[krbdev.mit.edu #9095] git commit

[Greg Hudson via RT]

Mon Jul 17 01:46:39 2023: Request 9095 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9095 >



PKINIT ECDH support

Add support for elliptic curve key exchange to PKINIT (RFC 5349
section 4).  Extend pkinit_dh_min_bits to allow the string values
"P-256", "P-384", and "P-521", using rough finite-field strength
equivalents to rank them relative to the Oakley Diffie-Hellman groups.

When processing TD-DH-PARAMETERS on the client, only accept the three
Oakley groups or the three supported elliptic curve groups.
Previously we accepted any Diffie-Hellman parameters that passed
EVP_PKEY_param_check()/DH_check() and had equal or better bit strength
to the original proposal.

https://github.com/krb5/krb5/commit/0f870b1bcad960fd5319a3f97aafd7f4a289e2fb
Author: Greg Hudson <ghudson at mit.edu>
Commit: 0f870b1bcad960fd5319a3f97aafd7f4a289e2fb
Branch: master
 doc/admin/conf_files/kdc_conf.rst                  |   7 +-
 doc/admin/conf_files/krb5_conf.rst                 |   7 +-
 src/plugins/preauth/pkinit/pkinit.h                |   6 +-
 src/plugins/preauth/pkinit/pkinit_clnt.c           |  17 +-
 src/plugins/preauth/pkinit/pkinit_constants.c      |  27 ++
 src/plugins/preauth/pkinit/pkinit_crypto.h         |   7 +
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 470 ++++++++++++++-------
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.h |   4 +-
 src/plugins/preauth/pkinit/pkinit_lib.c            |   3 -
 src/plugins/preauth/pkinit/pkinit_srv.c            |  17 +-
 src/plugins/preauth/pkinit/pkinit_trace.h          |  11 +
 src/tests/t_pkinit.py                              |  12 +
 12 files changed, 405 insertions(+), 183 deletions(-)