openssl / openssl/openssl

Add EVP_PKEY_supports_one_shot_digest function

Open
#26,700 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

branch: master triaged: feature
Dominant language
C
Stars
30.8k
Forks
11.5k
Avg merge
10m
Merged PRs (30d)
1

Description

Currently in multiple places in the commandline apps the following code is used..

            if (EVP_PKEY_get_default_digest_name(sigkey, def_md,
                                                 sizeof(def_md)) == 2
                    && strcmp(def_md, "UNDEF") == 0)

This test is being used to detect if a EVP_PKEY only supports one-shot signing operations.
(i.e. update/final calls are not supported).

The keymanagers for ML-DSA and ED both have getters that support..

p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MANDATORY_DIGEST);
if (p != NULL && !OSSL_PARAM_set_utf8_string(p, ""))
    return 0;

The EVP_PKEY_get_default_digest_name(0 interface seems quite quirky for doing this test, and it is probably not a good idea
to propagate and copy this interface.

So we could either
(1) wrap the call in a public API if required..
(2) Have some better way of querying properties related to keys..
To do this properly currently you would need to create a PKEY_CTX, init it for signing and then see if it handles the dispatch methods for one shot, but not the update/final.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the repeated EVP_PKEY_get_default_digest_name checks in the command-line apps and the OSSL_PKEY_PARAM_MANDATORY_DIGEST getters described for ML-DSA and ED. Compare the proposed public wrapper with querying PKEY_CTX dispatch methods, then define the supported behavior and tests before implementation.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
backend-api-design, cryptography
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.