diff options
| author | Michael Brown <mcb30@ipxe.org> | 2024-08-21 16:25:10 +0100 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2024-08-21 21:00:57 +0100 |
| commit | 46937a9df622d1e9fb5b1e926a04176b8855fdce (patch) | |
| tree | 05287931d7afaad1f6eb3294fcddda4118484c79 /src/include/ipxe/tls.h | |
| parent | acbabdb335f47eb8246188a23ed7e3997da6e8ba (diff) | |
| download | ipxe-46937a9df622d1e9fb5b1e926a04176b8855fdce.tar.gz | |
[crypto] Remove the concept of a public-key algorithm reusable context
Instances of cipher and digest algorithms tend to get called
repeatedly to process substantial amounts of data. This is not true
for public-key algorithms, which tend to get called only once or twice
for a given key.
Simplify the public-key algorithm API so that there is no reusable
algorithm context. In particular, this allows callers to omit the
error handling currently required to handle memory allocation (or key
parsing) errors from pubkey_init(), and to omit the cleanup calls to
pubkey_final().
This change does remove the ability for a caller to distinguish
between a verification failure due to a memory allocation failure and
a verification failure due to a bad signature. This difference is not
material in practice: in both cases, for whatever reason, the caller
was unable to verify the signature and so cannot proceed further, and
the cause of the error will be visible to the user via the return
status code.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/include/ipxe/tls.h')
| -rw-r--r-- | src/include/ipxe/tls.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h index 9494eaa05..08d58689e 100644 --- a/src/include/ipxe/tls.h +++ b/src/include/ipxe/tls.h @@ -240,8 +240,6 @@ struct tls_cipherspec { struct tls_cipher_suite *suite; /** Dynamically-allocated storage */ void *dynamic; - /** Public key encryption context */ - void *pubkey_ctx; /** Bulk encryption cipher context */ void *cipher_ctx; /** MAC secret */ @@ -402,6 +400,8 @@ struct tls_server { struct x509_root *root; /** Certificate chain */ struct x509_chain *chain; + /** Public key (within server certificate) */ + struct asn1_cursor key; /** Certificate validator */ struct interface validator; /** Certificate validation pending operation */ |