X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=doc%2Fcrypto%2FRSA_set_method.pod;h=2c963d7e5bbaa0989b2572591122e26f91b4c79e;hb=a12a6b99629e29d6f8f2e6731e29627a89839715;hp=bc0891a44505ebf963f58115fb1f01ce76264bf4;hpb=5270e7025e11b2fd1a5bdf8d81feded1167b1c87;p=oweals%2Fopenssl.git diff --git a/doc/crypto/RSA_set_method.pod b/doc/crypto/RSA_set_method.pod index bc0891a445..2c963d7e5b 100644 --- a/doc/crypto/RSA_set_method.pod +++ b/doc/crypto/RSA_set_method.pod @@ -3,71 +3,77 @@ =head1 NAME RSA_set_default_method, RSA_get_default_method, RSA_set_method, -RSA_get_method, RSA_PKCS1_SSLeay, RSA_PKCS1_RSAref, -RSA_null_method, RSA_flags, RSA_new_method - select RSA method +RSA_get_method, RSA_PKCS1_SSLeay, RSA_null_method, RSA_flags, +RSA_new_method - select RSA method =head1 SYNOPSIS #include - #include - void RSA_set_default_openssl_method(RSA_METHOD *meth); + void RSA_set_default_method(const RSA_METHOD *meth); - RSA_METHOD *RSA_get_default_openssl_method(void); + RSA_METHOD *RSA_get_default_method(void); - int RSA_set_method(RSA *rsa, ENGINE *engine); + int RSA_set_method(RSA *rsa, const RSA_METHOD *meth); - RSA_METHOD *RSA_get_method(RSA *rsa); + RSA_METHOD *RSA_get_method(const RSA *rsa); RSA_METHOD *RSA_PKCS1_SSLeay(void); - RSA_METHOD *RSA_PKCS1_RSAref(void); - RSA_METHOD *RSA_null_method(void); - int RSA_flags(RSA *rsa); + int RSA_flags(const RSA *rsa); - RSA *RSA_new_method(ENGINE *engine); + RSA *RSA_new_method(RSA_METHOD *method); =head1 DESCRIPTION An B specifies the functions that OpenSSL uses for RSA -operations. By modifying the method, alternative implementations -such as hardware accelerators may be used. - -Initially, the default is to use the OpenSSL internal implementation, -unless OpenSSL was configured with the C or C<-DRSA_NULL> -options. RSA_PKCS1_SSLeay() returns a pointer to that method. - -RSA_PKCS1_RSAref() returns a pointer to a method that uses the RSAref -library. This is the default method in the C configuration; -the function is not available in other configurations. -RSA_null_method() returns a pointer to a method that does not support -the RSA transformation. It is the default if OpenSSL is compiled with -C<-DRSA_NULL>. These methods may be useful in the USA because of a -patent on the RSA cryptosystem. - -RSA_set_default_openssl_method() makes B the default method for all B -structures created later. B This is true only whilst the default engine -for RSA operations remains as "openssl". ENGINEs provide an -encapsulation for implementations of one or more algorithms at a time, and all -the RSA functions mentioned here operate within the scope of the default -"openssl" engine. - -RSA_get_default_openssl_method() returns a pointer to the current default -method for the "openssl" engine. - -RSA_set_method() selects B for all operations using the key -B. +operations. By modifying the method, alternative implementations such as +hardware accelerators may be used. IMPORTANT: See the NOTES section for +important information about how these RSA API functions are affected by the +use of B API calls. + +Initially, the default RSA_METHOD is the OpenSSL internal implementation, +as returned by RSA_PKCS1_SSLeay(). + +RSA_set_default_method() makes B the default method for all RSA +structures created later. B: This is true only whilst no ENGINE has +been set as a default for RSA, so this function is no longer recommended. + +RSA_get_default_method() returns a pointer to the current default +RSA_METHOD. However, the meaningfulness of this result is dependent on +whether the ENGINE API is being used, so this function is no longer +recommended. + +RSA_set_method() selects B to perform all operations using the key +B. This will replace the RSA_METHOD used by the RSA key and if the +previous method was supplied by an ENGINE, the handle to that ENGINE will +be released during the change. It is possible to have RSA keys that only +work with certain RSA_METHOD implementations (eg. from an ENGINE module +that supports embedded hardware-protected keys), and in such cases +attempting to change the RSA_METHOD for the key can have unexpected +results. + +RSA_get_method() returns a pointer to the RSA_METHOD being used by B. +This method may or may not be supplied by an ENGINE implementation, but if +it is, the return value can only be guaranteed to be valid as long as the +RSA key itself is valid and does not have its implementation changed by +RSA_set_method(). + +RSA_flags() returns the B that are set for B's current +RSA_METHOD. See the BUGS