diff options
| author | David Makepeace <david.p.makepeace@oracle.com> | 2019-05-27 01:29:43 +0200 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2019-05-27 12:28:18 +0200 |
| commit | 324954640e7fcb2b4a26cb5ae7923a6e5e79ee14 (patch) | |
| tree | 7031fa2dedfcd9019869e647c76b52640cd6f44e /ssl/t1_enc.c | |
| parent | doc/man3/X509_LOOKUP_meth_new.pod: clarify the requirements (diff) | |
| download | openssl-324954640e7fcb2b4a26cb5ae7923a6e5e79ee14.tar.xz openssl-324954640e7fcb2b4a26cb5ae7923a6e5e79ee14.zip | |
Changed ssl layer to use EVP_KDF API for TLS1_PRF and HKDF.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9010)
Diffstat (limited to 'ssl/t1_enc.c')
| -rw-r--r-- | ssl/t1_enc.c | 30 |
1 files changed, 18 insertions, 12 deletions
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 9f2dbee016..31290a409a 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -31,7 +31,7 @@ static int tls1_PRF(SSL *s, unsigned char *out, size_t olen, int fatal) { const EVP_MD *md = ssl_prf_md(s); - EVP_PKEY_CTX *pctx = NULL; + EVP_KDF_CTX *kctx = NULL; int ret = 0; if (md == NULL) { @@ -43,16 +43,22 @@ static int tls1_PRF(SSL *s, SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); return 0; } - pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL); - if (pctx == NULL || EVP_PKEY_derive_init(pctx) <= 0 - || EVP_PKEY_CTX_set_tls1_prf_md(pctx, md) <= 0 - || EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, sec, (int)slen) <= 0 - || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, (int)seed1_len) <= 0 - || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, (int)seed2_len) <= 0 - || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, (int)seed3_len) <= 0 - || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed4, (int)seed4_len) <= 0 - || EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed5, (int)seed5_len) <= 0 - || EVP_PKEY_derive(pctx, out, &olen) <= 0) { + kctx = EVP_KDF_CTX_new_id(EVP_PKEY_TLS1_PRF); + if (kctx == NULL + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_MD, md) <= 0 + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_SET_TLS_SECRET, + sec, (size_t)slen) <= 0 + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, + seed1, (size_t)seed1_len) <= 0 + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, + seed2, (size_t)seed2_len) <= 0 + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, + seed3, (size_t)seed3_len) <= 0 + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, + seed4, (size_t)seed4_len) <= 0 + || EVP_KDF_ctrl(kctx, EVP_KDF_CTRL_ADD_TLS_SEED, + seed5, (size_t)seed5_len) <= 0 + || EVP_KDF_derive(kctx, out, olen) <= 0) { if (fatal) SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR); @@ -64,7 +70,7 @@ static int tls1_PRF(SSL *s, ret = 1; err: - EVP_PKEY_CTX_free(pctx); + EVP_KDF_CTX_free(kctx); return ret; } |