From: | ghudson@mit.edu |
Subject: | git commit |
PKINIT ECDH support
Add support for elliptic curve key exchange to PKINIT (RFC 5349
section 4). Extend pkinit_dh_min_bits to allow the string values
"P-256", "P-384", and "P-521", using rough finite-field strength
equivalents to rank them relative to the Oakley Diffie-Hellman groups.
When processing TD-DH-PARAMETERS on the client, only accept the three
Oakley groups or the three supported elliptic curve groups.
Previously we accepted any Diffie-Hellman parameters that passed
EVP_PKEY_param_check()/DH_check() and had equal or better bit strength
to the original proposal.
https://github.com/krb5/krb5/commit/0f870b1bcad960fd5319a3f97aafd7f4a289e2fb
Author: Greg Hudson <ghudson@mit.edu>
Commit: 0f870b1bcad960fd5319a3f97aafd7f4a289e2fb
Branch: master
doc/admin/conf_files/kdc_conf.rst | 7 +-
doc/admin/conf_files/krb5_conf.rst | 7 +-
src/plugins/preauth/pkinit/pkinit.h | 6 +-
src/plugins/preauth/pkinit/pkinit_clnt.c | 17 +-
src/plugins/preauth/pkinit/pkinit_constants.c | 27 ++
src/plugins/preauth/pkinit/pkinit_crypto.h | 7 +
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 470 ++++++++++++++-------
src/plugins/preauth/pkinit/pkinit_crypto_openssl.h | 4 +-
src/plugins/preauth/pkinit/pkinit_lib.c | 3 -
src/plugins/preauth/pkinit/pkinit_srv.c | 17 +-
src/plugins/preauth/pkinit/pkinit_trace.h | 11 +
src/tests/t_pkinit.py | 12 +
12 files changed, 405 insertions(+), 183 deletions(-)