Remove client-side support for ServerKeyExchange in the RSA key exchange.
Server-side support was removed in 77a942b7fedb58ae1afee042255b4b9267abebca,
but client-side support was retained as it appeared NSS supported this.
However, this is not the case: ssl3_HandleServerKeyExchange only allows a
ServerKeyExchange message if hs.ws is in an appropriate state.
ssl3_AuthCertificate only sets it to allow ServerKeyExchange if it is a key
exchange that normally uses it or if is_limited is set. is_limited is only set
for the export cipher suites.
Thus we can safely remove this without waiting on gathering UMA data.
BUG=chromium:400587
Change-Id: I9aefb742dbb2d99c13340ab48017e1ceee04bc2f
Reviewed-on: https://boringssl-review.googlesource.com/2230
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 0806d77..36f82bc 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1230,11 +1230,6 @@
if (s->session->sess_cert != NULL)
{
- if (s->session->sess_cert->peer_rsa_tmp != NULL)
- {
- RSA_free(s->session->sess_cert->peer_rsa_tmp);
- s->session->sess_cert->peer_rsa_tmp=NULL;
- }
if (s->session->sess_cert->peer_dh_tmp)
{
DH_free(s->session->sess_cert->peer_dh_tmp);
@@ -1293,55 +1288,7 @@
}
}
- if (alg_k & SSL_kRSA)
- {
- CBS rsa_modulus, rsa_exponent;
-
- /* TODO(davidben): This was originally for export
- * reasons. Do we still need to support it? */
-
- if (!CBS_get_u16_length_prefixed(&server_key_exchange, &rsa_modulus) ||
- CBS_len(&rsa_modulus) == 0 ||
- !CBS_get_u16_length_prefixed(&server_key_exchange, &rsa_exponent) ||
- CBS_len(&rsa_exponent) == 0)
- {
- al = SSL_AD_DECODE_ERROR;
- OPENSSL_PUT_ERROR(SSL, ssl3_get_server_key_exchange, SSL_R_DECODE_ERROR);
- goto f_err;
- }
-
- if ((rsa=RSA_new()) == NULL)
- {
- OPENSSL_PUT_ERROR(SSL, ssl3_get_server_key_exchange, ERR_R_MALLOC_FAILURE);
- goto err;
- }
-
- if (!(rsa->n = BN_bin2bn(CBS_data(&rsa_modulus),
- CBS_len(&rsa_modulus), rsa->n)))
- {
- OPENSSL_PUT_ERROR(SSL, ssl3_get_server_key_exchange, ERR_R_BN_LIB);
- goto err;
- }
-
- if (!(rsa->e = BN_bin2bn(CBS_data(&rsa_exponent),
- CBS_len(&rsa_exponent), rsa->e)))
- {
- OPENSSL_PUT_ERROR(SSL, ssl3_get_server_key_exchange, ERR_R_BN_LIB);
- goto err;
- }
-
- /* this should be because we are using an export cipher */
- if (alg_a & SSL_aRSA)
- pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
- else
- {
- OPENSSL_PUT_ERROR(SSL, ssl3_get_server_key_exchange, ERR_R_INTERNAL_ERROR);
- goto err;
- }
- s->session->sess_cert->peer_rsa_tmp=rsa;
- rsa=NULL;
- }
- else if (alg_k & SSL_kEDH)
+ if (alg_k & SSL_kEDH)
{
CBS dh_p, dh_g, dh_Ys;
@@ -1990,21 +1937,16 @@
goto err;
}
- if (s->session->sess_cert->peer_rsa_tmp != NULL)
- rsa=s->session->sess_cert->peer_rsa_tmp;
- else
+ pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+ if ((pkey == NULL) ||
+ (pkey->type != EVP_PKEY_RSA) ||
+ (pkey->pkey.rsa == NULL))
{
- pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
- if ((pkey == NULL) ||
- (pkey->type != EVP_PKEY_RSA) ||
- (pkey->pkey.rsa == NULL))
- {
- OPENSSL_PUT_ERROR(SSL, ssl3_send_client_key_exchange, ERR_R_INTERNAL_ERROR);
- goto err;
- }
- rsa=pkey->pkey.rsa;
- EVP_PKEY_free(pkey);
