strongswan.git
23 months agoswanctl: Properly register --counters commmand
Tobias Brunner [Mon, 13 Nov 2017 08:45:14 +0000 (09:45 +0100)]
swanctl: Properly register --counters commmand

Use C instead of c, which is already used for --load-conns.

23 months agotesting: Do not remove all swanctl subdirectories
Andreas Steffen [Sat, 11 Nov 2017 18:23:01 +0000 (19:23 +0100)]
testing: Do not remove all swanctl subdirectories

23 months agoVersion bump to 5.6.1rc1 5.6.1rc1
Andreas Steffen [Sat, 11 Nov 2017 17:25:17 +0000 (18:25 +0100)]
Version bump to 5.6.1rc1

23 months agoMerge branch 'swanctl-testing'
Andreas Steffen [Sat, 11 Nov 2017 15:42:38 +0000 (16:42 +0100)]
Merge branch 'swanctl-testing'

23 months agolibimcv: Updated imv database
Andreas Steffen [Sat, 11 Nov 2017 15:39:30 +0000 (16:39 +0100)]
libimcv: Updated imv database

23 months agotesting: Converterd tnc to systemd
Andreas Steffen [Sat, 11 Nov 2017 15:36:43 +0000 (16:36 +0100)]
testing: Converterd tnc to systemd

23 months agotesting: Converted sql to systemd
Andreas Steffen [Sat, 11 Nov 2017 06:18:51 +0000 (07:18 +0100)]
testing: Converted sql to systemd

23 months agotesting: Converted swanctl to systemd
Andreas Steffen [Fri, 10 Nov 2017 16:21:40 +0000 (17:21 +0100)]
testing: Converted swanctl to systemd

23 months agotesting: Added legacy ipv6-stroke scenarios
Andreas Steffen [Sun, 29 Oct 2017 19:39:10 +0000 (20:39 +0100)]
testing: Added legacy ipv6-stroke scenarios

23 months agotesting: Converted ipv6/rw-ip6-in-ip4-ikev2 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 12:50:24 +0000 (13:50 +0100)]
testing: Converted ipv6/rw-ip6-in-ip4-ikev2 to swanctl

23 months agotesting: Converted ipv6/rw-ip6-in-ip4-ikev1 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 12:42:29 +0000 (13:42 +0100)]
testing: Converted ipv6/rw-ip6-in-ip4-ikev1 to swanctl

23 months agotesting: Converted ipv6/net2net-ip6-in-ip4-ikev2 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 11:39:36 +0000 (12:39 +0100)]
testing: Converted ipv6/net2net-ip6-in-ip4-ikev2 to swanctl

23 months agotesting: Converted ipv6/net2net-ip6-in-ip4-ikev1 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 11:28:24 +0000 (12:28 +0100)]
testing: Converted ipv6/net2net-ip6-in-ip4-ikev1 to swanctl

23 months agotesting: Converted ipv6/rw-rfc3779-ikev2 to swanctl
Andreas Steffen [Fri, 10 Nov 2017 10:28:28 +0000 (11:28 +0100)]
testing: Converted ipv6/rw-rfc3779-ikev2 to swanctl

23 months agotesting: Converted ipv6/rw-compress-ikev2 to swanctl
Andreas Steffen [Thu, 9 Nov 2017 16:49:03 +0000 (17:49 +0100)]
testing: Converted ipv6/rw-compress-ikev2 to swanctl

23 months agotesting: Converted ipv6/rw-psk-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 19:23:03 +0000 (20:23 +0100)]
testing: Converted ipv6/rw-psk-ikev2 to swanctl

23 months agotesting: Converted ipv6/rw-psk-ikev1 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 18:53:45 +0000 (19:53 +0100)]
testing: Converted ipv6/rw-psk-ikev1 to swanctl

23 months agotesting: Converted ipv6/rw-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 15:52:51 +0000 (16:52 +0100)]
testing: Converted ipv6/rw-ikev2 to swanctl

23 months agotesting: Converted ipv6/rw-ikev1 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 15:48:19 +0000 (16:48 +0100)]
testing: Converted ipv6/rw-ikev1 to swanctl

23 months agotesting: Converted ipv6/net2net-rfc3779-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 14:38:45 +0000 (15:38 +0100)]
testing: Converted ipv6/net2net-rfc3779-ikev2 to swanctl

