Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-10 02:21:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Set the PSS salt length to the digest length

Browse Source 
Call EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, -1) when creating an RSA
signature to set the PSS salt length to the digest length. Without
this call we previously set the salt length to the maximum
permissible value, but this is not how TPM 2 implements it.

Per interoperability testing between signatures created previously
with the max. permissible value and the new code, which does not
modify the signature verification code, old signatures still verify.
New signatures also verify.

This patch may solve interoperability with hardware TPMs that signatures
created following this patch now verify on hardware TPMs as well.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2020-05-25 12:05:41 -04:00 committed by Stefan Berger
parent 93ae920a9c
commit 5bfdd8eba4
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/tpm2/crypto/openssl/CryptRsa.c
View File

@ -1459,6 +1459,10 @@ CryptRsaSign(
EVP_PKEY_CTX_set_signature_md(ctx, md) <= 0)
ERROR_RETURN(TPM_RC_FAILURE);
if (padding == RSA_PKCS1_PSS_PADDING &&
EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, -1) <= 0)
ERROR_RETURN(TPM_RC_FAILURE);
outlen = sigOut->signature.rsapss.sig.t.size;
if (EVP_PKEY_sign(ctx,
sigOut->signature.rsapss.sig.t.buffer, &outlen,