Skip to content

Commit c5f8713

Browse files
paulidalepaulidale
committed
Deprecate the low level RSA functions.
Use of the low level RSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Richard Levitte <[email protected]> (Merged from openssl#11063)
1 parent b9f733c commit c5f8713

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+880
-455
lines changed

‎CHANGES

+39
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,45 @@
1818
use the pkeyparam, pkey and genpkey programs.
1919
[Paul Dale]
2020

21+
*) All of the low level RSA functions have been deprecated including:
22+
23+
RSA_new_method, RSA_bits, RSA_size, RSA_security_bits,
24+
RSA_get0_pss_params, RSA_get_version, RSA_get0_engine,
25+
RSA_generate_key_ex, RSA_generate_multi_prime_key,
26+
RSA_X931_derive_ex, RSA_X931_generate_key_ex, RSA_check_key,
27+
RSA_check_key_ex, RSA_public_encrypt, RSA_private_encrypt,
28+
RSA_public_decrypt, RSA_private_decrypt, RSA_set_default_method,
29+
RSA_get_default_method, RSA_null_method, RSA_get_method, RSA_set_method,
30+
RSA_PKCS1_OpenSSL, RSA_print_fp, RSA_print, RSA_sign, RSA_verify,
31+
RSA_sign_ASN1_OCTET_STRING, RSA_verify_ASN1_OCTET_STRING,
32+
RSA_blinding_on, RSA_blinding_off, RSA_setup_blinding,
33+
RSA_padding_add_PKCS1_type_1, RSA_padding_check_PKCS1_type_1,
34+
RSA_padding_add_PKCS1_type_2, RSA_padding_check_PKCS1_type_2,
35+
PKCS1_MGF1, RSA_padding_add_PKCS1_OAEP, RSA_padding_check_PKCS1_OAEP,
36+
RSA_padding_add_PKCS1_OAEP_mgf1, RSA_padding_check_PKCS1_OAEP_mgf1,
37+
RSA_padding_add_SSLv23, RSA_padding_check_SSLv23,
38+
RSA_padding_add_none, RSA_padding_check_none, RSA_padding_add_X931,
39+
RSA_padding_check_X931, RSA_X931_hash_id, RSA_verify_PKCS1_PSS,
40+
RSA_padding_add_PKCS1_PSS, RSA_verify_PKCS1_PSS_mgf1,
41+
RSA_padding_add_PKCS1_PSS_mgf1, RSA_set_ex_data, RSA_get_ex_data,
42+
RSA_meth_new, RSA_meth_free, RSA_meth_dup, RSA_meth_get0_name,
43+
RSA_meth_set1_name, RSA_meth_get_flags, RSA_meth_set_flags,
44+
RSA_meth_get0_app_data, RSA_meth_set0_app_data, RSA_meth_get_pub_enc,
45+
RSA_meth_set_pub_enc, RSA_meth_get_pub_dec, RSA_meth_set_pub_dec,
46+
RSA_meth_get_priv_enc, RSA_meth_set_priv_enc, RSA_meth_get_priv_dec,
47+
RSA_meth_set_priv_dec, RSA_meth_get_mod_exp, RSA_meth_set_mod_exp,
48+
RSA_meth_get_bn_mod_exp, RSA_meth_set_bn_mod_exp, RSA_meth_get_init,
49+
RSA_meth_set_init, RSA_meth_get_finish, RSA_meth_set_finish,
50+
RSA_meth_get_sign, RSA_meth_set_sign, RSA_meth_get_verify,
51+
RSA_meth_set_verify, RSA_meth_get_keygen, RSA_meth_set_keygen,
52+
RSA_meth_get_multi_prime_keygen and RSA_meth_set_multi_prime_keygen.
53+
54+
Use of these low level functions has been informally discouraged for a long
55+
time. Instead applications should use L<EVP_PKEY_encrypt_init(3)>,
56+
L<EVP_PKEY_encrypt(3)>, L<EVP_PKEY_decrypt_init(3)> and
57+
L<EVP_PKEY_decrypt(3)>.
58+
[Paul Dale]
59+
2160
*) X509 certificates signed using SHA1 are no longer allowed at security
2261
level 1 and above.
2362
In TLS/SSL the default security level is 1. It can be set either