23 months agotesting: Converted ipv6/net2net-ip4-in-ip6-ikev2 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 11:17:29 +0000 (12:17 +0100)]
testing: Converted ipv6/net2net-ip4-in-ip6-ikev2 to swanctl

23 months agotesting: Converted ipv6/net2net-ip4-in-ip6-ikev1 to swanctl
Andreas Steffen [Sun, 29 Oct 2017 10:29:09 +0000 (11:29 +0100)]
testing: Converted ipv6/net2net-ip4-in-ip6-ikev1 to swanctl

23 months agotesting: Converted ipv6/transport-ikev2 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 19:27:37 +0000 (21:27 +0200)]
testing: Converted ipv6/transport-ikev2 to swanctl

23 months agotesting: Converted ipv6/transport-ikev1 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 19:20:01 +0000 (21:20 +0200)]
testing: Converted ipv6/transport-ikev1 to swanctl

23 months agotesting: Converted ipv6/net2net-ikev2 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 19:03:53 +0000 (21:03 +0200)]
testing: Converted ipv6/net2net-ikev2 to swanctl

23 months agotesting: Converted ipv6/net2net-ikev1 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 18:46:00 +0000 (20:46 +0200)]
testing: Converted ipv6/net2net-ikev1 to swanctl

23 months agotesting: Converted ipv6/host2host-ikev2 to swanctl
Andreas Steffen [Thu, 19 Oct 2017 15:46:39 +0000 (17:46 +0200)]
testing: Converted ipv6/host2host-ikev2 to swanctl

23 months agotesting: Converted ipv6/host2host-ikev1 to swanctl
Andreas Steffen [Tue, 17 Oct 2017 09:44:17 +0000 (11:44 +0200)]
testing: Converted ipv6/host2host-ikev1 to swanctl

23 months agotesting: Removed libipsec/rw-suite-b
Andreas Steffen [Tue, 10 Oct 2017 19:14:50 +0000 (21:14 +0200)]
testing: Removed libipsec/rw-suite-b

23 months agotesting: Converted libipsec/net2net-null to swanctl
Andreas Steffen [Tue, 10 Oct 2017 18:51:27 +0000 (20:51 +0200)]
testing: Converted libipsec/net2net-null to swanctl

23 months agotesting: Converted libipsec/net2net-cert-ipv6 to swanctl
Andreas Steffen [Sun, 8 Oct 2017 17:16:55 +0000 (19:16 +0200)]
testing: Converted libipsec/net2net-cert-ipv6 to swanctl

23 months agotesting: Converted libipsec/net2net-cert to swanctl
Andreas Steffen [Thu, 5 Oct 2017 07:35:59 +0000 (09:35 +0200)]
testing: Converted libipsec/net2net-cert to swanctl

23 months agotesting: Converted libipsec/net2net-3des to swanctl
Andreas Steffen [Thu, 5 Oct 2017 12:05:15 +0000 (14:05 +0200)]
testing: Converted libipsec/net2net-3des to swanctl

23 months agotesting: Converted libipsec/host2host-cert to swanctl
Andreas Steffen [Wed, 4 Oct 2017 18:34:51 +0000 (20:34 +0200)]
testing: Converted libipsec/host2host-cert to swanctl

23 months agotesting: Converted gcrypt-ikev2 to swanctl
Andreas Steffen [Fri, 1 Sep 2017 19:10:00 +0000 (21:10 +0200)]
testing: Converted gcrypt-ikev2 to swanctl

23 months agotesting: Converted gcrypt-ikev1 to systemd
Andreas Steffen [Thu, 19 Oct 2017 14:36:46 +0000 (16:36 +0200)]
testing: Converted gcrypt-ikev1 to systemd

23 months agotesting: Converted af-alg to systemd
Andreas Steffen [Wed, 18 Oct 2017 09:45:14 +0000 (11:45 +0200)]
testing: Converted af-alg to systemd

23 months agotesting: Enable systemd
Andreas Steffen [Tue, 17 Oct 2017 09:52:08 +0000 (11:52 +0200)]
testing: Enable systemd

23 months agotesting: Updated some descriptions
Andreas Steffen [Fri, 1 Sep 2017 16:14:04 +0000 (18:14 +0200)]
testing: Updated some descriptions

23 months agolibtpmtss: Added missing argument in hasher_from_signature_scheme()
Andreas Steffen [Fri, 10 Nov 2017 10:47:27 +0000 (11:47 +0100)]
libtpmtss: Added missing argument in hasher_from_signature_scheme()

23 months agocharon-tkm: Unlink PID file after deinit
Tobias Brunner [Tue, 7 Nov 2017 09:44:22 +0000 (10:44 +0100)]
charon-tkm: Unlink PID file after deinit

Same change as for charon in the previous commit.

