| 1 | =pod
|
|---|
| 2 |
|
|---|
| 3 | =head1 NAME
|
|---|
| 4 |
|
|---|
| 5 | EVP_PKEY_check, EVP_PKEY_param_check, EVP_PKEY_param_check_quick,
|
|---|
| 6 | EVP_PKEY_public_check, EVP_PKEY_public_check_quick, EVP_PKEY_private_check,
|
|---|
| 7 | EVP_PKEY_pairwise_check
|
|---|
| 8 | - key and parameter validation functions
|
|---|
| 9 |
|
|---|
| 10 | =head1 SYNOPSIS
|
|---|
| 11 |
|
|---|
| 12 | #include <openssl/evp.h>
|
|---|
| 13 |
|
|---|
| 14 | int EVP_PKEY_check(EVP_PKEY_CTX *ctx);
|
|---|
| 15 | int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx);
|
|---|
| 16 | int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx);
|
|---|
| 17 | int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx);
|
|---|
| 18 | int EVP_PKEY_public_check_quick(EVP_PKEY_CTX *ctx);
|
|---|
| 19 | int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx);
|
|---|
| 20 | int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx);
|
|---|
| 21 |
|
|---|
| 22 | =head1 DESCRIPTION
|
|---|
| 23 |
|
|---|
| 24 | EVP_PKEY_param_check() validates the parameters component of the key
|
|---|
| 25 | given by B<ctx>. This check will always succeed for key types that do not have
|
|---|
| 26 | parameters.
|
|---|
| 27 |
|
|---|
| 28 | EVP_PKEY_param_check_quick() validates the parameters component of the key
|
|---|
| 29 | given by B<ctx> like EVP_PKEY_param_check() does. However some algorithm
|
|---|
| 30 | implementations may offer a quicker form of validation that omits some checks in
|
|---|
| 31 | order to perform a lightweight sanity check of the key. If a quicker form is not
|
|---|
| 32 | provided then this function call does the same thing as EVP_PKEY_param_check().
|
|---|
| 33 |
|
|---|
| 34 | EVP_PKEY_public_check() validates the public component of the key given by B<ctx>.
|
|---|
| 35 |
|
|---|
| 36 | EVP_PKEY_public_check_quick() validates the public component of the key
|
|---|
| 37 | given by B<ctx> like EVP_PKEY_public_check() does. However some algorithm
|
|---|
| 38 | implementations may offer a quicker form of validation that omits some checks in
|
|---|
| 39 | order to perform a lightweight sanity check of the key. If a quicker form is not
|
|---|
| 40 | provided then this function call does the same thing as EVP_PKEY_public_check().
|
|---|
| 41 |
|
|---|
| 42 | EVP_PKEY_private_check() validates the private component of the key given by B<ctx>.
|
|---|
| 43 |
|
|---|
| 44 | EVP_PKEY_pairwise_check() validates that the public and private components have
|
|---|
| 45 | the correct mathematical relationship to each other for the key given by B<ctx>.
|
|---|
| 46 |
|
|---|
| 47 | EVP_PKEY_check() is an alias for the EVP_PKEY_pairwise_check() function.
|
|---|
| 48 |
|
|---|
| 49 | =head1 NOTES
|
|---|
| 50 |
|
|---|
| 51 | Key validation used by the OpenSSL FIPS provider complies with the rules
|
|---|
| 52 | within SP800-56A and SP800-56B. For backwards compatibility reasons the OpenSSL
|
|---|
| 53 | default provider may use checks that are not as restrictive for certain key types.
|
|---|
| 54 | For further information see L<EVP_PKEY-DSA(7)/DSA key validation>,
|
|---|
| 55 | L<EVP_PKEY-DH(7)/DH key validation>, L<EVP_PKEY-EC(7)/EC key validation> and
|
|---|
| 56 | L<EVP_PKEY-RSA(7)/RSA key validation>.
|
|---|
| 57 |
|
|---|
| 58 | Refer to SP800-56A and SP800-56B for rules relating to when these functions
|
|---|
| 59 | should be called during key establishment.
|
|---|
| 60 | It is not necessary to call these functions after locally calling an approved key
|
|---|
| 61 | generation method, but may be required for assurance purposes when receiving
|
|---|
| 62 | keys from a third party.
|
|---|
| 63 |
|
|---|
| 64 | =head1 RETURN VALUES
|
|---|
| 65 |
|
|---|
| 66 | All functions return 1 for success or others for failure.
|
|---|
| 67 | They return -2 if the operation is not supported for the specific algorithm.
|
|---|
| 68 |
|
|---|
| 69 | =head1 SEE ALSO
|
|---|
| 70 |
|
|---|
| 71 | L<EVP_PKEY_CTX_new(3)>,
|
|---|
| 72 | L<EVP_PKEY_fromdata(3)>,
|
|---|
| 73 | L<EVP_PKEY-DH(7)>,
|
|---|
| 74 | L<EVP_PKEY-FFC(7)>,
|
|---|
| 75 | L<EVP_PKEY-DSA(7)>,
|
|---|
| 76 | L<EVP_PKEY-EC(7)>,
|
|---|
| 77 | L<EVP_PKEY-RSA(7)>,
|
|---|
| 78 |
|
|---|
| 79 | =head1 HISTORY
|
|---|
| 80 |
|
|---|
| 81 | EVP_PKEY_check(), EVP_PKEY_public_check() and EVP_PKEY_param_check() were added
|
|---|
| 82 | in OpenSSL 1.1.1.
|
|---|
| 83 |
|
|---|
| 84 | EVP_PKEY_param_check_quick(), EVP_PKEY_public_check_quick(),
|
|---|
| 85 | EVP_PKEY_private_check() and EVP_PKEY_pairwise_check() were added in OpenSSL 3.0.
|
|---|
| 86 |
|
|---|
| 87 | =head1 COPYRIGHT
|
|---|
| 88 |
|
|---|
| 89 | Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 90 |
|
|---|
| 91 | Licensed under the Apache License 2.0 (the "License"). You may not use
|
|---|
| 92 | this file except in compliance with the License. You can obtain a copy
|
|---|
| 93 | in the file LICENSE in the source distribution or at
|
|---|
| 94 | L<https://www.openssl.org/source/license.html>.
|
|---|
| 95 |
|
|---|
| 96 | =cut
|
|---|
