@@ -7524,11 +7524,19 @@ int wolfSSL_CTX_check_private_key(const WOLFSSL_CTX* ctx)
75247524#ifdef WOLFSSL_DUAL_ALG_CERTS
75257525#ifdef WOLFSSL_BLIND_PRIVATE_KEY
75267526 privateKey = wolfssl_priv_der_unblind(ctx->privateKey, ctx->privateKeyMask);
7527- altPrivateKey = wolfssl_priv_der_unblind(ctx->altPrivateKey,
7528- ctx->altPrivateKeyMask);
7529- if ((privateKey == NULL) || (altPrivateKey == NULL)) {
7527+ if (privateKey == NULL) {
75307528 res = WOLFSSL_FAILURE;
75317529 }
7530+ if (ctx->altPrivateKey != NULL) {
7531+ altPrivateKey = wolfssl_priv_der_unblind(ctx->altPrivateKey,
7532+ ctx->altPrivateKeyMask);
7533+ if (altPrivateKey == NULL) {
7534+ res = WOLFSSL_FAILURE;
7535+ }
7536+ }
7537+ else {
7538+ altPrivateKey = NULL;
7539+ }
75327540#else
75337541 privateKey = ctx->privateKey;
75347542 altPrivateKey = ctx->altPrivateKey;
@@ -8871,47 +8879,69 @@ int wolfSSL_check_private_key(const WOLFSSL* ssl)
88718879{
88728880 int res = WOLFSSL_SUCCESS;
88738881
8882+ #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8883+ DerBuffer *privateKey;
8884+ #ifdef WOLFSSL_DUAL_ALG_CERTS
8885+ DerBuffer *altPrivateKey;
8886+ #endif
8887+ #else
8888+ const DerBuffer *privateKey;
8889+ #ifdef WOLFSSL_DUAL_ALG_CERTS
8890+ const DerBuffer *altPrivateKey;
8891+ #endif
8892+ #endif
8893+
88748894 if (ssl == NULL) {
88758895 return WOLFSSL_FAILURE;
88768896 }
88778897#ifdef WOLFSSL_DUAL_ALG_CERTS
88788898#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8879- wolfssl_priv_der_unblind(ssl->buffers.key, ssl->buffers.keyMask);
8880- wolfssl_priv_der_unblind(ssl->buffers.altKey, ssl->buffers.altKeyMask);
8881- #endif
8882- res = check_cert_key(ssl->buffers.certificate, ssl->buffers.key,
8883- ssl->buffers.altKey, ssl->heap, ssl->buffers.keyDevId,
8884- ssl->buffers.keyLabel, ssl->buffers.keyId, ssl->buffers.altKeyDevId,
8885- ssl->buffers.altKeyLabel, ssl->buffers.altKeyId);
8886- #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8887- if (res == WOLFSSL_SUCCESS) {
8888- int ret;
8889- ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.key,
8890- (DerBuffer**)&ssl->buffers.keyMask);
8891- if (ret == 0) {
8892- ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.altKey,
8893- (DerBuffer**)&ssl->buffers.altKeyMask);
8894- }
8895- if (ret != 0) {
8899+ privateKey = wolfssl_priv_der_unblind(ssl->buffers.key,
8900+ ssl->buffers.keyMask);
8901+ if (privateKey == NULL) {
8902+ res = WOLFSSL_FAILURE;
8903+ }
8904+ if (ssl->buffers.altKey != NULL) {
8905+ altPrivateKey = wolfssl_priv_der_unblind(ssl->buffers.altKey,
8906+ ssl->buffers.altKeyMask);
8907+ if (altPrivateKey == NULL) {
88968908 res = WOLFSSL_FAILURE;
88978909 }
88988910 }
8899- #endif
8911+ else {
8912+ altPrivateKey = NULL;
8913+ }
89008914#else
8915+ privateKey = ssl->buffers.key;
8916+ altPrivateKey = ssl->buffers.altKey;
8917+ #endif
8918+ if (res == WOLFSSL_SUCCESS) {
8919+ res = check_cert_key(ssl->buffers.certificate, privateKey,
8920+ altPrivateKey, ssl->heap, ssl->buffers.keyDevId,
8921+ ssl->buffers.keyLabel, ssl->buffers.keyId, ssl->buffers.altKeyDevId,
8922+ ssl->buffers.altKeyLabel, ssl->buffers.altKeyId);
8923+ }
89018924#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8902- wolfssl_priv_der_blind_toggle(ssl->buffers.key, ssl->buffers.keyMask);
8925+ wolfssl_priv_der_unblind_free(privateKey);
8926+ wolfssl_priv_der_unblind_free(altPrivateKey);
89038927#endif
8904- res = check_cert_key(ssl->buffers.certificate, ssl->buffers.key, NULL,
8905- ssl->heap, ssl->buffers.keyDevId, ssl->buffers.keyLabel,
8906- ssl->buffers.keyId, INVALID_DEVID, 0, 0);
8928+ #else
89078929#ifdef WOLFSSL_BLIND_PRIVATE_KEY
8930+ privateKey = wolfssl_priv_der_unblind(ssl->buffers.key,
8931+ ssl->buffers.keyMask);
8932+ if (privateKey == NULL) {
8933+ res = WOLFSSL_FAILURE;
8934+ }
8935+ #else
8936+ privateKey = ssl->buffers.key;
8937+ #endif
89088938 if (res == WOLFSSL_SUCCESS) {
8909- int ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.key,
8910- (DerBuffer**)&ssl->buffers.keyMask);
8911- if (ret != 0) {
8912- res = WOLFSSL_FAILURE;
8913- }
8939+ res = check_cert_key(ssl->buffers.certificate, privateKey, NULL,
8940+ ssl->heap, ssl->buffers.keyDevId, ssl->buffers.keyLabel,
8941+ ssl->buffers.keyId, INVALID_DEVID, 0, 0);
89148942 }
8943+ #ifdef WOLFSSL_BLIND_PRIVATE_KEY
8944+ wolfssl_priv_der_unblind_free(privateKey);
89158945#endif
89168946#endif
89178947
@@ -20993,14 +21023,15 @@ WOLFSSL_CTX* wolfSSL_set_SSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
2099321023 ssl->buffers.altKey = ctx->altPrivateKey;
2099421024#else
2099521025 if (ctx->altPrivateKey != NULL) {
20996- ret = AllocCopyDer(&ssl->buffers.altkey , ctx->altPrivateKey->buffer,
21026+ ret = AllocCopyDer(&ssl->buffers.altKey , ctx->altPrivateKey->buffer,
2099721027 ctx->altPrivateKey->length, ctx->altPrivateKey->type,
2099821028 ctx->altPrivateKey->heap);
2099921029 if (ret != 0) {
2100021030 return NULL;
2100121031 }
2100221032 /* Blind the private key for the SSL with new random mask. */
21003- wolfssl_priv_der_unblind(ssl->buffers.altKey, ctx->altPrivateKeyMask);
21033+ wolfssl_priv_der_blind_toggle(ssl->buffers.altKey,
21034+ ctx->altPrivateKeyMask);
2100421035 ret = wolfssl_priv_der_blind(ssl->rng, ssl->buffers.altKey,
2100521036 &ssl->buffers.altKeyMask);
2100621037 if (ret != 0) {
0 commit comments