References #2460.

23 months agocharon: Unlink PID file after daemon deinit (i.e. after unloading plugins etc.)
Tobias Brunner [Tue, 7 Nov 2017 09:30:05 +0000 (10:30 +0100)]
charon: Unlink PID file after daemon deinit (i.e. after unloading plugins etc.)

Make sure, though, that we only remove the file if we actually
created it (e.g. not for --help or --version).  And do so before
deinitializing libstrongswan due to leak detective.

Fixes #2460.

23 months agounit-tests: Rename targets for libstrongswan and kernel-netlink
Thomas Egerer [Wed, 8 Nov 2017 17:16:52 +0000 (18:16 +0100)]
unit-tests: Rename targets for libstrongswan and kernel-netlink

libstrongswan and kernel-netlink are the only two components which do
not adhere to the naming scheme used for all other tests. If the tests
are run by an external application this imposes problems due to clashing
names.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
23 months agoMerge branch 'rsassa-pss'
Tobias Brunner [Wed, 8 Nov 2017 15:48:37 +0000 (16:48 +0100)]
Merge branch 'rsassa-pss'

This adds support for RSASSA-PSS signatures in IKEv2 digital signature
authentication (RFC 7427), certificates and CRLs etc., and when signing
credentials via pki tool.  For interoperability with older versions, the
default is to use classic PKCS#1 signatures.  To use PSS padding either enable
rsa_pss via strongswan.conf or explicitly use it either via ike:rsa/pss...
auth token or the --rsa-padding option of the pki tool.

References #2427.

23 months agoauth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf
Tobias Brunner [Tue, 31 Oct 2017 13:20:28 +0000 (14:20 +0100)]
auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf

Also document the rsa/pss prefix.

23 months agopki: Enable PSS padding if enabled in strongswan.conf
Tobias Brunner [Mon, 30 Oct 2017 16:54:44 +0000 (17:54 +0100)]
pki: Enable PSS padding if enabled in strongswan.conf

23 months agopki: Optionally generate RSA/PSS signatures
Tobias Brunner [Mon, 30 Oct 2017 14:10:46 +0000 (15:10 +0100)]
pki: Optionally generate RSA/PSS signatures

23 months agopki: Indent usage lines properly automatically
Tobias Brunner [Mon, 30 Oct 2017 13:55:44 +0000 (14:55 +0100)]
pki: Indent usage lines properly automatically

23 months agoTreat RSASSA-PSS keys like rsaEncryption RSA keys
Tobias Brunner [Fri, 27 Oct 2017 13:09:46 +0000 (15:09 +0200)]
Treat RSASSA-PSS keys like rsaEncryption RSA keys

In theory we should treat any parameters and the identifier itself as
restriction to only use the key to create signatures accordingly (e.g.
only use RSA with PSS padding or even use specific hash algorithms).
But that's currently tricky as we'd have to store and pass this information
along with our private keys (i.e. use PKCS#8 to store them and change the
builder calls to pass along the identifier and parameters). That would
require quite some work.

23 months agoopenssl: Add support for signature schemes with parameters
Tobias Brunner [Fri, 27 Oct 2017 12:29:50 +0000 (14:29 +0200)]
openssl: Add support for signature schemes with parameters

23 months agopki: Properly forward digest to attribute certificate builder
Tobias Brunner [Fri, 27 Oct 2017 11:49:29 +0000 (13:49 +0200)]
pki: Properly forward digest to attribute certificate builder

23 months agox509: Add support for signature schemes with parameters
Tobias Brunner [Fri, 27 Oct 2017 09:18:35 +0000 (11:18 +0200)]
x509: Add support for signature schemes with parameters

Also adds support for specifying the hash algorithm for attribute
certificate signatures.

