OpenSSL::PKey convenience methods #373
Conversation
| len = EVP_PKEY_size(pkey); | ||
| unsigned char str[len]; | ||
|
|
||
| return EVP_PKEY_get_raw_private_key(pkey, str, &len) == 1 ? Qtrue : Qfalse; |
There was a problem hiding this comment.
I'm pretty sure I'm not doing this right. According to https://www.openssl.org/docs/man1.1.1/man3/EVP_PKEY_get_raw_private_key.html:
EVP_PKEY_get_raw_private_key() fills the buffer provided by priv with raw private key data. The size of the priv buffer should be in *len on entry to the function, and on exit *len is updated with the number of bytes actually written. If the buffer priv is NULL then *len is populated with the number of bytes required to hold the key.
However if I pass NULL instead of str the tests fail 🤔
ext/openssl/ossl_pkey.c
Outdated
| int nid = OBJ_sn2nid(StringValueCStr(type)); | ||
| if(!nid) ossl_raise(ePKeyError, "unknown OID `%"PRIsVALUE"'", type); | ||
|
|
||
| size_t keylen = RSTRING_LEN(key); |
There was a problem hiding this comment.
Variable declaration after statements is a C99 feature. Unfortunately we can't use it until we drop support for Ruby 2.6.
| EVP_PKEY *pkey; | ||
|
|
||
| int nid = OBJ_sn2nid(StringValueCStr(type)); | ||
| if(!nid) ossl_raise(ePKeyError, "unknown OID `%"PRIsVALUE"'", type); |
There was a problem hiding this comment.
Please use EVP_PKEY_asn1_find_str() instead of OBJ_sn2nid().
pkey_generate() is currently doing this. I think it should be extracted as a function.
|
EVP_PKEY_new_raw_private_key()/EVP_PKEY_get_raw_private_key() family is for pkey types that support "raw public/private key", such as X25519 (but not RSA, for example). It can't be used to implement #private?. I think it can use OSSL_PKEY_SET_PRIVATE() macro to mark the pkey contains private components or not, similar to OpenSSL::Engine#load_private_key, since a private key will not suddenly become a public key, or vice versa. OpenSSL::PKey.read and PKey::*.new can do the same. Anyway, I think this is out of scope of this Pull Request. |
bdewater
force-pushed
the
pkey-convenience-methods
branch
2 times, most recently
from
44e7735 to
cbc53fc
Compare
bdewater
force-pushed
the
pkey-convenience-methods
branch
from
cbc53fc to
8f7467f
Compare
|
This was superseded by #646, and it's been merged to master now. Thank you! |
Implementing #329 (comment) and Marshal support. I'm not very good at C, so any feedback is very welcome.