tree 20019ff55edae7ff49a121cdc38009fd3fc33bf3
parent 033e5f47d1a95fb9972bc3e4bebe1986b724dc5f
author David Benjamin <davidben@chromium.org> 1415924245 -0500
committer Adam Langley <agl@google.com> 1416349353 +0000

Account for EVP_PKEY capabilities in selecting hash functions.

tls1_process_sigalgs now only determines the intersection between the peer
algorithms and those configured locally. That list is queried later to
determine the hash algorithm to use when signing CertificateVerify or
ServerKeyExchange.

This is needed to support client auth on Windows where smartcards or CAPI may
not support all hash functions.

As a bonus, this does away with more connection-global state. This avoids the
current situation where digests are chosen before keys are known (for
CertificateVerify) or for slots that don't exist.

Change-Id: Iec3619a103d691291d8ebe08ef77d574f2faf0e8
Reviewed-on: https://boringssl-review.googlesource.com/2280
Reviewed-by: Adam Langley <agl@google.com>