23 months agobuilder: Add builder option to pass signature scheme and params
Tobias Brunner [Fri, 27 Oct 2017 09:06:14 +0000 (11:06 +0200)]
builder: Add builder option to pass signature scheme and params

23 months agoikev2: Use helpers to build signature auth data
Tobias Brunner [Tue, 24 Oct 2017 11:49:14 +0000 (13:49 +0200)]
ikev2: Use helpers to build signature auth data

23 months agosignature-params: Add helpers to parse/build ASN.1 algorithmIdentifier for signature...
Tobias Brunner [Tue, 24 Oct 2017 11:45:31 +0000 (13:45 +0200)]
signature-params: Add helpers to parse/build ASN.1 algorithmIdentifier for signature schemes

23 months agoikev2: Enumerate RSA/PSS schemes and use them if enabled
Tobias Brunner [Mon, 16 Oct 2017 16:09:38 +0000 (18:09 +0200)]
ikev2: Enumerate RSA/PSS schemes and use them if enabled

23 months agoikev2: Support signing with RSASSA-PSS via RFC 7427 signature auth
Tobias Brunner [Mon, 2 Oct 2017 14:21:13 +0000 (16:21 +0200)]
ikev2: Support signing with RSASSA-PSS via RFC 7427 signature auth

23 months agosignature-params: Use helper to build MGF1 algorithmIdentifier
Tobias Brunner [Mon, 2 Oct 2017 14:10:40 +0000 (16:10 +0200)]
signature-params: Use helper to build MGF1 algorithmIdentifier

23 months agoasn1: Add helper function to create algorithmIdentifier with parameters
Tobias Brunner [Mon, 2 Oct 2017 14:08:46 +0000 (16:08 +0200)]
asn1: Add helper function to create algorithmIdentifier with parameters

23 months agoikev2: Verify RSASSA-PSS signatures via RFC 7427 signature auth
Tobias Brunner [Mon, 2 Oct 2017 13:57:17 +0000 (15:57 +0200)]
ikev2: Verify RSASSA-PSS signatures via RFC 7427 signature auth

23 months agokeymat_v2: Pass/receive signature schemes as signature_param_t objects
Tobias Brunner [Mon, 16 Oct 2017 14:41:55 +0000 (16:41 +0200)]
keymat_v2: Pass/receive signature schemes as signature_param_t objects

23 months agoauth-cfg: Parse rsa/pss auth tokens
Tobias Brunner [Fri, 13 Oct 2017 13:32:29 +0000 (15:32 +0200)]
auth-cfg: Parse rsa/pss auth tokens

23 months agoauth-cfg: Store signature schemes as signature_params_t objects
Tobias Brunner [Fri, 13 Oct 2017 13:02:02 +0000 (15:02 +0200)]
auth-cfg: Store signature schemes as signature_params_t objects

Due to circular references the hasher_from_signature_scheme() helper
does not take a signature_params_t object.

23 months agocertificate: Return signature scheme and parameters from issued_by() method
Tobias Brunner [Fri, 13 Oct 2017 12:33:43 +0000 (14:33 +0200)]
certificate: Return signature scheme and parameters from issued_by() method

This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.

23 months agosignature-params: Add helper struct for signature scheme and parameters
Tobias Brunner [Tue, 10 Oct 2017 13:52:19 +0000 (15:52 +0200)]
signature-params: Add helper struct for signature scheme and parameters

23 months agoandroid: Add support for creating RSASSA-PSS signatures via JNI
Tobias Brunner [Tue, 26 Sep 2017 16:35:59 +0000 (18:35 +0200)]
android: Add support for creating RSASSA-PSS signatures via JNI

23 months agounit-tests: Add RSA-PSS signature tests with specific salts
Tobias Brunner [Tue, 26 Sep 2017 14:46:42 +0000 (16:46 +0200)]
unit-tests: Add RSA-PSS signature tests with specific salts

23 months agogcrypt: Add support for static salts when signing with RSA-PSS
Tobias Brunner [Tue, 26 Sep 2017 14:44:44 +0000 (16:44 +0200)]
gcrypt: Add support for static salts when signing with RSA-PSS

23 months agogmp: Add support for static salts when signing with RSA-PSS
Tobias Brunner [Tue, 26 Sep 2017 14:44:02 +0000 (16:44 +0200)]
gmp: Add support for static salts when signing with RSA-PSS

23 months agosignature-params: Optionally pass a specific salt value when signing
Tobias Brunner [Tue, 26 Sep 2017 13:02:04 +0000 (15:02 +0200)]
signature-params: Optionally pass a specific salt value when signing

23 months agounit-tests: Warn if we skip RSA tests due to dependencies
Tobias Brunner [Tue, 26 Sep 2017 12:57:40 +0000 (14:57 +0200)]
unit-tests: Warn if we skip RSA tests due to dependencies

23 months agounit-tests: Add ability to issue a warning message for a test case
Tobias Brunner [Tue, 26 Sep 2017 12:55:14 +0000 (14:55 +0200)]
unit-tests: Add ability to issue a warning message for a test case

This way we can warn if we e.g. skipped actually doing something due to
dependencies (otherwise the test case would just appear to have succeeded).

23 months agomgf1: Add support for SHA-224/384 based MGF1
Tobias Brunner [Mon, 25 Sep 2017 16:17:54 +0000 (18:17 +0200)]
mgf1: Add support for SHA-224/384 based MGF1

23 months agoxof: Add identifiers for MGF1 XOFs based on SHA-224/384
Tobias Brunner [Mon, 25 Sep 2017 16:15:35 +0000 (18:15 +0200)]
xof: Add identifiers for MGF1 XOFs based on SHA-224/384

23 months agogmp: Use helper to determine XOF type
Tobias Brunner [Mon, 25 Sep 2017 16:07:58 +0000 (18:07 +0200)]
gmp: Use helper to determine XOF type

23 months agoxof: Add helper to determine MGF1 XOF type from hash algorithm
Tobias Brunner [Mon, 25 Sep 2017 16:06:40 +0000 (18:06 +0200)]
xof: Add helper to determine MGF1 XOF type from hash algorithm

23 months agogcrypt: Add support for RSA-PSS signatures
Tobias Brunner [Mon, 25 Sep 2017 12:50:20 +0000 (14:50 +0200)]
gcrypt: Add support for RSA-PSS signatures

For salt lengths other than 20 this requires 0bd8137e68c2 ("cipher:
Add option to specify salt length for PSS verification."), which was
included in libgcrypt 1.7.0 (for Ubuntu requires 17.04).  As that makes
it pretty much useless for us (SHA-1 is a MUST NOT), we require that version
to even provide the feature.

23 months agogcrypt: Register supported RSA signature/verification schemes
Tobias Brunner [Mon, 25 Sep 2017 12:30:45 +0000 (14:30 +0200)]
gcrypt: Register supported RSA signature/verification schemes

23 months agoconfigure: Enable mgf1 plugin if gmp plugin is enabled
Tobias Brunner [Sat, 23 Sep 2017 14:32:03 +0000 (16:32 +0200)]
configure: Enable mgf1 plugin if gmp plugin is enabled

23 months agogmp: Add support for RSASSA-PSS signature verification
Tobias Brunner [Sat, 23 Sep 2017 14:25:20 +0000 (16:25 +0200)]
gmp: Add support for RSASSA-PSS signature verification

23 months agogmp: Add support for RSASSA-PSS signature creation
Tobias Brunner [Sat, 23 Sep 2017 13:33:11 +0000 (15:33 +0200)]
gmp: Add support for RSASSA-PSS signature creation

23 months agounit-tests: Add FIPS 186-4 RSASSA-PSS test vectors
Tobias Brunner [Sat, 23 Sep 2017 11:36:32 +0000 (13:36 +0200)]
unit-tests: Add FIPS 186-4 RSASSA-PSS test vectors

Since not all implementations allow setting a specific salt value when
generating signatures (e.g. OpenSSL doesn't), we are often limited to
only using the test vectors with salt length of 0.

We also exclude test vectors with SHA-1, SHA-224 and SHA-384.

23 months agounit-tests: Create and verify some RSA PSS signatures
Tobias Brunner [Sat, 23 Sep 2017 08:49:09 +0000 (10:49 +0200)]
unit-tests: Create and verify some RSA PSS signatures

23 months agoopenssl: Add support for verifying RSASSA-PSS signatures
Tobias Brunner [Sat, 23 Sep 2017 08:39:14 +0000 (10:39 +0200)]
openssl: Add support for verifying RSASSA-PSS signatures

23 months agoopenssl: Add support for creating RSASSA-PSS signatures
Tobias Brunner [Sat, 23 Sep 2017 08:01:57 +0000 (10:01 +0200)]
openssl: Add support for creating RSASSA-PSS signatures

23 months agoopenssl: Add helper to determine EVP_MD from hash_algorithm_t
Tobias Brunner [Sat, 23 Sep 2017 08:12:36 +0000 (10:12 +0200)]
openssl: Add helper to determine EVP_MD from hash_algorithm_t

23 months agounit-tests: Add FIPS 186-4 RSA test vectors
Tobias Brunner [Fri, 22 Sep 2017 17:37:54 +0000 (19:37 +0200)]
unit-tests: Add FIPS 186-4 RSA test vectors

Excluding SHA-224 and the stuff from FIPS 186-2 (SHA-1, 1024 bit keys).

23 months agogcrypt: Determine missing RSA private key parameters
Tobias Brunner [Fri, 22 Sep 2017 17:10:39 +0000 (19:10 +0200)]
gcrypt: Determine missing RSA private key parameters

We only need n, e, and d.  The primes p and q and the coefficient
for the Chinese remainder algorithm can be determined from these.

23 months agogmp: Determine missing RSA private key parameters
Tobias Brunner [Fri, 22 Sep 2017 15:49:00 +0000 (17:49 +0200)]
gmp: Determine missing RSA private key parameters

We only need n, e, and d.  The parameters for the Chinese remainder
algorithm and even p and q can be determined from these.

23 months agoopenssl: Add functions to determine missing RSA private key parameters
Tobias Brunner [Fri, 22 Sep 2017 13:47:11 +0000 (15:47 +0200)]
openssl: Add functions to determine missing RSA private key parameters

We only need n, e, and d.  The parameters for the Chinese remainder
algorithm and even p and q can be determined from these.

23 months agosignature-params: Add functions to parse/build ASN.1 RSASSA-PSS params
Tobias Brunner [Wed, 20 Sep 2017 13:21:51 +0000 (15:21 +0200)]
signature-params: Add functions to parse/build ASN.1 RSASSA-PSS params

23 months agohasher: Add function to determine length of hashes
Tobias Brunner [Fri, 22 Sep 2017 07:46:14 +0000 (09:46 +0200)]
hasher: Add function to determine length of hashes

23 months agoasn1: Add function to generate an ASN.1 integer from an uint64_t
Tobias Brunner [Wed, 20 Sep 2017 13:00:42 +0000 (15:00 +0200)]
asn1: Add function to generate an ASN.1 integer from an uint64_t

23 months agoasn1: Add OID for MGF1
Tobias Brunner [Tue, 19 Sep 2017 16:45:49 +0000 (18:45 +0200)]
asn1: Add OID for MGF1

23 months agosignature-params: Add struct for RSASSA-PSS parameters
Tobias Brunner [Tue, 19 Sep 2017 16:21:37 +0000 (18:21 +0200)]
signature-params: Add struct for RSASSA-PSS parameters

23 months agoprivate-key: Add optional parameters argument to sign() method
Tobias Brunner [Tue, 19 Sep 2017 15:26:58 +0000 (17:26 +0200)]
private-key: Add optional parameters argument to sign() method

23 months agopublic-key: Add optional parameters argument to verify() method
Tobias Brunner [Tue, 19 Sep 2017 15:15:18 +0000 (17:15 +0200)]
public-key: Add optional parameters argument to verify() method

23 months agopublic-key: Add RSASSA-PSS signature scheme identifier
Tobias Brunner [Tue, 19 Sep 2017 11:40:48 +0000 (13:40 +0200)]
public-key: Add RSASSA-PSS signature scheme identifier

23 months agoasn1: Add OID for RSASSA-PSS
Tobias Brunner [Tue, 19 Sep 2017 10:10:36 +0000 (12:10 +0200)]
asn1: Add OID for RSASSA-PSS

23 months agoikev2: Don't use SHA-1 for RFC 7427 signature authentication
Tobias Brunner [Tue, 19 Sep 2017 09:10:09 +0000 (11:10 +0200)]
ikev2: Don't use SHA-1 for RFC 7427 signature authentication

RFC 8247 demoted it to MUST NOT.

References #2427.