Commit 254f84f5 authored by Tianjia Zhang's avatar Tianjia Zhang Committed by Herbert Xu

X.509: support OSCCA certificate parse

The digital certificate format based on SM2 crypto algorithm as
specified in GM/T 0015-2012. It was published by State Encryption
Management Bureau, China.

This patch adds the OID object identifier defined by OSCCA. The
x509 certificate supports SM2-with-SM3 type certificate parsing.
It uses the standard elliptic curve public key, and the sm2
algorithm signs the hash generated by sm3.
Signed-off-by: default avatarTianjia Zhang <tianjia.zhang@linux.alibaba.com>
Tested-by: default avatarXufeng Zhang <yunbo.xufeng@linux.alibaba.com>
Reviewed-by: default avatarVitaly Chikunov <vt@altlinux.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 8b805b97
...@@ -234,6 +234,10 @@ int x509_note_pkey_algo(void *context, size_t hdrlen, ...@@ -234,6 +234,10 @@ int x509_note_pkey_algo(void *context, size_t hdrlen,
case OID_gost2012Signature512: case OID_gost2012Signature512:
ctx->cert->sig->hash_algo = "streebog512"; ctx->cert->sig->hash_algo = "streebog512";
goto ecrdsa; goto ecrdsa;
case OID_SM2_with_SM3:
ctx->cert->sig->hash_algo = "sm3";
goto sm2;
} }
rsa_pkcs1: rsa_pkcs1:
...@@ -246,6 +250,11 @@ int x509_note_pkey_algo(void *context, size_t hdrlen, ...@@ -246,6 +250,11 @@ int x509_note_pkey_algo(void *context, size_t hdrlen,
ctx->cert->sig->encoding = "raw"; ctx->cert->sig->encoding = "raw";
ctx->algo_oid = ctx->last_oid; ctx->algo_oid = ctx->last_oid;
return 0; return 0;
sm2:
ctx->cert->sig->pkey_algo = "sm2";
ctx->cert->sig->encoding = "raw";
ctx->algo_oid = ctx->last_oid;
return 0;
} }
/* /*
...@@ -266,7 +275,8 @@ int x509_note_signature(void *context, size_t hdrlen, ...@@ -266,7 +275,8 @@ int x509_note_signature(void *context, size_t hdrlen,
} }
if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 || if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0) { strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 ||
strcmp(ctx->cert->sig->pkey_algo, "sm2") == 0) {
/* Discard the BIT STRING metadata */ /* Discard the BIT STRING metadata */
if (vlen < 1 || *(const u8 *)value != 0) if (vlen < 1 || *(const u8 *)value != 0)
return -EBADMSG; return -EBADMSG;
...@@ -451,13 +461,20 @@ int x509_extract_key_data(void *context, size_t hdrlen, ...@@ -451,13 +461,20 @@ int x509_extract_key_data(void *context, size_t hdrlen,
struct x509_parse_context *ctx = context; struct x509_parse_context *ctx = context;
ctx->key_algo = ctx->last_oid; ctx->key_algo = ctx->last_oid;
if (ctx->last_oid == OID_rsaEncryption) switch (ctx->last_oid) {
case OID_rsaEncryption:
ctx->cert->pub->pkey_algo = "rsa"; ctx->cert->pub->pkey_algo = "rsa";
else if (ctx->last_oid == OID_gost2012PKey256 || break;
ctx->last_oid == OID_gost2012PKey512) case OID_gost2012PKey256:
case OID_gost2012PKey512:
ctx->cert->pub->pkey_algo = "ecrdsa"; ctx->cert->pub->pkey_algo = "ecrdsa";
else break;
case OID_id_ecPublicKey:
ctx->cert->pub->pkey_algo = "sm2";
break;
default:
return -ENOPKG; return -ENOPKG;
}
/* Discard the BIT STRING metadata */ /* Discard the BIT STRING metadata */
if (vlen < 1 || *(const u8 *)value != 0) if (vlen < 1 || *(const u8 *)value != 0)
......
...@@ -107,6 +107,12 @@ enum OID { ...@@ -107,6 +107,12 @@ enum OID {
OID_gostTC26Sign512B, /* 1.2.643.7.1.2.1.2.2 */ OID_gostTC26Sign512B, /* 1.2.643.7.1.2.1.2.2 */
OID_gostTC26Sign512C, /* 1.2.643.7.1.2.1.2.3 */ OID_gostTC26Sign512C, /* 1.2.643.7.1.2.1.2.3 */
/* OSCCA */
OID_sm2, /* 1.2.156.10197.1.301 */
OID_sm3, /* 1.2.156.10197.1.401 */
OID_SM2_with_SM3, /* 1.2.156.10197.1.501 */
OID_sm3WithRSAEncryption, /* 1.2.156.10197.1.504 */
OID__NR OID__NR
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment