Bug 2080581

More direct link to check of algorithm: https://gitlab.isc.org/isc-projects/bind9/-/blob/mnowak/fix-fips-in-tests/lib/dns/opensslrsa_link.c#L1637

A new propsal exists on openssl, which would allow even specification of separate verification and generation of signatures.

https://github.com/openssl/openssl/issues/18867 provides some sort of check. If we are able to fetch the EVP_MD object and EVP_PKEY_CTX_set_signature_md fails, it's the case. 

Petr, is this solution sufficient for your purposes?

My projects mostly depends on signature verification, signature creation is more rare case. And neither bind or unbound calls ever EVP_PKEY_CTX_set_signature_md directly in their code. So it does not help much. What I were looking for is kind of boolean check done before creating context for signature and key operations. Mentioned call requires loaded and prepared key, which is often not yet available in code I tried to simplify.

So no, I don't think such call would work for me. I would like to check algorithm availability before I have a key for OpenSSL prepared.

It seems development version of BIND9 uses EVP_PKEY_CTX only for key generation:
https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.19.13/lib/dns/opensslrsa_link.c?ref_type=tags#L349

$ grep -r EVP_PKEY_CTX_set_ lib
lib/dns/opensslrsa_link.c:	if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, (int)key_size) != 1) {
lib/dns/opensslrsa_link.c:		EVP_PKEY_CTX_set_app_data(ctx, (void *)callback);
lib/dns/opensslrsa_link.c:		EVP_PKEY_CTX_set_cb(ctx, progress_cb);
lib/dns/opensslecdsa_link.c:	status = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, group_nid);
lib/dns/opensslecdsa_link.c:		DST_RET(dst__openssl_toresult2("EVP_PKEY_CTX_set_ec_paramgen_"
lib/isc/tls.c:		rv = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pkey_ctx,


I just assume you propose here to call EVP_PKEY_verify_init() variant, followed by set_signature_md. Something like:

/* omitted proper return value checks for ease of reading */
int accept_sha1_sigs() {
  int ok;
  EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
  EVP_PKEY_verify_init(ctx);
  ok = (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha1());
  EVP_PKEY_CTX_free(ctx);
  return ok;
}

ISC (upstream) made check using EVP_VerifyFinal:
https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.19.13/lib/dns/opensslrsa_link.c?ref_type=tags#L1169

But the disadvantage here is they have to try the actual signature verification which nobody needed in fact. Wasting CPU cycles on the startup, including key data nobody needed etc.

Should above check work already on all our RHEL9 openssl versions already?

I double-checked the code. Until you at least set the key, this check will not fail. If you set the key, it should check whether sha1 is allowed.

Could it be fixed then? Every DNSSEC validating solution needs to decide whether it is required to fetch key data. When it is trying to decide whether it should do it, it has at hand only algorithm number. While BIND9 has made some workarounds, I do not think this approach should be considered the best solution avaliable.

I should not have to provide fake built-in key just to check the system policy will block its use. If it is refused not because of key size, but because algorithm used, then it is not related to the key itself. It should not require key to check it.

I do not want to add built-in checking of fake keys into unbound or dnsmasq startup, just to work around inability to query system policy allowed algorithms. There has to be more correct method.

If you have an RSA key, what's the problem with this check? If you don't, are you affected?