Commit 0398167
crypto: fix WebCrypto import of RSA-PSS keys
This patch changes GetRsaKeyDetail to work in older supported versions
of OpenSSL.
Refs: openssl/openssl#10217
PR-URL: #36877
Refs: #36188
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>1 parent c4cdf1d commit 0398167
2 files changed
Lines changed: 56 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -367,7 +367,14 @@ Maybe<bool> ExportJWKRsaKey( | |||
| 367 | 367 | int type = EVP_PKEY_id(pkey.get()); | |
| 368 | 368 | CHECK(type == EVP_PKEY_RSA || type == EVP_PKEY_RSA_PSS); | |
| 369 | 369 | ||
| 370 | - RSA* rsa = EVP_PKEY_get0_RSA(pkey.get()); | ||
| 370 | + // TODO(tniessen): Remove the "else" branch once we drop support for OpenSSL | ||
| 371 | + // versions older than 1.1.1e via FIPS / dynamic linking. | ||
| 372 | + RSA* rsa; | ||
| 373 | + if (OpenSSL_version_num() >= 0x1010105fL) { | ||
| 374 | + rsa = EVP_PKEY_get0_RSA(pkey.get()); | ||
| 375 | + } else { | ||
| 376 | + rsa = static_cast<RSA*>(EVP_PKEY_get0(pkey.get())); | ||
| 377 | + } | ||
| 371 | 378 | CHECK_NOT_NULL(rsa); | |
| 372 | 379 | ||
| 373 | 380 | const BIGNUM* n; | |
@@ -508,7 +515,14 @@ Maybe<bool> GetRsaKeyDetail( | |||
| 508 | 515 | int type = EVP_PKEY_id(pkey.get()); | |
| 509 | 516 | CHECK(type == EVP_PKEY_RSA || type == EVP_PKEY_RSA_PSS); | |
| 510 | 517 | ||
| 511 | - RSA* rsa = EVP_PKEY_get0_RSA(pkey.get()); | ||
| 518 | + // TODO(tniessen): Remove the "else" branch once we drop support for OpenSSL | ||
| 519 | + // versions older than 1.1.1e via FIPS / dynamic linking. | ||
| 520 | + RSA* rsa; | ||
| 521 | + if (OpenSSL_version_num() >= 0x1010105fL) { | ||
| 522 | + rsa = EVP_PKEY_get0_RSA(pkey.get()); | ||
| 523 | + } else { | ||
| 524 | + rsa = static_cast<RSA*>(EVP_PKEY_get0(pkey.get())); | ||
| 525 | + } | ||
| 512 | 526 | CHECK_NOT_NULL(rsa); | |
| 513 | 527 | ||
| 514 | 528 | RSA_get0_key(rsa, &n, &e, nullptr); | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,40 @@ | |||
| 1 | + 'use strict'; | ||
| 2 | + | ||
| 3 | + const common = require('../common'); | ||
| 4 | + | ||
| 5 | + if (!common.hasCrypto) | ||
| 6 | + common.skip('missing crypto'); | ||
| 7 | + | ||
| 8 | + const { | ||
| 9 | + createPrivateKey, | ||
| 10 | + createPublicKey, | ||
| 11 | + webcrypto: { | ||
| 12 | + subtle | ||
| 13 | + } | ||
| 14 | + } = require('crypto'); | ||
| 15 | + | ||
| 16 | + const fixtures = require('../common/fixtures'); | ||
| 17 | + | ||
| 18 | + { | ||
| 19 | + const rsaPssKeyWithoutParams = fixtures.readKey('rsa_pss_private_2048.pem'); | ||
| 20 | + | ||
| 21 | + const pkcs8 = createPrivateKey(rsaPssKeyWithoutParams).export({ | ||
| 22 | + type: 'pkcs8', | ||
| 23 | + format: 'der' | ||
| 24 | + }); | ||
| 25 | + const spki = createPublicKey(rsaPssKeyWithoutParams).export({ | ||
| 26 | + type: 'spki', | ||
| 27 | + format: 'der' | ||
| 28 | + }); | ||
| 29 | + | ||
| 30 | + const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512']; | ||
| 31 | + | ||
| 32 | + const tasks = []; | ||
| 33 | + for (const hash of hashes) { | ||
| 34 | + const algorithm = { name: 'RSA-PSS', hash }; | ||
| 35 | + tasks.push(subtle.importKey('pkcs8', pkcs8, algorithm, true, ['sign'])); | ||
| 36 | + tasks.push(subtle.importKey('spki', spki, algorithm, true, ['verify'])); | ||
| 37 | + } | ||
| 38 | + | ||
| 39 | + Promise.all(tasks).then(common.mustCall()); | ||
| 40 | + } | ||
0 commit comments