starred/certbot-certbot-2
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-03 00:22:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use SHA256 openssl signatures

Browse Source
This commit is contained in:
Peter Eckersley
2016-01-11 14:22:51 -08:00
parent e17bb27508
commit be653e8e6b
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/half-sign.c
+6 -6
View File
@@ -12,18 +12,18 @@
// To compile: // To compile:
// gcc half-sign.c -lssl -lcrypto -o half-sign // gcc half-sign.c -lssl -lcrypto -o half-sign
// Sign with SHA1 // Sign with SHA256
#define HASH_SIZE 20 #define HASH_SIZE 32
void usage() { void usage() {
printf("half-sign <private key file> [binary hash file]\n"); printf("half-sign <private key file> [binary hash file]\n");
printf("\n"); printf("\n");
printf(" Computes and prints a binary RSA signature over data given the SHA1 hash of\n"); printf(" Computes and prints a binary RSA signature over data given the SHA256 hash of\n");
printf(" the data as input.\n"); printf(" the data as input.\n");
printf("\n"); printf("\n");
printf(" <private key file> should be PEM encoded.\n"); printf(" <private key file> should be PEM encoded.\n");
printf("\n"); printf("\n");
printf(" The input SHA1 hash should be %d bytes in length. If no binary hash file is\n", HASH_SIZE); printf(" The input SHA256 hash should be %d bytes in length. If no binary hash file is\n", HASH_SIZE);
printf(" specified, it will be read from stdin.\n"); printf(" specified, it will be read from stdin.\n");
exit(1); exit(1);
} }
@@ -41,7 +41,7 @@ void sign_hashed_data(EVP_PKEY *signing_key, unsigned char *md, size_t mdlen) {
if ((!ctx) if ((!ctx)
|| (EVP_PKEY_sign_init(ctx) <= 0) || (EVP_PKEY_sign_init(ctx) <= 0)
|| (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0) || (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
|| (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha1()) <= 0)) { || (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)) {
fprintf(stderr, "Failure establishing ctx for signature\n"); fprintf(stderr, "Failure establishing ctx for signature\n");
exit(1); exit(1);
} }
@@ -108,7 +108,7 @@ int main(int argc, char *argv[]) {
exit(1); exit(1);
} }
if (fread(buffer, HASH_SIZE, 1, input) != 1) { if (fread(buffer, HASH_SIZE, 1, input) != 1) {
perror("half-sign: Failed to read SHA1 from input\n"); perror("half-sign: Failed to read SHA256 from input\n");
exit(1); exit(1);
} }
tools/release.sh
+3 -3
View File
@@ -34,8 +34,8 @@ else
echo Releasing developer version "$version"... echo Releasing developer version "$version"...
fi fi
if [ "$RELEASE_OPENSSL_KEY" = "" ] ; then if [ "$RELEASE_OPENSSL_PUBKEY" = "" ] ; then
RELEASE_OPENSSL_KEY="`realpath \`dirname $0\``/eff-pubkey.pem" RELEASE_OPENSSL_PUBKEY="`realpath \`dirname $0\``/eff-pubkey.pem"
fi fi
RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2} RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
# Needed to fix problems with git signatures and pinentry # Needed to fix problems with git signatures and pinentry
@@ -85,7 +85,7 @@ git checkout "$RELEASE_BRANCH"
letsencrypt-auto-source/build.py letsencrypt-auto-source/build.py
# and that it's signed correctly # and that it's signed correctly
if ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_KEY -signature \ if ! openssl dgst -sha256 -verify $RELEASE_OPENSSL_PUBKEY -signature \
letsencrypt-auto-source/letsencrypt-auto.sig \ letsencrypt-auto-source/letsencrypt-auto.sig \
letsencrypt-auto-source/letsencrypt-auto ; then letsencrypt-auto-source/letsencrypt-auto ; then
echo Failed letsencrypt-auto signature check on "$RELEASE_BRANCH" echo Failed letsencrypt-auto signature check on "$RELEASE_BRANCH"