commit b1d4eb16e4bb3e06b78630b0a521bac7e9ca9720
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Wed Jan 22 10:12:57 2014 +0100
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Sat Jan 25 12:48:58 2014 +0100
tree fdc2cc1a98b531c7f77229bc2284260a28b966c0
parent d75ba40cc3f7f99c117456f59364784c4710b595

Basic parsing of certs signed with RSASSA-PSS

include/polarssl/config.h

diff --git a/include/polarssl/config.h b/include/polarssl/config.h
index 83f9dac..29ba54f 100644
--- a/include/polarssl/config.h
+++ b/include/polarssl/config.h
@@ -154,6 +154,22 @@
 //#define POLARSSL_SHA512_ALT
 
 /**
+ * \def POLARSSL_RSASSA_PSS_CERTIFICATES
+ *
+ * Enable parsing and verification of X.509 certificates and CRLs signed with
+ * RSASSA-PSS.
+ *
+ * This is disabled by default since it breaks binary compatibility with the
+ * 1.3.x line. If you choose to enable it, you will need to rebuild your
+ * application against the new header files, relinking will not be enough.
+ *
+ * TODO: actually disable it when done working on this branch ,)
+ *
+ * Uncomment this macro to allow using RSASSA-PSS in certificates.
+ */
+#define POLARSSL_RSASSA_PSS_CERTIFICATES
+
+/**
  * \def POLARSSL_AES_ROM_TABLES
  *
  * Store the AES tables in ROM.

include/polarssl/oid.h

diff --git a/include/polarssl/oid.h b/include/polarssl/oid.h
index f000b8e..669ad53 100644
--- a/include/polarssl/oid.h
+++ b/include/polarssl/oid.h
@@ -193,6 +193,9 @@
 
 #define OID_PKCS9_EMAIL         OID_PKCS9 "\x01" /**< emailAddress AttributeType ::= { pkcs-9 1 } */
 
+/* RFC 4055 */
+#define OID_RSASSA_PSS          OID_PKCS1 "\x0a" /**< id-RSASSA-PSS ::= { pkcs-1 10 } */
+
 /*
  * Digest algorithms
  */

include/polarssl/pk.h

diff --git a/include/polarssl/pk.h b/include/polarssl/pk.h
index 8b84471..e4b5618 100644
--- a/include/polarssl/pk.h
+++ b/include/polarssl/pk.h
@@ -94,6 +94,7 @@
     POLARSSL_PK_ECKEY_DH,
     POLARSSL_PK_ECDSA,
     POLARSSL_PK_RSA_ALT,
+    POLARSSL_PK_RSASSA_PSS,
 } pk_type_t;
 
 /**

include/polarssl/x509.h

diff --git a/include/polarssl/x509.h b/include/polarssl/x509.h
index a456537..c48e00a 100644
--- a/include/polarssl/x509.h
+++ b/include/polarssl/x509.h
@@ -254,6 +254,8 @@
                    x509_name *cur );
 int x509_get_alg_null( unsigned char **p, const unsigned char *end,
                        x509_buf *alg );
+int x509_get_alg( unsigned char **p, const unsigned char *end,
+                  x509_buf *alg, x509_buf *params );
 int x509_get_sig( unsigned char **p, const unsigned char *end, x509_buf *sig );
 int x509_get_sig_alg( const x509_buf *sig_oid, md_type_t *md_alg,
                       pk_type_t *pk_alg );

include/polarssl/x509_crt.h

diff --git a/include/polarssl/x509_crt.h b/include/polarssl/x509_crt.h
index ee8f9e6..916dc3b 100644
--- a/include/polarssl/x509_crt.h
+++ b/include/polarssl/x509_crt.h
@@ -89,6 +89,9 @@
     x509_buf sig;               /**< Signature: hash of the tbs part signed with the private key. */
     md_type_t sig_md;           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. POLARSSL_MD_SHA256 */
     pk_type_t sig_pk            /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. POLARSSL_PK_RSA */;
+#if defined(POLARSSL_RSASSA_PSS_CERTIFICATES)
+    x509_buf sig_params;        /**< Parameters for the signature algorithm */
+#endif
 
     struct _x509_crt *next;     /**< Next certificate in the CA-chain. */
 }