tree be37df5b19c3bc5c6a15a9515494dbf8499af577
parent d512f5a47b07f63eed61fcfa0cb54c0177323b13
author David Benjamin <davidben@google.com> 1755278828 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1755542329 -0700

Don't support parameterless DSA keys in SPKIs

RFC 3279 allows DSA parameters to be omitted, in which case they are
picked up from the issuer in an X.509 chain (which we do not support),
or implicitly from some unspecified out-of-band source.

Update-Note: Parameterless DSA keys (a legacy algorithm) in
SubjectPublicKeyInfo will no longer parse. This does not impact TLS,
where we have never supported DSA.

Bug: 438886851
Change-Id: Ib2e7e70b4eb388af4b4299afbc4b36b9c0505d65
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/81367
Reviewed-by: Lily Chen <chlily@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Auto-Submit: David Benjamin <davidben@google.com>