@@ -7519,11 +7519,19 @@ int wolfSSL_CTX_check_private_key(const WOLFSSL_CTX* ctx)
75197519#ifdef WOLFSSL_DUAL_ALG_CERTS
75207520#ifdef WOLFSSL_BLIND_PRIVATE_KEY
75217521 privateKey = wolfssl_priv_der_unblind(ctx->privateKey, ctx->privateKeyMask);
7522- altPrivateKey = wolfssl_priv_der_unblind(ctx->altPrivateKey,
7523- ctx->altPrivateKeyMask);
7524- if ((privateKey == NULL) || (altPrivateKey == NULL)) {
7522+ if (privateKey == NULL) {
75257523 res = WOLFSSL_FAILURE;
75267524 }
7525+ if (ctx->altPrivateKey != NULL) {
7526+ altPrivateKey = wolfssl_priv_der_unblind(ctx->altPrivateKey,
7527+ ctx->altPrivateKeyMask);
7528+ if (altPrivateKey == NULL) {
7529+ res = WOLFSSL_FAILURE;
7530+ }
7531+ }
7532+ else {
7533+ altPrivateKey = NULL;
7534+ }
75277535#else
75287536 privateKey = ctx->privateKey;
75297537 altPrivateKey = ctx->altPrivateKey;
@@ -8866,47 +8874,69 @@ int wolfSSL_check_private_key(const WOLFSSL* ssl)
88668874{
88678875 int res = WOLFSSL_SUCCESS;
88688876
8877+ #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8878+ DerBuffer *privateKey;
8879+ #ifdef WOLFSSL_DUAL_ALG_CERTS
8880+ DerBuffer *altPrivateKey;
8881+ #endif
8882+ #else
8883+ const DerBuffer *privateKey;
8884+ #ifdef WOLFSSL_DUAL_ALG_CERTS
8885+ const DerBuffer *altPrivateKey;
8886+ #endif
8887+ #endif
8888+
88698889 if (ssl == NULL) {
88708890 return WOLFSSL_FAILURE;
88718891 }
88728892#ifdef WOLFSSL_DUAL_ALG_CERTS
88738893#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8874- wolfssl_priv_der_unblind(ssl->buffers.key, ssl->buffers.keyMask);
8875- wolfssl_priv_der_unblind(ssl->buffers.altKey, ssl->buffers.altKeyMask);
8876- #endif
8877- res = check_cert_key(ssl->buffers.certificate, ssl->buffers.key,
8878- ssl->buffers.altKey, ssl->heap, ssl->buffers.keyDevId,
8879- ssl->buffers.keyLabel, ssl->buffers.keyId, ssl->buffers.altKeyDevId,
8880- ssl->buffers.altKeyLabel, ssl->buffers.altKeyId);
8881- #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8882- if (res == WOLFSSL_SUCCESS) {
8883- int ret;
8884- ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.key,
8885- (DerBuffer**)&ssl->buffers.keyMask);
8886- if (ret == 0) {
8887- ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.altKey,
8888- (DerBuffer**)&ssl->buffers.altKeyMask);
8889- }
8890- if (ret != 0) {
8894+ privateKey = wolfssl_priv_der_unblind(ssl->buffers.key,
8895+ ssl->buffers.keyMask);
8896+ if (privateKey == NULL) {
8897+ res = WOLFSSL_FAILURE;
8898+ }
8899+ if (ssl->buffers.altKey != NULL) {
8900+ altPrivateKey = wolfssl_priv_der_unblind(ssl->buffers.altKey,
8901+ ssl->buffers.altKeyMask);
8902+ if (altPrivateKey == NULL) {
88918903 res = WOLFSSL_FAILURE;
88928904 }
88938905 }
8894- #endif
8906+ else {
8907+ altPrivateKey = NULL;
8908+ }
88958909#else
8910+ privateKey = ssl->buffers.key;
8911+ altPrivateKey = ssl->buffers.altKey;
8912+ #endif
8913+ if (res == WOLFSSL_SUCCESS) {
8914+ res = check_cert_key(ssl->buffers.certificate, privateKey,
8915+ altPrivateKey, ssl->heap, ssl->buffers.keyDevId,
8916+ ssl->buffers.keyLabel, ssl->buffers.keyId, ssl->buffers.altKeyDevId,
8917+ ssl->buffers.altKeyLabel, ssl->buffers.altKeyId);
8918+ }
88968919#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8897- wolfssl_priv_der_blind_toggle(ssl->buffers.key, ssl->buffers.keyMask);
8920+ wolfssl_priv_der_unblind_free(privateKey);
8921+ wolfssl_priv_der_unblind_free(altPrivateKey);
88988922#endif
8899- res = check_cert_key(ssl->buffers.certificate, ssl->buffers.key, NULL,
8900- ssl->heap, ssl->buffers.keyDevId, ssl->buffers.keyLabel,
8901- ssl->buffers.keyId, INVALID_DEVID, 0, 0);
8923+ #else
89028924#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8925+ privateKey = wolfssl_priv_der_unblind(ssl->buffers.key,
8926+ ssl->buffers.keyMask);
8927+ if (privateKey == NULL) {
8928+ res = WOLFSSL_FAILURE;
8929+ }
8930+ #else
8931+ privateKey = ssl->buffers.key;
8932+ #endif
89038933 if (res == WOLFSSL_SUCCESS) {
8904- int ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.key,
8905- (DerBuffer**)&ssl->buffers.keyMask);
8906- if (ret != 0) {
8907- res = WOLFSSL_FAILURE;
8908- }
8934+ res = check_cert_key(ssl->buffers.certificate, privateKey, NULL,
8935+ ssl->heap, ssl->buffers.keyDevId, ssl->buffers.keyLabel,
8936+ ssl->buffers.keyId, INVALID_DEVID, 0, 0);
89098937 }
8938+ #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8939+ wolfssl_priv_der_unblind_free(privateKey);
89108940#endif
89118941#endif
89128942
@@ -20988,14 +21018,15 @@ WOLFSSL_CTX* wolfSSL_set_SSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
2098821018 ssl->buffers.altKey = ctx->altPrivateKey;
2098921019#else
2099021020 if (ctx->altPrivateKey != NULL) {
20991- ret = AllocCopyDer(&ssl->buffers.altkey , ctx->altPrivateKey->buffer,
21021+ ret = AllocCopyDer(&ssl->buffers.altKey , ctx->altPrivateKey->buffer,
2099221022 ctx->altPrivateKey->length, ctx->altPrivateKey->type,
2099321023 ctx->altPrivateKey->heap);
2099421024 if (ret != 0) {
2099521025 return NULL;
2099621026 }
2099721027 /* Blind the private key for the SSL with new random mask. */
20998- wolfssl_priv_der_unblind(ssl->buffers.altKey, ctx->altPrivateKeyMask);
21028+ wolfssl_priv_der_blind_toggle(ssl->buffers.altKey,
21029+ ctx->altPrivateKeyMask);
2099921030 ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.altKey,
2100021031 &ssl->buffers.altKeyMask);
2100121032 if (ret != 0) {
0 commit comments