mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-28 21:17:54 +00:00
Code Issues Releases Wiki Activity

Fix creating and validating EdDSA signatures

Browse Source 
Revert parts of commit c3b8130fe8267185e786e9c12527df7c53b37589 which
inadvertently broke creating and validating EdDSA signatures:

 1. EVP_DigestSignInit() returns 1 on success.

 2. EdDSA does not support streaming (EVP_Digest*Update() followed by
    EVP_Digest*Final()), only one shot operations.
This commit is contained in:
Witold Kręcicki 2018-10-04 12:19:10 +02:00 committed by Michał Kępień
parent dc7b556c31
commit 87b07bf08a
2 changed files with 8 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@ -1,5 +1,7 @@
5043. [bug] Fix creating and validating EdDSA signatures. [GL #579]
5042. [test] Make the chained delegations in reclimit behave
like they would in a regular name server. [GL #578]
like they would in a regular name server. [GL #578]
5041. [test] The chain test contains a incomplete delegation.
[GL #568]

18
lib/dns/openssleddsa_link.c
View File

@ -355,16 +355,13 @@ openssleddsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
isc_buffer_usedregion(buf, &tbsreg);
if (EVP_DigestSignInit(ctx, NULL, NULL, NULL, pkey))
if (EVP_DigestSignInit(ctx, NULL, NULL, NULL, pkey) != 1) {
DST_RET(dst__openssl_toresult3(dctx->category,
"EVP_DigestSignInit",
ISC_R_FAILURE));
if (EVP_DigestSignUpdate(ctx, tbsreg.base, tbsreg.length) != 1) {
DST_RET(dst__openssl_toresult3(dctx->category,
"EVP_DigestSignUpdate",
DST_R_SIGNFAILURE));
}
if (EVP_DigestSignFinal(ctx, sigreg.base, &siglen) != 1) {
if (EVP_DigestSign(ctx, sigreg.base, &siglen,
tbsreg.base, tbsreg.length) != 1) {
DST_RET(dst__openssl_toresult3(dctx->category,
"EVP_DigestSign",
DST_R_SIGNFAILURE));
@ -423,13 +420,8 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
ISC_R_FAILURE));
}
if (EVP_DigestVerifyUpdate(ctx, tbsreg.base, tbsreg.length) != 1) {
DST_RET(dst__openssl_toresult3(dctx->category,
"EVP_DigestVerifyUpdate",
ISC_R_FAILURE));
}
status = EVP_DigestVerifyFinal(ctx, sig->base, siglen);
status = EVP_DigestVerify(ctx, sig->base, siglen,
tbsreg.base, tbsreg.length);
switch (status) {
case 1: