diff options
| author | David Benjamin <davidben@google.com> | 2016-07-14 19:51:01 +0300 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2016-07-15 21:10:29 +0300 |
| commit | ca3d545d7f34d67c8fb05265a0f1cf7f88076776 (patch) | |
| tree | ac0715f9fb6a78732e20898d6fae83efcd1d56da /include/openssl/ssl.h | |
| parent | 0ee2e1107e6e59021b2e26ec83382010190e9f3c (diff) | |
Add SSL_set_signing_algorithm_prefs.
This gives us a sigalg-based API for configuring signing algorithms.
Change-Id: Ib746a56ebd1061eadd2620cdb140d5171b59bc02
Reviewed-on: https://boringssl-review.googlesource.com/8784
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'include/openssl/ssl.h')
| -rw-r--r-- | include/openssl/ssl.h | 44 |
1 files changed, 37 insertions, 7 deletions
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index d0bc1038..7b4b3497 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -869,13 +869,31 @@ OPENSSL_EXPORT int SSL_CTX_set_ocsp_response(SSL_CTX *ctx, const uint8_t *response, size_t response_len); -/* SSL_set_private_key_digest_prefs copies |num_digests| NIDs from |digest_nids| - * into |ssl|. These digests will be used, in decreasing order of preference, - * when signing with |ssl|'s private key. It returns one on success and zero on - * error. */ -OPENSSL_EXPORT int SSL_set_private_key_digest_prefs(SSL *ssl, - const int *digest_nids, - size_t num_digests); +/* SSL_SIGN_* are signature algorithm values as defined in TLS 1.3. */ +#define SSL_SIGN_RSA_PKCS1_SHA1 0x0201 +#define SSL_SIGN_RSA_PKCS1_SHA256 0x0401 +#define SSL_SIGN_RSA_PKCS1_SHA384 0x0501 +#define SSL_SIGN_RSA_PKCS1_SHA512 0x0601 +#define SSL_SIGN_ECDSA_SHA1 0x0203 +#define SSL_SIGN_ECDSA_SECP256R1_SHA256 0x0403 +#define SSL_SIGN_ECDSA_SECP384R1_SHA384 0x0503 +#define SSL_SIGN_ECDSA_SECP521R1_SHA512 0x0603 +#define SSL_SIGN_RSA_PSS_SHA256 0x0700 +#define SSL_SIGN_RSA_PSS_SHA384 0x0701 +#define SSL_SIGN_RSA_PSS_SHA512 0x0702 + +/* SSL_SIGN_RSA_PKCS1_MD5_SHA1 is an internal signature algorithm used to + * specify raw RSASSA-PKCS1-v1_5 with an MD5/SHA-1 concatenation, as used in TLS + * before TLS 1.2. */ +#define SSL_SIGN_RSA_PKCS1_MD5_SHA1 0xff01 + +/* SSL_set_signing_algorithm_prefs configures |ssl| to use |prefs| as the + * preference list when signing with |ssl|'s private key. It returns one on + * success and zero on error. |prefs| should not include the internal-only value + * |SSL_SIGN_RSA_PKCS1_MD5_SHA1|. */ +OPENSSL_EXPORT int SSL_set_signing_algorithm_prefs(SSL *ssl, + const uint16_t *prefs, + size_t prefs_len); /* Certificate and private key convenience functions. */ @@ -3482,6 +3500,18 @@ OPENSSL_EXPORT int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *out, OPENSSL_EXPORT uint32_t SSL_SESSION_get_key_exchange_info( const SSL_SESSION *session); +/* SSL_set_private_key_digest_prefs copies |num_digests| NIDs from |digest_nids| + * into |ssl|. These digests will be used, in decreasing order of preference, + * when signing with |ssl|'s private key. It returns one on success and zero on + * error. + * + * Use |SSL_set_signing_algorithm_prefs| instead. + * + * TODO(davidben): Remove this API when callers have been updated. */ +OPENSSL_EXPORT int SSL_set_private_key_digest_prefs(SSL *ssl, + const int *digest_nids, + size_t num_digests); + /* Private structures. * |