‎apps/build.info

+4-4
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ $OPENSSLSRC=\
1414
openssl.c progs.c \
1515
asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c \
1616
ec.c ecparam.c enc.c engine.c errstr.c \
17-
genpkey.c genrsa.c kdf.c mac.c nseq.c ocsp.c passwd.c pkcs12.c pkcs7.c \
18-
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c rsa.c \
19-
rsautl.c s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
17+
genpkey.c kdf.c mac.c nseq.c ocsp.c passwd.c pkcs12.c pkcs7.c \
18+
pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
19+
s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
2020
spkac.c srp.c ts.c verify.c version.c x509.c rehash.c storeutl.c \
2121
list.c info.c provider.c fipsinstall.c
2222

@@ -32,7 +32,7 @@ IF[{- !$disabled{apps} -}]
3232
ENDIF
3333

3434
IF[{- !$disabled{'deprecated-3.0'} -}]
35-
SOURCE[openssl]=dhparam.c dsa.c dsaparam.c gendsa.c
35+
SOURCE[openssl]=dhparam.c dsa.c dsaparam.c gendsa.c rsa.c rsautl.c genrsa.c
3636
ENDIF
3737

3838
SCRIPTS{misc}=CA.pl

‎apps/genrsa.c

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/* We need to use the deprecated RSA low level calls */
11+
#define OPENSSL_SUPPRESS_DEPRECATED
12+
1013
#include <openssl/opensslconf.h>
1114
#ifdef OPENSSL_NO_RSA
1215
NON_EMPTY_TRANSLATION_UNIT

‎apps/progs.c

+7-5
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ FUNCTION functions[] = {
4949
{FT_general, "gendsa", gendsa_main, gendsa_options, "genpkey"},
5050
#endif
5151
{FT_general, "genpkey", genpkey_main, genpkey_options, NULL},
52-
#ifndef OPENSSL_NO_RSA
53-
{FT_general, "genrsa", genrsa_main, genrsa_options, NULL},
52+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
53+
{FT_general, "genrsa", genrsa_main, genrsa_options, "genpkey"},
5454
#endif
5555
{FT_general, "help", help_main, help_options, NULL},
5656
{FT_general, "info", info_main, info_options, NULL},
@@ -75,9 +75,11 @@ FUNCTION functions[] = {
7575
{FT_general, "rand", rand_main, rand_options, NULL},
7676
{FT_general, "rehash", rehash_main, rehash_options, NULL},
7777
{FT_general, "req", req_main, req_options, NULL},
78-
{FT_general, "rsa", rsa_main, rsa_options, NULL},
79-
#ifndef OPENSSL_NO_RSA
80-
{FT_general, "rsautl", rsautl_main, rsautl_options, NULL},
78+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
79+
{FT_general, "rsa", rsa_main, rsa_options, "pkey"},
80+
#endif
81+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
82+
{FT_general, "rsautl", rsautl_main, rsautl_options, "pkeyutl"},
8183
#endif
8284
#ifndef OPENSSL_NO_SOCK
8385
{FT_general, "s_client", s_client_main, s_client_options, NULL},

‎apps/progs.pl

+3-2
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,13 @@
9292

9393
my %cmd_disabler = (
9494
ciphers => "sock",
95-
genrsa => "rsa",
96-
rsautl => "rsa",
9795
gendh => "dh",
9896
pkcs12 => "des",
9997
);
10098
my %cmd_deprecated = (
99+
rsa => [ "3_0", "pkey", "rsa" ],
100+
genrsa => [ "3_0", "genpkey", "rsa" ],
101+
rsautl => [ "3_0", "pkeyutl", "rsa" ],
101102
dhparam => [ "3_0", "pkeyparam", "dh" ],
102103
dsaparam => [ "3_0", "pkeyparam", "dsa" ],
103104
dsa => [ "3_0", "pkey", "dsa" ],

‎apps/rsa.c

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/* We need to use the deprecated RSA low level calls */
11+
#define OPENSSL_SUPPRESS_DEPRECATED
12+
1013
#include <openssl/opensslconf.h>
1114
#ifdef OPENSSL_NO_RSA
1215
NON_EMPTY_TRANSLATION_UNIT

‎apps/rsautl.c

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/* We need to use the deprecated RSA low level calls */
11+
#define OPENSSL_SUPPRESS_DEPRECATED
12+
1013
#include <openssl/opensslconf.h>
1114
#ifdef OPENSSL_NO_RSA
1215
NON_EMPTY_TRANSLATION_UNIT

