lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-07 06:42:56 +03:00
Code Activity

Merge pull request #7788 from marekjansta/fix-x509-ec-algorithm-identifier

Browse Source 
Fixed x509 certificate generation to conform to RFCs when using ECC key
This commit is contained in:
Gilles Peskine
2023-08-07 19:14:54 +00:00
committed by GitHub
parent 953f2a4780 044a98aaa3
commit a79256472c
10 changed files with 67 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
library/x509_create.c
View File

@@ -285,9 +285,11 @@ int mbedtls_x509_write_names(unsigned char **p, unsigned char *start,
int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start,
const char *oid, size_t oid_len,
unsigned char *sig, size_t size)
unsigned char *sig, size_t size,
mbedtls_pk_type_t pk_alg)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
int write_null_par;
size_t len = 0;
if (*p < start || (size_t) (*p - start) < size) {
@@ -310,8 +312,19 @@ int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start,
// Write OID
//
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_algorithm_identifier(p, start, oid,
oid_len, 0));
if (pk_alg == MBEDTLS_PK_ECDSA) {
/*
* The AlgorithmIdentifier's parameters field must be absent for DSA/ECDSA signature
* algorithms, see https://www.rfc-editor.org/rfc/rfc5480#page-17 and
* https://www.rfc-editor.org/rfc/rfc5758#section-3.
*/
write_null_par = 0;
} else {
write_null_par = 1;
}
MBEDTLS_ASN1_CHK_ADD(len,
mbedtls_asn1_write_algorithm_identifier_ext(p, start, oid, oid_len,
0, write_null_par));
return (int) len;
}