generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update certificate hash line format to handle canonical format

Browse Source 
and avoid MD5 dependency.
This commit is contained in:
Dr. Stephen Henson 2009-01-15 13:22:39 +00:00
parent 8125d9f99c
commit c2c99e2860
3 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
CHANGES
View File

@ -4,6 +4,13 @@
Changes between 0.9.8j and 0.9.9 [xx XXX xxxx] Changes between 0.9.8j and 0.9.9 [xx XXX xxxx]
*) Enhance the hash format used for certificate directory links. The new
form uses the canonical encoding (meaning equivalent names will work
even if they aren't identical) and uses SHA1 instead of MD5. This form
is incompatible with the older format and as a result c_rehash should
be used to rebuild symbolic links.
[Steve Henson]
*) Make PKCS#8 the default write format for private keys, replacing the *) Make PKCS#8 the default write format for private keys, replacing the
traditional format. This form is standardised, more secure and doesn't traditional format. This form is standardised, more secure and doesn't
include an implicit MD5 dependency. include an implicit MD5 dependency.

1
crypto/x509/x509.h
View File

@ -963,6 +963,7 @@ unsigned long X509_subject_name_hash(X509 *x);
int X509_cmp(const X509 *a, const X509 *b); int X509_cmp(const X509 *a, const X509 *b);
int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b); int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b);
unsigned long X509_NAME_hash(X509_NAME *x); unsigned long X509_NAME_hash(X509_NAME *x);
unsigned long X509_NAME_hash_old(X509_NAME *x);
int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b); int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b);
int X509_CRL_match(const X509_CRL *a, const X509_CRL *b); int X509_CRL_match(const X509_CRL *a, const X509_CRL *b);

18
crypto/x509/x509_cmp.c
View File

@ -198,11 +198,27 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
} }
unsigned long X509_NAME_hash(X509_NAME *x)
{
unsigned long ret=0;
unsigned char md[16];
/* Make sure X509_NAME structure contains valid cached encoding */
i2d_X509_NAME(x,NULL);
EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(), NULL);
ret=( ((unsigned long)md[0] )|((unsigned long)md[1]<<8L)|
((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
)&0xffffffffL;
return(ret);
}
#ifndef OPENSSL_NO_MD5 #ifndef OPENSSL_NO_MD5
/* I now DER encode the name and hash it. Since I cache the DER encoding, /* I now DER encode the name and hash it. Since I cache the DER encoding,
* this is reasonably efficient. */ * this is reasonably efficient. */
unsigned long X509_NAME_hash(X509_NAME *x)
unsigned long X509_NAME_hash_old(X509_NAME *x)
{ {
unsigned long ret=0; unsigned long ret=0;
unsigned char md[16]; unsigned char md[16];