determining of an EVP_PKEY can do a signature.

Michael Richardson <mcr-SWp7JaYWvAQV+D8aMU/[email protected]> Fri, 22 Aug 2025 17:07:29 -0400

Newsgroups	gmane.comp.encryption.openssl.user
Message-ID	<[email protected]>

Hi, the ruby-openssl code has a check:
  EVP_PKEY *
  GetPrivPKeyPtr(VALUE obj)

which is used in the .sign function.
It throws an exception if one tries to do a signature without a private key.
Alas, it checks a bunch of internal things, but tries things like
RSA_get0_key() if it's an RSA key, etc.  (Since ruby has OpenSSL::PKey::{RSA,EC,..})
This clearly is WRONG in a provider world where a private key might be kept
safely away from muggles like me.

Looking for man pages, and then evp.h, and store.h, to try to learn if there
is a way to understand if an EVP_PKEY has a private key associated with it.
I found nothing, but I could perhaps see if it was loaded via a provider, but
I think that a truism now, because the default provider is still a provider.

Okay, step back.
What we really want to know is: can this EVP_PKEY perform a signature operation.
It seems that perhaps I should just skip the tests that GetPrivPKeyPtr does,
and just depend upon EVP_DigestSignInit() failing if it can't be done?

EVP_DigestSignInit() still has ENGINE* argument.
While EVP_DigestSignInit_ex() has OSSL_LIB_CTX.
I find this confusing!


-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/558.1755896849%40obiwan.sandelman.ca.

signature.asc (application/pgp-signature, 511 B)