From 92fee4213b80e3980f07260e5816e99b9e146e08 Mon Sep 17 00:00:00 2001 From: Pauli Date: Tue, 18 Feb 2020 11:36:08 +1000 Subject: [PATCH] pkey: additional EC related options Add options to change the parameter encoding and point conversions for EC public and private keys. These options are present in the deprecated 'ec' utility. Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/11113) --- apps/pkey.c | 69 +++++++++++++++++++++++++++++++++++- doc/man1/openssl-pkey.pod.in | 34 ++++++++++++++++++ 2 files changed, 102 insertions(+), 1 deletion(-) diff --git a/apps/pkey.c b/apps/pkey.c index 6100f8dcd3..54709f656e 100644 --- a/apps/pkey.c +++ b/apps/pkey.c @@ -15,11 +15,29 @@ #include #include +#ifndef OPENSSL_NO_EC +# include + +static OPT_PAIR ec_conv_forms[] = { + {"compressed", POINT_CONVERSION_COMPRESSED}, + {"uncompressed", POINT_CONVERSION_UNCOMPRESSED}, + {"hybrid", POINT_CONVERSION_HYBRID}, + {NULL} +}; + +static OPT_PAIR ec_param_enc[] = { + {"named_curve", OPENSSL_EC_NAMED_CURVE}, + {"explicit", 0}, + {NULL} +}; +#endif + typedef enum OPTION_choice { OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB, - OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK + OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK, + OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM } OPTION_CHOICE; const OPTIONS pkey_options[] = { @@ -31,6 +49,10 @@ const OPTIONS pkey_options[] = { {"check", OPT_CHECK, '-', "Check key consistency"}, {"pubcheck", OPT_PUB_CHECK, '-', "Check public key consistency"}, {"", OPT_MD, '-', "Any supported cipher"}, + {"ec_param_enc", OPT_EC_PARAM_ENC, 's', + "Specifies the way the ec parameters are encoded"}, + {"ec_conv_form", OPT_EC_CONV_FORM, 's', + "Specifies the point conversion form "}, OPT_SECTION("Input"), {"in", OPT_IN, 's', "Input key"}, @@ -65,6 +87,12 @@ int pkey_main(int argc, char **argv) int informat = FORMAT_PEM, outformat = FORMAT_PEM; int pubin = 0, pubout = 0, pubtext = 0, text = 0, noout = 0, ret = 1; int private = 0, traditional = 0, check = 0, pub_check = 0; +#ifndef OPENSSL_NO_EC + EC_KEY *eckey; + int ec_asn1_flag = OPENSSL_EC_NAMED_CURVE, new_ec_asn1_flag = 0; + int i, new_ec_form = 0; + point_conversion_form_t ec_form = POINT_CONVERSION_UNCOMPRESSED; +#endif prog = opt_init(argc, argv, pkey_options); while ((o = opt_next()) != OPT_EOF) { @@ -128,6 +156,27 @@ int pkey_main(int argc, char **argv) case OPT_MD: if (!opt_cipher(opt_unknown(), &cipher)) goto opthelp; + break; + case OPT_EC_CONV_FORM: +#ifdef OPENSSL_NO_EC + goto opthelp; +#else + if (!opt_pair(opt_arg(), ec_conv_forms, &i)) + goto opthelp; + new_ec_form = 1; + ec_form = i; + break; +#endif + case OPT_EC_PARAM_ENC: +#ifdef OPENSSL_NO_EC + goto opthelp; +#else + if (!opt_pair(opt_arg(), ec_param_enc, &i)) + goto opthelp; + new_ec_asn1_flag = 1; + ec_asn1_flag = i; + break; +#endif } } argc = opt_num_rest(); @@ -154,6 +203,24 @@ int pkey_main(int argc, char **argv) if (pkey == NULL) goto end; +#ifndef OPENSSL_NO_EC + /* + * TODO: remove this and use a set params call with a 'pkeyopt' command + * line option instead. + */ + if (new_ec_form || new_ec_asn1_flag) { + if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) { + ERR_print_errors(bio_err); + goto end; + } + if (new_ec_form) + EC_KEY_set_conv_form(eckey, ec_form); + + if (new_ec_asn1_flag) + EC_KEY_set_asn1_flag(eckey, ec_asn1_flag); + } +#endif + if (check || pub_check) { int r; EVP_PKEY_CTX *ctx; diff --git a/doc/man1/openssl-pkey.pod.in b/doc/man1/openssl-pkey.pod.in index c85fc12327..31bf005f74 100644 --- a/doc/man1/openssl-pkey.pod.in +++ b/doc/man1/openssl-pkey.pod.in @@ -28,6 +28,8 @@ B B [B<-pubout>] [B<-check>] [B<-pubcheck>] +[B<-ec_conv_form> I] +[B<-ec_param_enc> I] {- $OpenSSL::safe::opt_engine_synopsis -} =for openssl ifdef engine @@ -114,6 +116,30 @@ components. This option checks the correctness of either a public key or the public component of a key pair. +=item B<-ec_conv_form> I + +This option only applies to elliptic curve based public and private keys. + +This specifies how the points on the elliptic curve are converted +into octet strings. Possible values are: B (the default +value), B and B. For more information regarding +the point conversion forms please read the X9.62 standard. +B Due to patent issues the B option is disabled +by default for binary curves and can be enabled by defining +the preprocessor macro B at compile time. + +=item B<-ec_param_enc> I + +This option only applies to elliptic curve based public and private keys. + +This specifies how the elliptic curve parameters are encoded. +Possible value are: B, i.e. the ec parameters are +specified by an OID, or B where the ec parameters are +explicitly given (see RFC 3279 for the definition of the +EC parameters structures). The default value is B. +B the B alternative, as specified in RFC 3279, +is currently not implemented in OpenSSL. + {- $OpenSSL::safe::opt_engine_item -} =back @@ -144,6 +170,14 @@ To just output the public part of a private key: openssl pkey -in key.pem -pubout -out pubkey.pem +To change the EC parameters encoding to B: + + openssl pkey -in key.pem -ec_param_enc explicit -out keyout.pem + +To change the EC point conversion form to B: + + openssl pkey -in key.pem -ec_conv_form compressed -out keyout.pem + =head1 SEE ALSO L, -- 2.25.1