From: Dr. Stephen Henson <steve@openssl.org>
Date: Mon, 30 Jan 2017 13:53:54 +0000 (+0000)
Subject: Only allow PSS signatures with RSA keys and TLS 1.3
X-Git-Tag: OpenSSL_1_1_1-pre1~2516
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=2b4418ebd6a7b748b943f867eac0f3372a8dd5ea;p=oweals%2Fopenssl.git

Only allow PSS signatures with RSA keys and TLS 1.3

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2324)
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 2a39e7ed10..12da585c65 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -835,6 +835,9 @@ int tls12_check_peer_sigalg(SSL *s, uint16_t sig, EVP_PKEY *pkey)
     /* Should never happen */
     if (pkeyid == -1)
         return -1;
+    /* Only allow PSS for TLS 1.3 */
+    if (SSL_IS_TLS13(s) && pkeyid == EVP_PKEY_RSA)
+        pkeyid = EVP_PKEY_RSA_PSS;
     lu = tls1_lookup_sigalg(sig);
     /*
      * Check sigalgs is known and key type is consistent with signature: