64 lines
2.2 KiB
Diff
64 lines
2.2 KiB
Diff
From 1f9215f5f92c5478c8aaba8054d192a5e6280e95 Mon Sep 17 00:00:00 2001
|
|
From: Simon Kelley <simon@thekelleys.org.uk>
|
|
Date: Wed, 16 Nov 2022 15:54:43 +0000
|
|
Subject: [PATCH] Fix GOST signature algorithms for DNSSEC validation.
|
|
|
|
Use CryptoPro version of the hash function.
|
|
Handle the little-endian wire format of key data.
|
|
Get the wire order of S and R correct.
|
|
|
|
Note that Nettle version 3.6 or later is required for GOST support.
|
|
Conflict:NA
|
|
Reference:https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=id=1f9215f5f92c5478c8aaba8054d192a5e6280e95
|
|
---
|
|
src/crypto.c | 16 +++++++++-------
|
|
1 file changed, 9 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/crypto.c b/src/crypto.c
|
|
index 4009569..9b97aed 100644
|
|
--- a/src/crypto.c
|
|
+++ b/src/crypto.c
|
|
@@ -309,14 +309,14 @@ static int dnsmasq_gostdsa_verify(struct blockdata *key_data, unsigned int key_l
|
|
mpz_init(y);
|
|
}
|
|
|
|
- mpz_import(x, 32 , 1, 1, 0, 0, p);
|
|
- mpz_import(y, 32 , 1, 1, 0, 0, p + 32);
|
|
+ mpz_import(x, 32, -1, 1, 0, 0, p);
|
|
+ mpz_import(y, 32, -1, 1, 0, 0, p + 32);
|
|
|
|
if (!ecc_point_set(gost_key, x, y))
|
|
- return 0;
|
|
+ return 0;
|
|
|
|
- mpz_import(sig_struct->r, 32, 1, 1, 0, 0, sig);
|
|
- mpz_import(sig_struct->s, 32, 1, 1, 0, 0, sig + 32);
|
|
+ mpz_import(sig_struct->s, 32, 1, 1, 0, 0, sig);
|
|
+ mpz_import(sig_struct->r, 32, 1, 1, 0, 0, sig + 32);
|
|
|
|
return nettle_gostdsa_verify(gost_key, digest_len, digest, sig_struct);
|
|
}
|
|
@@ -425,7 +425,9 @@ char *ds_digest_name(int digest)
|
|
{
|
|
case 1: return "sha1";
|
|
case 2: return "sha256";
|
|
- case 3: return "gosthash94";
|
|
+#if MIN_VERSION(3, 6)
|
|
+ case 3: return "gosthash94cp";
|
|
+#endif
|
|
case 4: return "sha384";
|
|
default: return NULL;
|
|
}
|
|
@@ -444,7 +446,7 @@ char *algo_digest_name(int algo)
|
|
case 7: return "sha1"; /* RSASHA1-NSEC3-SHA1 */
|
|
case 8: return "sha256"; /* RSA/SHA-256 */
|
|
case 10: return "sha512"; /* RSA/SHA-512 */
|
|
- case 12: return "gosthash94"; /* ECC-GOST */
|
|
+ case 12: return "gosthash94cp"; /* ECC-GOST */
|
|
case 13: return "sha256"; /* ECDSAP256SHA256 */
|
|
case 14: return "sha384"; /* ECDSAP384SHA384 */
|
|
case 15: return "null_hash"; /* ED25519 */
|
|
--
|
|
2.27.0
|
|
|