276 lines
12 KiB
PHP
Raw Normal View History

Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
/*
Copyright year updates Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-09-07 16:59:15 +08:00
* Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#ifndef ENCODER_PROVIDER
# error Macro ENCODER_PROVIDER undefined
Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
#endif
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#define ENCODER_STRUCTURE_type_specific_keypair "type-specific"
#define ENCODER_STRUCTURE_type_specific_params "type-specific"
#define ENCODER_STRUCTURE_type_specific "type-specific"
#define ENCODER_STRUCTURE_type_specific_no_pub "type-specific"
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
#define ENCODER_STRUCTURE_EncryptedPrivateKeyInfo "EncryptedPrivateKeyInfo"
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
#define ENCODER_STRUCTURE_PrivateKeyInfo "PrivateKeyInfo"
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#define ENCODER_STRUCTURE_SubjectPublicKeyInfo "SubjectPublicKeyInfo"
#define ENCODER_STRUCTURE_DH "dh"
#define ENCODER_STRUCTURE_DHX "dhx"
#define ENCODER_STRUCTURE_DSA "dsa"
#define ENCODER_STRUCTURE_EC "ec"
#define ENCODER_STRUCTURE_RSA "rsa"
#define ENCODER_STRUCTURE_PKCS1 "pkcs1"
#define ENCODER_STRUCTURE_PKCS3 "pkcs3"
#define ENCODER_STRUCTURE_X9_42 "X9.42"
#define ENCODER_STRUCTURE_X9_62 "X9.62"
/* Arguments are prefixed with '_' to avoid build breaks on certain platforms */
#define ENCODER_TEXT(_name, _sym, _fips) \
{ _name, \
"provider=" ENCODER_PROVIDER ",fips=" #_fips ",output=text", \
(ossl_##_sym##_to_text_encoder_functions) }
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
#define ENCODER(_name, _sym, _fips, _output) \
{ _name, \
"provider=" ENCODER_PROVIDER ",fips=" #_fips ",output=" #_output, \
(ossl_##_sym##_to_##_output##_encoder_functions) }
#define ENCODER_w_structure(_name, _sym, _fips, _output, _structure) \
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
{ _name, \
"provider=" ENCODER_PROVIDER ",fips=" #_fips ",output=" #_output \
",structure=" ENCODER_STRUCTURE_##_structure, \
(ossl_##_sym##_to_##_structure##_##_output##_encoder_functions) }
/*
* Entries for human text "encoders"
*/
ENCODER_TEXT("RSA", rsa, yes),
ENCODER_TEXT("RSA-PSS", rsapss, yes),
#ifndef OPENSSL_NO_DH
ENCODER_TEXT("DH", dh, yes),
ENCODER_TEXT("DHX", dhx, yes),
#endif
#ifndef OPENSSL_NO_DSA
ENCODER_TEXT("DSA", dsa, yes),
#endif
#ifndef OPENSSL_NO_EC
ENCODER_TEXT("EC", ec, yes),
configure: introduce no-ecx to remove ECX related feature This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-04-17 16:20:31 +08:00
# ifndef OPENSSL_NO_ECX
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
ENCODER_TEXT("ED25519", ed25519, yes),
ENCODER_TEXT("ED448", ed448, yes),
ENCODER_TEXT("X25519", x25519, yes),
ENCODER_TEXT("X448", x448, yes),
configure: introduce no-ecx to remove ECX related feature This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-04-17 16:20:31 +08:00
# endif
PROV: Add SM2 encoders and decoders, as well as support functionality The EC KEYMGMT implementation handled SM2 as well, except what's needed to support decoding: loading functions for both EC and SM2 that checks for the presence or absence of the SM2 curve the same way as the EC / SM2 import functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14028)
2021-01-28 15:22:09 +08:00
# ifndef OPENSSL_NO_SM2
prov: tag SM2 encoders and decoders as non-FIPS They're impossible to use in a FIPS environment, so they shouldn't be flagged as compatible. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15782)
2021-06-16 06:44:28 +08:00
ENCODER_TEXT("SM2", sm2, no),
PROV: Add SM2 encoders and decoders, as well as support functionality The EC KEYMGMT implementation handled SM2 as well, except what's needed to support decoding: loading functions for both EC and SM2 that checks for the presence or absence of the SM2 curve the same way as the EC / SM2 import functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14028)
2021-01-28 15:22:09 +08:00
# endif
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
/*
* Entries for key type specific output formats. The structure name on these
* is the same as the key type name. This allows us to say something like:
*
* To replace i2d_{TYPE}PrivateKey(), i2d_{TYPE}PublicKey() and
* i2d_{TYPE}Params(), use OSSL_ENCODER functions with an OSSL_ENCODER_CTX
* created like this:
*
* OSSL_ENCODER_CTX *ctx =
Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEY Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
2021-02-11 23:57:37 +08:00
* OSSL_ENCODER_CTX_new_for_pkey(pkey, selection, "DER", "type-specific",
* NULL, NULL);
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
*
* To replace PEM_write_bio_{TYPE}PrivateKey(), PEM_write_bio_{TYPE}PublicKey()
* and PEM_write_bio_{TYPE}Params(), use OSSL_ENCODER functions with an
* OSSL_ENCODER_CTX created like this:
*
* OSSL_ENCODER_CTX *ctx =
Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEY Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
2021-02-11 23:57:37 +08:00
* OSSL_ENCODER_CTX_new_for_pkey(pkey, selection, "PEM", "type-specific",
* NULL, NULL);
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
*
* We only implement those for which there are current i2d_ and PEM_write_bio
* implementations.
