From 7854475f422584e161cbbeddd05e86f96a21169e Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 4 Nov 2008 14:05:42 +0000 Subject: OpenSSL requires a signature length of exactly RSA_size() --- src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c') diff --git a/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c b/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c index 756a033bd..eb051b7ab 100644 --- a/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c +++ b/src/libstrongswan/plugins/openssl/openssl_rsa_public_key.c @@ -90,13 +90,11 @@ static bool verify_emsa_pkcs1_signature(private_openssl_rsa_public_key_t *this, goto error; } - /* remove any preceding 0-bytes from signature */ - while (signature.len && *(signature.ptr) == 0x00) + /* VerifyFinal expects a signature of exactly RSA size (no leading 0x00) */ + if (signature.len > RSA_size(this->rsa)) { - signature.len -= 1; - signature.ptr++; + signature = chunk_skip(signature, signature.len - RSA_size(this->rsa)); } - valid = (EVP_VerifyFinal(ctx, signature.ptr, signature.len, key) == 1); error: -- cgit v1.2.3