section. -RSA_get_method() returns a pointer to the RSA_METHOD from the currently -selected ENGINE for B. +RSA_new_method() allocates and initializes an RSA structure so that +B will be used for the RSA operations. If B is NULL, the +default ENGINE for RSA operations is used, and if no default ENGINE is set, +the RSA_METHOD controlled by RSA_set_default_method() is used. RSA_flags() returns the B that are set for B's current method. -RSA_new_method() allocates and initializes an RSA structure so that -B will be used for the RSA operations. If B is NULL, -the default engine for RSA operations is used. +RSA_new_method() allocates and initializes an B structure so that +B will be used for the RSA operations. If B is B, +the default method is used. =head1 THE RSA_METHOD STRUCTURE @@ -132,23 +138,45 @@ the default engine for RSA operations is used. =head1 RETURN VALUES -RSA_PKCS1_SSLeay(), RSA_PKCS1_RSAref(), RSA_PKCS1_null_method(), -RSA_get_default_openssl_method() and RSA_get_method() return pointers to -the respective RSA_METHODs. +RSA_PKCS1_SSLeay(), RSA_PKCS1_null_method(), RSA_get_default_method() +and RSA_get_method() return pointers to the respective RSA_METHODs. -RSA_set_default_openssl_method() returns no value. +RSA_set_default_method() returns no value. -RSA_set_method() selects B as the engine that will be responsible for -all operations using the structure B. If this function completes successfully, -then the B structure will have its own functional reference of B, so -the caller should remember to free their own reference to B when they are -finished with it. NB: An ENGINE's RSA_METHOD can be retrieved (or set) by -ENGINE_get_RSA() or ENGINE_set_RSA(). +RSA_set_method() returns a pointer to the old RSA_METHOD implementation +that was replaced. However, this return value should probably be ignored +because if it was supplied by an ENGINE, the pointer could be invalidated +at any time if the ENGINE is unloaded (in fact it could be unloaded as a +result of the RSA_set_method() function releasing its handle to the +ENGINE). For this reason, the return type may be replaced with a B +declaration in a future release. -RSA_new_method() returns NULL and sets an error code that can be -obtained by L if the allocation fails. Otherwise +RSA_new_method() returns NULL and sets an error code that can be obtained +by L if the allocation fails. Otherwise it returns a pointer to the newly allocated structure. +=head1 NOTES + +As of version 0.9.7, RSA_METHOD implementations are grouped together with +other algorithmic APIs (eg. DSA_METHOD, EVP_CIPHER, etc) into B +modules. If a default ENGINE is specified for RSA functionality using an +ENGINE API function, that will override any RSA defaults set using the RSA +API (ie. RSA_set_default_method()). For this reason, the ENGINE API is the +recommended way to control default implementations for use in RSA and other +cryptographic algorithms. + +=head1 BUGS + +The behaviour of RSA_flags() is a mis-feature that is left as-is for now +to avoid creating compatibility problems. RSA functionality, such as the +encryption functions, are controlled by the B value in the RSA key +itself, not by the B value in the RSA_METHOD attached to the RSA key +(which is what this function returns). If the flags element of an RSA key +is changed, the changes will be honoured by RSA functionality but will not +be reflected in the return value of the RSA_flags() function - in effect +RSA_flags() behaves more like an RSA_default_flags() function (which does +not currently exist). + =head1 SEE ALSO L, L @@ -161,8 +189,14 @@ well as the rsa_sign and rsa_verify components of RSA_METHOD were added in OpenSSL 0.9.4. RSA_set_default_openssl_method() and RSA_get_default_openssl_method() -replaced RSA_set_default_method() and RSA_get_default_method() respectively, -and RSA_set_method() and RSA_new_method() were altered to use Bs -rather than Bs during development of OpenSSL 0.9.6. +replaced RSA_set_default_method() and RSA_get_default_method() +respectively, and RSA_set_method() and RSA_new_method() were altered to use +Bs rather than Bs during development of the engine +version of OpenSSL 0.9.6. For 0.9.7, the handling of defaults in the ENGINE +API was restructured so that this change was reversed, and behaviour of the +other functions resembled more closely the previous behaviour. The +behaviour of defaults in the ENGINE API now transparently overrides the +behaviour of defaults in the RSA API without requiring changing these +function prototypes. =cut