‎apps/speed.c

+18-13
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@
9494
#ifndef OPENSSL_NO_CAST
9595
# include <openssl/cast.h>
9696
#endif
97-
#ifndef OPENSSL_NO_RSA
97+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
9898
# include <openssl/rsa.h>
9999
# include "./testrsa.h"
100100
#endif
@@ -416,7 +416,7 @@ static const OPT_PAIR dsa_choices[DSA_NUM] = {
416416
static double dsa_results[DSA_NUM][2]; /* 2 ops: sign then verify */
417417
#endif /* OPENSSL_NO_DSA */
418418

419-
#ifndef OPENSSL_NO_RSA
419+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
420420
enum {
421421
R_RSA_512, R_RSA_1024, R_RSA_2048, R_RSA_3072, R_RSA_4096, R_RSA_7680,
422422
R_RSA_15360, RSA_NUM
@@ -542,7 +542,7 @@ typedef struct loopargs_st {
542542
unsigned char *key;
543543
unsigned int siglen;
544544
size_t sigsize;
545-
#ifndef OPENSSL_NO_RSA
545+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
546546
RSA *rsa_key[RSA_NUM];
547547
#endif
548548
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
@@ -1021,7 +1021,7 @@ static int EVP_CMAC_loop(void *args)
10211021
}
10221022
#endif
10231023

1024-
#ifndef OPENSSL_NO_RSA
1024+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
10251025
static long rsa_c[RSA_NUM][2]; /* # RSA iteration test */
10261026

10271027
static int RSA_sign_loop(void *args)
@@ -1503,7 +1503,7 @@ int speed_main(int argc, char **argv)
15031503
#if !defined(OPENSSL_NO_CAMELLIA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
15041504
CAMELLIA_KEY camellia_ks[3];
15051505
#endif
1506-
#ifndef OPENSSL_NO_RSA
1506+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
15071507
static const struct {
15081508
const unsigned char *data;
15091509
unsigned int length;
@@ -1707,8 +1707,10 @@ int speed_main(int argc, char **argv)
17071707
goto end;
17081708
break;
17091709
case OPT_PRIMES:
1710+
#ifndef OPENSSL_NO_DEPRECATED_3_0
17101711
if (!opt_int(opt_arg(), &primes))
17111712
goto end;
1713+
#endif
17121714
break;
17131715
case OPT_SECONDS:
17141716
seconds.sym = seconds.rsa = seconds.dsa = seconds.ecdsa
@@ -1746,7 +1748,7 @@ int speed_main(int argc, char **argv)
17461748
doit[D_SHA1] = doit[D_SHA256] = doit[D_SHA512] = 1;
17471749
continue;
17481750
}
1749-
#ifndef OPENSSL_NO_RSA
1751+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
17501752
if (strcmp(algo, "openssl") == 0) /* just for compatibility */
17511753
continue;
17521754
if (strncmp(algo, "rsa", 3) == 0) {
@@ -1909,7 +1911,7 @@ int speed_main(int argc, char **argv)
19091911
if (argc == 0 && !doit[D_EVP] && !doit[D_EVP_HMAC] && !doit[D_EVP_CMAC]) {
19101912
memset(doit, 1, sizeof(doit));
19111913
doit[D_EVP] = doit[D_EVP_HMAC] = doit[D_EVP_CMAC] = 0;
1912-
#ifndef OPENSSL_NO_RSA
1914+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
19131915
memset(rsa_doit, 1, sizeof(rsa_doit));
19141916
#endif
19151917
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
@@ -1933,7 +1935,7 @@ int speed_main(int argc, char **argv)
19331935
"You have chosen to measure elapsed time "
19341936
"instead of user CPU time.\n");
19351937

1936-
#ifndef OPENSSL_NO_RSA
1938+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
19371939
for (i = 0; i < loopargs_len; i++) {
19381940
if (primes > RSA_DEFAULT_PRIME_NUM) {
19391941
/* for multi-prime RSA, skip this */
@@ -2103,7 +2105,7 @@ int speed_main(int argc, char **argv)
21032105
c[D_IGE_256_AES][i] = c[D_IGE_256_AES][i - 1] * l0 / l1;
21042106
}
21052107

