Skip to contentSkip to conversation

Document that RSA_SIGN can also request TLS 1.2 signatures

PATCH In review Steffan Karger 3 participants 3 messages Dec 25, 2016 – Dec 26, 2016

lore
Share & tools
lore

Steffan Karger

author
#0 lore raw

PATCH 1/1 Document that RSA_SIGN can also request TLS 1.2 signatures

Ever since we support TLS 1.2 (OpenVPN 2.3.3+), the RSA_SIGN might not only request MD5-SHA1 'TLS signatures', but also other variants. Document this by updating the implementation hints, and explicitly stating that we expect a PKCS#1 1.5 signature.

Trac: #764

Signed-off-by Steffan Karger <[email protected]...>
---
 doc/management-notes.txt | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
doc/management-notes.txt +5 -4
index dd870eb..29c3aad 100644
@@ -773,8 +773,9 @@ via a notification as follows:
 
 >RSA_SIGN:[BASE64_DATA]
 
-The management interface client should then sign BASE64_DATA
-using the private key and return the SSL signature as follows:
+The management interface client should then create a PKCS#1 v1.5 signature of
+the (decoded) BASE64_DATA using the private key and return the SSL signature as
+follows:
 
 rsa-sig
 [BASE64_SIG_LINE]

@@ -783,8 +784,8 @@ rsa-sig
 .
 END
 
-Base64 encoded output of RSA_sign(NID_md5_sha1,... will provide a
-correct signature.
+Base64 encoded output of RSA_private_encrypt() (OpenSSL) or mbedtls_pk_sign()
+(mbed TLS) will provide a correct signature.
 
 This capability is intended to allow the use of arbitrary cryptographic
 service providers with OpenVPN via the management interface.
Signature · 1 line
2.7.4
#1 lore raw

Am 25.12.16 um 22:38 schrieb Steffan Karger:

Quoted 4 lines

Ever since we support TLS 1.2 (OpenVPN 2.3.3+), the RSA_SIGN might not only request MD5-SHA1 'TLS signatures', but also other variants. Document this by updating the implementation hints, and explicitly stating that we expect a PKCS#1 1.5 signature.

ACK. I ran into this. ;)

Arne

#2 lore raw
In reply to Steffan Karger

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Your patch has been applied to the following branches

commit 1e36b814073c0f56c77e4922cc105f00b8558e7e (master) commit 9b42853eea285ad54aed8b466e7f5a789a943933 (release/2.4)

Author: Steffan Karger
Date:   Sun Dec 25 23:38:25 2016 +0100
     Document that RSA_SIGN can also request TLS 1.2 signatures

     Trac: #764
     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg13714.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJYYQq6AAoJEIbPlEyWcf3ydS8P/iZDyUGQdlOu+05vZlKY8xTo jK4SkBXud7aleJvTUncQ3YCWBccNfYOlD2iVNKQSmwxsFB5aGunvvpujT99e9ZQk TpWXImERqtbmkd/dMmhBiAGZizNuXhFwX9SgFYI/OCnfQRj9vMaDBbdLo+AM9d8q s2iNTLlEiZYb3+RBV6z6uNgIb8JDOPKDlmbqMZma7TqlpfsbTEQWJe+SpIniglxa /7/ubglukfQQJjxFtQ0/uSapjN64fyXxsDQsQTUZPALTViDC+G/R3KW4VClZVcpa Jsy+ceIlkhUQIC0QVhx7B2mkdyTa4rIN/3a3ytU2WByl4rmDq9FwT406HFjm6D4r 0I5p96iuWK6aYXYW5QB6QfPOh2EtmFZuW7WE/N0BJyXxo+pDyKaGGwTOWiFSEWd7 HrXlTFSkxBk50XYavTmYC7jWLKhcus7GHMjnthSnj8E4DLcsblFiwCluT6aH94yf q0WocsLfBoJUpUUyaY4pLZcb9aRBIZQK/i9o439cu2UfKnAw6Og0Gwsin71z170y V0ahR3SmmF03+KgA1TQv9VvEuPbsORZb9QaZhalkTKgIAKNBzrkV8XdWlIYZngIi hZJug7KVQxo6UHW1NWlhlSVpMt6XGf8YSclDzgu3mGyrO5s6zUivCyK8V1LG6EMb panYszBADhJrItOgjRTS
=w1zq
-----END PGP SIGNATURE-----