pkey: allow setting algorithm-specific options in #sign and #verify #374
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rhenium
force-pushed
the
ky/pkey-sign-verify-options
branch
from
76db8a4
to
4c13c6a
Compare
|
Do these behave like keyword options? |
|
Technically, it takes Hash as the last (3rd) positional parameter, and the key-value pairs are passed to EVP_PKEY_CTX_ctrl_str(). The Hash can have String and Symbol keys (both converted to String later), so caller can use the keyword argument style as well. My understanding is that Ruby 3 is not going to change this. pkey.sign("sha256", data, { rsa_padding_mode: "pss", ... })
pkey.sign("sha256", data, rsa_padding_mode: "pss", ...)The drawback is that we won't be able to add real keyword arguments to #sign or #verify later. But at the moment I can't think of any. |
rhenium
force-pushed
the
ky/pkey-sign-verify-options
branch
from
4c13c6a
to
e39e92c
Compare
|
CI is failing because the test depends on OpenSSL >= 1.0.2 feature (RSA-PSS). |
rhenium
force-pushed
the
ky/pkey-sign-verify-options
branch
from
e39e92c
to
7f57273
Compare
Fix potential leak of EVP_MD_CTX object in an error path. This path is normally unreachable, since the size of a signature generated by any supported algorithms would not be larger than LONG_MAX.
The routine to apply Hash to EVP_PKEY_CTX_ctrl_str() is currently used by key generation, but it is useful for other operations too. Let's change it to a slightly more generic name.
Similarly to OpenSSL::PKey.generate_key and .generate_parameters, let OpenSSL::PKey::PKey#sign and #verify take an optional parameter for specifying control strings for EVP_PKEY_CTX_ctrl_str().
rhenium
force-pushed
the
ky/pkey-sign-verify-options
branch
from
7f57273
to
faf85d7
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Similarly to OpenSSL::PKey.generate_key and .generate_parameters, add
an optional parameter to OpenSSL::PKey::PKey#sign and #verify to specify
strings for EVP_PKEY_CTX_ctrl_str().