*/
/* The RSA encoders only support private key and public key output */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("RSA", rsa, yes, der, type_specific_keypair),
ENCODER_w_structure("RSA", rsa, yes, pem, type_specific_keypair),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#ifndef OPENSSL_NO_DH
/* DH and X9.42 DH only support key parameters output. */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DH", dh, yes, der, type_specific_params),
ENCODER_w_structure("DH", dh, yes, pem, type_specific_params),
ENCODER_w_structure("DHX", dhx, yes, der, type_specific_params),
ENCODER_w_structure("DHX", dhx, yes, pem, type_specific_params),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
#ifndef OPENSSL_NO_DSA
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DSA", dsa, yes, der, type_specific),
ENCODER_w_structure("DSA", dsa, yes, pem, type_specific),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
#ifndef OPENSSL_NO_EC
PROV: Implement an EC key -> blob encoder, to get the public key Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/14291)
2021-02-24 05:41:04 +08:00
/* EC only supports keypair and parameters DER and PEM output. */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("EC", ec, yes, der, type_specific_no_pub),
ENCODER_w_structure("EC", ec, yes, pem, type_specific_no_pub),
PROV: Implement an EC key -> blob encoder, to get the public key Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/14291)
2021-02-24 05:41:04 +08:00
/* EC supports blob output for the public key */
ENCODER("EC", ec, yes, blob),
PROV: Add SM2 encoders and decoders, as well as support functionality The EC KEYMGMT implementation handled SM2 as well, except what's needed to support decoding: loading functions for both EC and SM2 that checks for the presence or absence of the SM2 curve the same way as the EC / SM2 import functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14028)
2021-01-28 15:22:09 +08:00
# ifndef OPENSSL_NO_SM2
prov: tag SM2 encoders and decoders as non-FIPS They're impossible to use in a FIPS environment, so they shouldn't be flagged as compatible. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15782)
2021-06-16 06:44:28 +08:00
ENCODER_w_structure("SM2", sm2, no, der, type_specific_no_pub),
ENCODER_w_structure("SM2", sm2, no, pem, type_specific_no_pub),
ENCODER("SM2", sm2, no, blob),
PROV: Add SM2 encoders and decoders, as well as support functionality The EC KEYMGMT implementation handled SM2 as well, except what's needed to support decoding: loading functions for both EC and SM2 that checks for the presence or absence of the SM2 curve the same way as the EC / SM2 import functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14028)
2021-01-28 15:22:09 +08:00
# endif
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
#endif
/*
* Entries for the output formats MSBLOB and PVK
*/
ENCODER("RSA", rsa, yes, msblob),
ENCODER("RSA", rsa, yes, pvk),
#ifndef OPENSSL_NO_DSA
ENCODER("DSA", dsa, yes, msblob),
ENCODER("DSA", dsa, yes, pvk),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
/*
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
* Entries for encrypted PKCS#8 (EncryptedPrivateKeyInfo), unencrypted PKCS#8
* (PrivateKeyInfo) and SubjectPublicKeyInfo. The "der" ones are added
* convenience for any user that wants to use OSSL_ENCODER directly.
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
* The "pem" ones also support PEM_write_bio_PrivateKey() and
* PEM_write_bio_PUBKEY().
