diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2021-03-29 05:38:00 +0200 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2021-04-01 01:07:08 +0200 |
| commit | e454a3934c287aede194cac49c8934f04bf6a04f (patch) | |
| tree | c43916f0a50c5e2d1a9aa1caa00539c0629f1175 /test/evp_test.c | |
| parent | CHANGES.md: reflect OSSL_HTTP_REQ_CTX_i2d renamed to OSSL_HTTP_REQ_CTX_set1_req (diff) | |
| download | openssl-e454a3934c287aede194cac49c8934f04bf6a04f.tar.xz openssl-e454a3934c287aede194cac49c8934f04bf6a04f.zip | |
Add a range check (from SP800-56Ar3) to DH key derivation.
Fixes #14401
Note that this moves the public key check out of DH compute_key() since
key validation does not belong inside this primitive..
The check has been moved to the EVP_PKEY_derive_set_peer() function so that
it generally applies to all exchange operations.. Use EVP_PKEY_derive_set_peer_ex()
to disable this behaviour.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14717)
Diffstat (limited to 'test/evp_test.c')
| -rw-r--r-- | test/evp_test.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/test/evp_test.c b/test/evp_test.c index 2bb837e6e7..efcf4c5fee 100644 --- a/test/evp_test.c +++ b/test/evp_test.c @@ -1632,7 +1632,7 @@ static int pderive_test_parse(EVP_TEST *t, EVP_PKEY *peer; if (find_key(&peer, value, public_keys) == 0) return -1; - if (EVP_PKEY_derive_set_peer(kdata->ctx, peer) <= 0) { + if (EVP_PKEY_derive_set_peer_ex(kdata->ctx, peer, 0) <= 0) { t->err = "DERIVE_SET_PEER_ERROR"; return 1; } |