WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Certificates: ECC signature algorithm parameter 

Allow, with a define, ECC signature algorithm parameters to be NULL and
not just empty.
Only for interop.
pull/7903/head
Sean Parkinson 2024-08-27 09:08:06 +10:00
parent bf074d2bb9
commit a3e239c2ad
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
wolfcrypt/src/asn.c
View File

@ -102,6 +102,9 @@ ASN Options:
* which is discouraged by X.690 specification - default values shall not * which is discouraged by X.690 specification - default values shall not
* be encoded. * be encoded.
* NO_TIME_SIGNEDNESS_CHECK: Disabled the time_t signedness check. * NO_TIME_SIGNEDNESS_CHECK: Disabled the time_t signedness check.
* WOLFSSL_ECC_SIGALG_PARAMS_NULL_ALLOWED: Allows the ECDSA/EdDSA signature
* algorithms in certificates to have NULL parameter instead of empty.
* DO NOT enable this unless required for interoperability.
*/ */
#include <wolfssl/wolfcrypt/error-crypt.h> #include <wolfssl/wolfcrypt/error-crypt.h>
@ -22089,14 +22092,18 @@ static int DecodeCertInternal(DecodedCert* cert, int verify, int* criticalExt,
} }
/* Parameters not allowed after ECDSA or EdDSA algorithm OID. */ /* Parameters not allowed after ECDSA or EdDSA algorithm OID. */
else if (IsSigAlgoECC(cert->signatureOID)) { else if (IsSigAlgoECC(cert->signatureOID)) {
if ((dataASN[X509CERTASN_IDX_SIGALGO_PARAMS_NULL].tag != 0) #ifndef WOLFSSL_ECC_SIGALG_PARAMS_NULL_ALLOWED
#ifdef WC_RSA_PSS if (dataASN[X509CERTASN_IDX_SIGALGO_PARAMS_NULL].tag != 0) {
|| (dataASN[X509CERTASN_IDX_SIGALGO_PARAMS].tag != 0)
#endif
) {
WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E); WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
ret = ASN_PARSE_E; ret = ASN_PARSE_E;
} }
#endif
#ifdef WC_RSA_PSS
if (dataASN[X509CERTASN_IDX_SIGALGO_PARAMS].tag != 0) {
WOLFSSL_ERROR_VERBOSE(ASN_PARSE_E);
ret = ASN_PARSE_E;
}
#endif
} }
#ifdef WC_RSA_PSS #ifdef WC_RSA_PSS
/* Check parameters starting with a SEQUENCE. */ /* Check parameters starting with a SEQUENCE. */