*/
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("RSA", rsa, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("RSA", rsa, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("RSA", rsa, yes, der, PrivateKeyInfo),
ENCODER_w_structure("RSA", rsa, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("RSA", rsa, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("RSA", rsa, yes, pem, SubjectPublicKeyInfo),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("RSA-PSS", rsapss, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("RSA-PSS", rsapss, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("RSA-PSS", rsapss, yes, der, PrivateKeyInfo),
ENCODER_w_structure("RSA-PSS", rsapss, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("RSA-PSS", rsapss, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("RSA-PSS", rsapss, yes, pem, SubjectPublicKeyInfo),
Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
#ifndef OPENSSL_NO_DH
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("DH", dh, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("DH", dh, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("DH", dh, yes, der, PrivateKeyInfo),
ENCODER_w_structure("DH", dh, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DH", dh, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("DH", dh, yes, pem, SubjectPublicKeyInfo),
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("DHX", dhx, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("DHX", dhx, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("DHX", dhx, yes, der, PrivateKeyInfo),
ENCODER_w_structure("DHX", dhx, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DHX", dhx, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("DHX", dhx, yes, pem, SubjectPublicKeyInfo),
Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
#endif
#ifndef OPENSSL_NO_DSA
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("DSA", dsa, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("DSA", dsa, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("DSA", dsa, yes, der, PrivateKeyInfo),
ENCODER_w_structure("DSA", dsa, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DSA", dsa, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("DSA", dsa, yes, pem, SubjectPublicKeyInfo),
Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
#endif
#ifndef OPENSSL_NO_EC
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("EC", ec, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("EC", ec, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("EC", ec, yes, der, PrivateKeyInfo),
ENCODER_w_structure("EC", ec, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("EC", ec, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("EC", ec, yes, pem, SubjectPublicKeyInfo),
configure: introduce no-ecx to remove ECX related feature This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-04-17 16:20:31 +08:00
#ifndef OPENSSL_NO_ECX
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("X25519", x25519, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("X25519", x25519, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("X25519", x25519, yes, der, PrivateKeyInfo),
ENCODER_w_structure("X25519", x25519, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("X25519", x25519, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("X25519", x25519, yes, pem, SubjectPublicKeyInfo),
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("X448", x448, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("X448", x448, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("X448", x448, yes, der, PrivateKeyInfo),
ENCODER_w_structure("X448", x448, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("X448", x448, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("X448", x448, yes, pem, SubjectPublicKeyInfo),
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("ED25519", ed25519, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("ED25519", ed25519, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("ED25519", ed25519, yes, der, PrivateKeyInfo),
ENCODER_w_structure("ED25519", ed25519, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("ED25519", ed25519, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("ED25519", ed25519, yes, pem, SubjectPublicKeyInfo),
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("ED448", ed448, yes, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("ED448", ed448, yes, pem, EncryptedPrivateKeyInfo),
Decoding PKCS#8: separate decoding of encrypted and unencrypted PKCS#8 This has us switch from the 'structure' "pkcs8" to "PrivateKeyInfo", which is sensible considering we already have "SubjectPublicKeyInfo". We also add "EncryptedPrivateKeyInfo", and use it for a special decoder that detects and decrypts an EncryptedPrivateKeyInfo structured DER blob into a PrivateKeyInfo structured DER blob and passes that on to the next decoder implementation. The result of this change is that PKCS#8 decryption should only happen once per decoding instead of once for every expected key type. Furthermore, this new decoder implementation sets the data type to the OID of the algorithmIdentifier field, thus reducing how many decoder implementations are tentativaly run further down the call chain. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15498)
2021-05-27 18:34:03 +08:00
ENCODER_w_structure("ED448", ed448, yes, der, PrivateKeyInfo),
ENCODER_w_structure("ED448", ed448, yes, pem, PrivateKeyInfo),
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("ED448", ed448, yes, der, SubjectPublicKeyInfo),
ENCODER_w_structure("ED448", ed448, yes, pem, SubjectPublicKeyInfo),
configure: introduce no-ecx to remove ECX related feature This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-04-17 16:20:31 +08:00
# endif
PROV: Add SM2 encoders and decoders, as well as support functionality The EC KEYMGMT implementation handled SM2 as well, except what's needed to support decoding: loading functions for both EC and SM2 that checks for the presence or absence of the SM2 curve the same way as the EC / SM2 import functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14028)
2021-01-28 15:22:09 +08:00
# ifndef OPENSSL_NO_SM2
ENCODER PROV: Add encoders with EncryptedPrivateKeyInfo output Since EncryptedPrivateKeyInfo is a recognised structure, it's reasonable to think that someone might want to specify it. To be noted is that if someone specifies the structure PrivateKeyInfo but has also passed a passphrase callback, the result will still become a EncryptedPrivateKeyInfo structure. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16466)
2021-09-02 04:18:45 +08:00
ENCODER_w_structure("SM2", sm2, no, der, EncryptedPrivateKeyInfo),
ENCODER_w_structure("SM2", sm2, no, pem, EncryptedPrivateKeyInfo),
prov: tag SM2 encoders and decoders as non-FIPS They're impossible to use in a FIPS environment, so they shouldn't be flagged as compatible. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15782)
2021-06-16 06:44:28 +08:00
ENCODER_w_structure("SM2", sm2, no, der, PrivateKeyInfo),
ENCODER_w_structure("SM2", sm2, no, pem, PrivateKeyInfo),
ENCODER_w_structure("SM2", sm2, no, der, SubjectPublicKeyInfo),
ENCODER_w_structure("SM2", sm2, no, pem, SubjectPublicKeyInfo),
PROV: Add SM2 encoders and decoders, as well as support functionality The EC KEYMGMT implementation handled SM2 as well, except what's needed to support decoding: loading functions for both EC and SM2 that checks for the presence or absence of the SM2 curve the same way as the EC / SM2 import functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14028)
2021-01-28 15:22:09 +08:00
# endif
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
/*
* Entries for key type specific output formats. These are exactly the
* same as the type specific above, except that they use the key type
* name as structure name instead of "type-specific", in the call on
Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEY Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
2021-02-11 23:57:37 +08:00
* OSSL_ENCODER_CTX_new_for_pkey().
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
*/
/* The RSA encoders only support private key and public key output */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("RSA", rsa, yes, der, RSA),
ENCODER_w_structure("RSA", rsa, yes, pem, RSA),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#ifndef OPENSSL_NO_DH
/* DH and X9.42 DH only support key parameters output. */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DH", dh, yes, der, DH),
ENCODER_w_structure("DH", dh, yes, pem, DH),
ENCODER_w_structure("DHX", dhx, yes, der, DHX),
ENCODER_w_structure("DHX", dhx, yes, pem, DHX),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
#ifndef OPENSSL_NO_DSA
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DSA", dsa, yes, der, DSA),
ENCODER_w_structure("DSA", dsa, yes, pem, DSA),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
#ifndef OPENSSL_NO_EC
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("EC", ec, yes, der, EC),
ENCODER_w_structure("EC", ec, yes, pem, EC),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
/*
* Additional entries with structure names being the standard name.
* This is entirely for the convenience of the user that wants to use
* OSSL_ENCODER directly with names they may fancy. These do not impact
* on libcrypto functionality in any way.
*/
/* PKCS#1 is a well known for plain RSA keys, so we add that too */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("RSA", rsa, yes, der, PKCS1),
ENCODER_w_structure("RSA", rsa, yes, pem, PKCS1),
ENCODER_w_structure("RSA-PSS", rsapss, yes, der, PKCS1),
ENCODER_w_structure("RSA-PSS", rsapss, yes, pem, PKCS1),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#ifndef OPENSSL_NO_DH
/* PKCS#3 defines the format for DH parameters */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DH", dh, yes, der, PKCS3),
ENCODER_w_structure("DH", dh, yes, pem, PKCS3),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
/* X9.42 defines the format for DHX parameters */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("DHX", dhx, yes, der, X9_42),
ENCODER_w_structure("DHX", dhx, yes, pem, X9_42),
PROV: Re-implement all the keypair encoders The base functionality to implement the keypair encoders doesn't change much, but this results in a more massive amount of OSSL_DISPATCH and OSSL_ALGORITHM arrays, to support a fine grained selection of implementation based on what parts of the keypair structure (combinations of key parameters, public key and private key) should be output, the output type ("TEXT", "DER" or "PEM") and the outermost output structure ("pkcs8", "SubjectPublicKeyInfo", key type specific structures, ...). We add support for the generic structure name "type-specific", to allow selecting that without knowing the exact name of that structure. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13167)
2020-10-17 14:34:47 +08:00
#endif
#ifndef OPENSSL_NO_EC
/* RFC 5915 defines the format for EC keys and parameters */
PROV: Add MSBLOB and PVK encoders This allows 15-test_rsa.t to succeed, and provides the same OSSL_ENCODER support for these formats as for all other formats supported in OpenSSL. Fixes #13379 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13645)
2020-12-09 18:54:56 +08:00
ENCODER_w_structure("EC", ec, yes, der, X9_62),
ENCODER_w_structure("EC", ec, yes, pem, X9_62),
Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODE Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-17 03:25:08 +08:00
#endif