2106-
# ifndef OPENSSL_NO_RSA
2108+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
21072109
rsa_c[R_RSA_512][0] = count / 2000;
21082110
rsa_c[R_RSA_512][1] = count / 400;
21092111
for (i = 1; i < RSA_NUM; i++) {
@@ -2859,7 +2861,7 @@ int speed_main(int argc, char **argv)
28592861
if (RAND_bytes(loopargs[i].buf, 36) <= 0)
28602862
goto end;
28612863

2862-
#ifndef OPENSSL_NO_RSA
2864+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
28632865
for (testnum = 0; testnum < RSA_NUM; testnum++) {
28642866
int st = 0;
28652867
if (!rsa_doit[testnum])
@@ -3564,7 +3566,7 @@ int speed_main(int argc, char **argv)
35643566
}
35653567
printf("\n");
35663568
}
3567-
#ifndef OPENSSL_NO_RSA
3569+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
35683570
testnum = 1;
35693571
for (k = 0; k < RSA_NUM; k++) {
35703572
if (!rsa_doit[k])
@@ -3691,7 +3693,7 @@ int speed_main(int argc, char **argv)
36913693
OPENSSL_free(loopargs[i].buf_malloc);
36923694
OPENSSL_free(loopargs[i].buf2_malloc);
36933695

3694-
#ifndef OPENSSL_NO_RSA
3696+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
36953697
for (k = 0; k < RSA_NUM; k++)
36963698
RSA_free(loopargs[i].rsa_key[k]);
36973699
#endif
@@ -3887,7 +3889,9 @@ static int do_multi(int multi, int size_num)
38873889
sstrsep(&p, sep);
38883890
for (j = 0; j < size_num; ++j)
38893891
results[alg][j] += atof(sstrsep(&p, sep));
3890-
} else if (strncmp(buf, "+F2:", 4) == 0) {
3892+
}
3893+
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
3894+
else if (strncmp(buf, "+F2:", 4) == 0) {
38913895
int k;
38923896
double d;
38933897

@@ -3901,6 +3905,7 @@ static int do_multi(int multi, int size_num)
39013905
d = atof(sstrsep(&p, sep));
39023906
rsa_results[k][1] += d;
39033907
}
3908+
#endif
39043909
#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
39053910
else if (strncmp(buf, "+F3:", 4) == 0) {
39063911
int k;

‎crypto/evp/p_dec.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <stdio.h>
1117
#include "internal/cryptlib.h"
1218
#include <openssl/rsa.h>

‎crypto/evp/p_enc.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <stdio.h>
1117
#include "internal/cryptlib.h"
1218
#include <openssl/rsa.h>

‎crypto/rsa/rsa_ameth.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <stdio.h>
1117
#include "internal/cryptlib.h"
1218
#include <openssl/asn1t.h>

‎crypto/rsa/rsa_asn1.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <stdio.h>
1117
#include "internal/cryptlib.h"
1218
#include <openssl/bn.h>

‎crypto/rsa/rsa_chk.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <openssl/bn.h>
1117
#include <openssl/err.h>
1218
#include "crypto/rsa.h"

‎crypto/rsa/rsa_crpt.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <stdio.h>
1117
#include <openssl/crypto.h>
1218
#include "internal/cryptlib.h"

‎crypto/rsa/rsa_depr.c

+6
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@
1212
* "new" versions).
1313
*/
1414

15+
/*
16+
* RSA low level APIs are deprecated for public use, but still ok for
17+
* internal use.
18+
*/
19+
#include "internal/deprecated.h"
20+
1521
#include <openssl/opensslconf.h>
1622
#ifdef OPENSSL_NO_DEPRECATED_0_9_8
1723
NON_EMPTY_TRANSLATION_UNIT

‎crypto/rsa/rsa_gen.c

+6
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,12 @@
1313
* Geoff
1414
*/
1515

16+
/*
17+
* RSA low level APIs are deprecated for public use, but still ok for
18+
* internal use.
19+
*/
20+
#include "internal/deprecated.h"
21+
1622
#include <stdio.h>
1723
#include <time.h>
1824
#include "internal/cryptlib.h"

‎crypto/rsa/rsa_lib.c

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@
77
* https://www.openssl.org/source/license.html
88
*/
99

10+
/*
11+
* RSA low level APIs are deprecated for public use, but still ok for
12+
* internal use.
13+
*/
14+
#include "internal/deprecated.h"
15+
1016
#include <stdio.h>
1117
#include <openssl/crypto.h>
1218
#include <openssl/core_names.h>

0 commit comments

Comments
 (0)