@@ -7527,11 +7527,19 @@ int wolfSSL_CTX_check_private_key(const WOLFSSL_CTX* ctx)
75277527#ifdef WOLFSSL_DUAL_ALG_CERTS
75287528#ifdef WOLFSSL_BLIND_PRIVATE_KEY
75297529 privateKey = wolfssl_priv_der_unblind(ctx->privateKey, ctx->privateKeyMask);
7530- altPrivateKey = wolfssl_priv_der_unblind(ctx->altPrivateKey,
7531- ctx->altPrivateKeyMask);
7532- if ((privateKey == NULL) || (altPrivateKey == NULL)) {
7530+ if (privateKey == NULL) {
75337531 res = WOLFSSL_FAILURE;
75347532 }
7533+ if (ctx->altPrivateKey != NULL) {
7534+ altPrivateKey = wolfssl_priv_der_unblind(ctx->altPrivateKey,
7535+ ctx->altPrivateKeyMask);
7536+ if (altPrivateKey == NULL) {
7537+ res = WOLFSSL_FAILURE;
7538+ }
7539+ }
7540+ else {
7541+ altPrivateKey = NULL;
7542+ }
75357543#else
75367544 privateKey = ctx->privateKey;
75377545 altPrivateKey = ctx->altPrivateKey;
@@ -8874,47 +8882,69 @@ int wolfSSL_check_private_key(const WOLFSSL* ssl)
88748882{
88758883 int res = WOLFSSL_SUCCESS;
88768884
8885+ #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8886+ DerBuffer *privateKey;
8887+ #ifdef WOLFSSL_DUAL_ALG_CERTS
8888+ DerBuffer *altPrivateKey;
8889+ #endif
8890+ #else
8891+ const DerBuffer *privateKey;
8892+ #ifdef WOLFSSL_DUAL_ALG_CERTS
8893+ const DerBuffer *altPrivateKey;
8894+ #endif
8895+ #endif
8896+
88778897 if (ssl == NULL) {
88788898 return WOLFSSL_FAILURE;
88798899 }
88808900#ifdef WOLFSSL_DUAL_ALG_CERTS
88818901#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8882- wolfssl_priv_der_unblind(ssl->buffers.key, ssl->buffers.keyMask);
8883- wolfssl_priv_der_unblind(ssl->buffers.altKey, ssl->buffers.altKeyMask);
8884- #endif
8885- res = check_cert_key(ssl->buffers.certificate, ssl->buffers.key,
8886- ssl->buffers.altKey, ssl->heap, ssl->buffers.keyDevId,
8887- ssl->buffers.keyLabel, ssl->buffers.keyId, ssl->buffers.altKeyDevId,
8888- ssl->buffers.altKeyLabel, ssl->buffers.altKeyId);
8889- #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8890- if (res == WOLFSSL_SUCCESS) {
8891- int ret;
8892- ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.key,
8893- (DerBuffer**)&ssl->buffers.keyMask);
8894- if (ret == 0) {
8895- ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.altKey,
8896- (DerBuffer**)&ssl->buffers.altKeyMask);
8897- }
8898- if (ret != 0) {
8902+ privateKey = wolfssl_priv_der_unblind(ssl->buffers.key,
8903+ ssl->buffers.keyMask);
8904+ if (privateKey == NULL) {
8905+ res = WOLFSSL_FAILURE;
8906+ }
8907+ if (ssl->buffers.altKey != NULL) {
8908+ altPrivateKey = wolfssl_priv_der_unblind(ssl->buffers.altKey,
8909+ ssl->buffers.altKeyMask);
8910+ if (altPrivateKey == NULL) {
88998911 res = WOLFSSL_FAILURE;
89008912 }
89018913 }
8902- #endif
8914+ else {
8915+ altPrivateKey = NULL;
8916+ }
89038917#else
8918+ privateKey = ssl->buffers.key;
8919+ altPrivateKey = ssl->buffers.altKey;
8920+ #endif
8921+ if (res == WOLFSSL_SUCCESS) {
8922+ res = check_cert_key(ssl->buffers.certificate, privateKey,
8923+ altPrivateKey, ssl->heap, ssl->buffers.keyDevId,
8924+ ssl->buffers.keyLabel, ssl->buffers.keyId, ssl->buffers.altKeyDevId,
8925+ ssl->buffers.altKeyLabel, ssl->buffers.altKeyId);
8926+ }
89048927#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8905- wolfssl_priv_der_blind_toggle(ssl->buffers.key, ssl->buffers.keyMask);
8928+ wolfssl_priv_der_unblind_free(privateKey);
8929+ wolfssl_priv_der_unblind_free(altPrivateKey);
89068930#endif
8907- res = check_cert_key(ssl->buffers.certificate, ssl->buffers.key, NULL,
8908- ssl->heap, ssl->buffers.keyDevId, ssl->buffers.keyLabel,
8909- ssl->buffers.keyId, INVALID_DEVID, 0, 0);
8931+ #else
89108932#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8933+ privateKey = wolfssl_priv_der_unblind(ssl->buffers.key,
8934+ ssl->buffers.keyMask);
8935+ if (privateKey == NULL) {
8936+ res = WOLFSSL_FAILURE;
8937+ }
8938+ #else
8939+ privateKey = ssl->buffers.key;
8940+ #endif
89118941 if (res == WOLFSSL_SUCCESS) {
8912- int ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.key,
8913- (DerBuffer**)&ssl->buffers.keyMask);
8914- if (ret != 0) {
8915- res = WOLFSSL_FAILURE;
8916- }
8942+ res = check_cert_key(ssl->buffers.certificate, privateKey, NULL,
8943+ ssl->heap, ssl->buffers.keyDevId, ssl->buffers.keyLabel,
8944+ ssl->buffers.keyId, INVALID_DEVID, 0, 0);
89178945 }
8946+ #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8947+ wolfssl_priv_der_unblind_free(privateKey);
89188948#endif
89198949#endif
89208950
@@ -20998,14 +21028,15 @@ WOLFSSL_CTX* wolfSSL_set_SSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
2099821028 ssl->buffers.altKey = ctx->altPrivateKey;
2099921029#else
2100021030 if (ctx->altPrivateKey != NULL) {
21001- ret = AllocCopyDer(&ssl->buffers.altkey , ctx->altPrivateKey->buffer,
21031+ ret = AllocCopyDer(&ssl->buffers.altKey , ctx->altPrivateKey->buffer,
2100221032 ctx->altPrivateKey->length, ctx->altPrivateKey->type,
2100321033 ctx->altPrivateKey->heap);
2100421034 if (ret != 0) {
2100521035 return NULL;
2100621036 }
2100721037 /* Blind the private key for the SSL with new random mask. */
21008- wolfssl_priv_der_unblind(ssl->buffers.altKey, ctx->altPrivateKeyMask);
21038+ wolfssl_priv_der_blind_toggle(ssl->buffers.altKey,
21039+ ctx->altPrivateKeyMask);
2100921040 ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.altKey,
2101021041 &ssl->buffers.altKeyMask);
2101121042 if (ret != 0) {
0 commit comments