+ OPENSSL_PUT_ERROR(SSL, ssl3_send_client_key_exchange, ERR_R_INTERNAL_ERROR);
+ goto err;
}
+ rsa=pkey->pkey.rsa;
+ EVP_PKEY_free(pkey);
pms[0]=s->client_version>>8;
pms[1]=s->client_version&0xff;
@@ -2499,7 +2441,6 @@
long alg_k,alg_a;
EVP_PKEY *pkey=NULL;
SESS_CERT *sc;
- RSA *rsa;
DH *dh;
/* we don't have a certificate */
@@ -2516,7 +2457,6 @@
goto err;
}
- rsa=s->session->sess_cert->peer_rsa_tmp;
dh=s->session->sess_cert->peer_dh_tmp;
/* This is the passed certificate */
@@ -2551,8 +2491,7 @@
OPENSSL_PUT_ERROR(SSL, ssl3_check_cert_and_algorithm, SSL_R_MISSING_RSA_SIGNING_CERT);
goto f_err;
}
- if ((alg_k & SSL_kRSA) &&
- !(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
+ if ((alg_k & SSL_kRSA) && !has_bits(i,EVP_PK_RSA|EVP_PKT_ENC))
{
OPENSSL_PUT_ERROR(SSL, ssl3_check_cert_and_algorithm, SSL_R_MISSING_RSA_ENCRYPTING_CERT);
goto f_err;
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index e4ded32..0141dde 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -1381,14 +1381,12 @@
EVP_PKEY *ptmp;
int rv = 0;
sc = s->session->sess_cert;
- if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp && !sc->peer_ecdh_tmp)
+ if (!sc->peer_dh_tmp && !sc->peer_ecdh_tmp)
return 0;
ptmp = EVP_PKEY_new();
if (!ptmp)
return 0;
- if (sc->peer_rsa_tmp)
- rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
- else if (sc->peer_dh_tmp)
+ if (sc->peer_dh_tmp)
rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
else if (sc->peer_ecdh_tmp)
rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 3d56da6..50ff7fc 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -567,8 +567,6 @@
#endif
}
- if (sc->peer_rsa_tmp != NULL)
- RSA_free(sc->peer_rsa_tmp);
if (sc->peer_dh_tmp != NULL)
DH_free(sc->peer_dh_tmp);
if (sc->peer_ecdh_tmp != NULL)
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 97169f2..a55b1e7 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -1456,15 +1456,7 @@
*
* Unlike ssl_cipher_has_server_public_key, some ciphers take optional
* ServerKeyExchanges. PSK and RSA_PSK only use the ServerKeyExchange
- * to communicate a psk_identity_hint, so it is optional.
- *
- * Also, as implemented, the RSA key exchange takes an optional
- * ServerKeyExchange containing a signed ephemeral RSA encryption key.
- *
- * TODO(davidben): Can we remove the RSA one? This is a remnant of
- * RSA_EXPORT ciphers which required this (it was used to generate an
- * ephemeral 512-bit RSA encryption key), but it's allowed for all RSA
- * ciphers. */
+ * to communicate a psk_identity_hint, so it is optional. */
int ssl_cipher_requires_server_key_exchange(const SSL_CIPHER *cipher)
{
/* Ephemeral Diffie-Hellman key exchanges require a
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index c214b91..aca7cbd 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -537,8 +537,7 @@
/* Obviously we don't have the private keys of these,
* so maybe we shouldn't even use the CERT_PKEY type here. */
- RSA *peer_rsa_tmp; /* not used for SSL 2 */
- DH *peer_dh_tmp; /* not used for SSL 2 */
+ DH *peer_dh_tmp;
EC_KEY *peer_ecdh_tmp;
} SESS_CERT;
/* Structure containing decoded values of signature algorithms extension */
