diff options
| author | Kazuki Yamaguchi <k@rhe.jp> | 2021-12-12 01:25:20 +0900 |
|---|---|---|
| committer | Kazuki Yamaguchi <k@rhe.jp> | 2021-12-17 02:35:22 +0900 |
| commit | 46ca47060ca8ef3419ec36c2326a81b442d9b43b (patch) | |
| tree | 8351ea437e2d0941e09b3d10b29cd28075a29e4b | |
| parent | 8193b7322ece2548eaf3d8acd1aec32bfc2cfdb9 (diff) | |
| download | ruby-openssl-46ca47060ca8ef3419ec36c2326a81b442d9b43b.tar.gz | |
pkey/dh: avoid using DH#set_key in DH#compute_key
DH#set_key will not work on OpenSSL 3.0 because keys are immutable.
For now, let's reimplement DH#compute_key by manually constructing a
DER-encoded SubjectPublicKeyInfo structure and feeding it to
OpenSSL::PKey.read.
Eventually, we should implement a new method around EVP_PKEY_fromdata()
and use it instead.
| -rw-r--r-- | lib/openssl/pkey.rb | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/lib/openssl/pkey.rb b/lib/openssl/pkey.rb index f6bf5892..5864faa9 100644 --- a/lib/openssl/pkey.rb +++ b/lib/openssl/pkey.rb @@ -47,9 +47,19 @@ module OpenSSL::PKey # * _pub_bn_ is a OpenSSL::BN, *not* the DH instance returned by # DH#public_key as that contains the DH parameters only. def compute_key(pub_bn) - peer = dup - peer.set_key(pub_bn, nil) - derive(peer) + # FIXME: This is constructing an X.509 SubjectPublicKeyInfo and is very + # inefficient + obj = OpenSSL::ASN1.Sequence([ + OpenSSL::ASN1.Sequence([ + OpenSSL::ASN1.ObjectId("dhKeyAgreement"), + OpenSSL::ASN1.Sequence([ + OpenSSL::ASN1.Integer(p), + OpenSSL::ASN1.Integer(g), + ]), + ]), + OpenSSL::ASN1.BitString(OpenSSL::ASN1.Integer(pub_bn).to_der), + ]) + derive(OpenSSL::PKey.read(obj.to_der)) end # :call-seq: |