diff --git a/apps/pkeyparam.c b/apps/pkeyparam.c index 3722be4bf6..4fefe69e6b 100644 --- a/apps/pkeyparam.c +++ b/apps/pkeyparam.c @@ -100,7 +100,8 @@ int pkeyparam_main(int argc, char **argv) out = bio_open_default(outfile, 'w', FORMAT_PEM); if (out == NULL) goto end; - pkey = PEM_read_bio_Parameters(in, NULL); + pkey = PEM_read_bio_Parameters_ex(in, NULL, app_get0_libctx(), + app_get0_propq()); if (pkey == NULL) { BIO_printf(bio_err, "Error reading parameters\n"); ERR_print_errors(bio_err); @@ -108,7 +109,11 @@ int pkeyparam_main(int argc, char **argv) } if (check) { - ctx = EVP_PKEY_CTX_new(pkey, e); + if (e == NULL) + ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey, + app_get0_propq()); + else + ctx = EVP_PKEY_CTX_new(pkey, e); if (ctx == NULL) { ERR_print_errors(bio_err); goto end; diff --git a/test/recipes/15-test_ecparam.t b/test/recipes/15-test_ecparam.t index 17ee9e2d98..37bf620f35 100644 --- a/test/recipes/15-test_ecparam.t +++ b/test/recipes/15-test_ecparam.t @@ -119,7 +119,7 @@ subtest "Check pkeyparam does not change the parameter file on output" => sub { subtest "Check loading of fips and non-fips params" => sub { plan skip_all => "FIPS is disabled" if $no_fips; - plan tests => 6; + plan tests => 8; my $fipsconf = srctop_file("test", "fips-and-base.cnf"); my $defaultconf = srctop_file("test", "default.cnf"); @@ -141,6 +141,11 @@ subtest "Check loading of fips and non-fips params" => sub { '-check'])), "Fail loading named non-fips curve"); + ok(!run(app(['openssl', 'pkeyparam', + '-in', data_file('valid', 'secp112r1-named.pem'), + '-check'])), + "Fail loading named non-fips curve using pkeyparam"); + ok(run(app(['openssl', 'ecparam', '-provider', 'default', '-propquery', '?fips!=yes', @@ -149,6 +154,14 @@ subtest "Check loading of fips and non-fips params" => sub { "Loading named non-fips curve in FIPS mode with non-FIPS property". " query"); + ok(run(app(['openssl', 'pkeyparam', + '-provider', 'default', + '-propquery', '?fips!=yes', + '-in', data_file('valid', 'secp112r1-named.pem'), + '-check'])), + "Loading named non-fips curve in FIPS mode with non-FIPS property". + " query using pkeyparam"); + ok(!run(app(['openssl', 'ecparam', '-genkey', '-name', 'secp112r1'])), "Fail generating key for named non-fips curve");