Skip to content

Commit f2d3e75

Browse files
committed
Do not special case export of EC keys
All other private keys are exported in PKCS#8 format, while EC keys use traditional format. Switch them to use PKCS#8 format as well. As the OpenSSL docs say: > PEM_write_bio_PrivateKey_traditional() writes out a private key > in the "traditional" format with a simple private key marker and > should only be used for compatibility with legacy programs.
1 parent 5843ba5 commit f2d3e75

File tree

3 files changed

+15
-31
lines changed

3 files changed

+15
-31
lines changed

UPGRADING

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,10 @@ PHP 8.1 UPGRADE NOTES
112112
. The mysqlnd.fetch_copy_data ini setting has been removed. However, this
113113
should not result in user-visible behavior changes.
114114

115+
- OpenSSL:
116+
. EC private keys will now be exported in PKCS#8 format rather than
117+
traditional format, just like all other keys.
118+
115119
- PDO:
116120
. PDO::ATTR_STRINGIFY_FETCHES now also stringifies values of type bool to
117121
"0" or "1". Previously booleans were not stringified.

ext/openssl/openssl.c

Lines changed: 6 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -4200,21 +4200,9 @@ PHP_FUNCTION(openssl_pkey_export_to_file)
42004200
cipher = NULL;
42014201
}
42024202

4203-
switch (EVP_PKEY_base_id(key)) {
4204-
#ifdef HAVE_EVP_PKEY_EC
4205-
case EVP_PKEY_EC:
4206-
pem_write = PEM_write_bio_ECPrivateKey(
4207-
bio_out, EVP_PKEY_get0_EC_KEY(key), cipher,
4208-
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
4209-
break;
4210-
#endif
4211-
default:
4212-
pem_write = PEM_write_bio_PrivateKey(
4213-
bio_out, key, cipher,
4214-
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
4215-
break;
4216-
}
4217-
4203+
pem_write = PEM_write_bio_PrivateKey(
4204+
bio_out, key, cipher,
4205+
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
42184206
if (pem_write) {
42194207
/* Success!
42204208
* If returning the output as a string, do so now */
@@ -4272,21 +4260,9 @@ PHP_FUNCTION(openssl_pkey_export)
42724260
cipher = NULL;
42734261
}
42744262

4275-
switch (EVP_PKEY_base_id(key)) {
4276-
#ifdef HAVE_EVP_PKEY_EC
4277-
case EVP_PKEY_EC:
4278-
pem_write = PEM_write_bio_ECPrivateKey(
4279-
bio_out, EVP_PKEY_get0_EC_KEY(key), cipher,
4280-
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
4281-
break;
4282-
#endif
4283-
default:
4284-
pem_write = PEM_write_bio_PrivateKey(
4285-
bio_out, key, cipher,
4286-
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
4287-
break;
4288-
}
4289-
4263+
pem_write = PEM_write_bio_PrivateKey(
4264+
bio_out, key, cipher,
4265+
(unsigned char *)passphrase, (int)passphrase_len, NULL, NULL);
42904266
if (pem_write) {
42914267
/* Success!
42924268
* If returning the output as a string, do so now */

ext/openssl/tests/openssl_pkey_export_basic.phpt

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,11 @@ var_dump($key instanceof OpenSSLAsymmetricKey);
4747
object(OpenSSLAsymmetricKey)#%d (0) {
4848
}
4949
bool(true)
50-
-----BEGIN EC PRIVATE KEY-----%a-----END EC PRIVATE KEY-----
50+
-----BEGIN PRIVATE KEY-----
51+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgs+Sqh7IzteDBiS5K
52+
PfTvuWuyt9YkrkuoyiW/6bag6NmhRANCAAQ+riFshYe8HnWt1avx6OuNajipU1ZW
53+
6BgW0+D/EtDDSYeQg9ngO8qyo5M6cyh7ORtKZVUy7DP1+W+eocaZC+a6
54+
-----END PRIVATE KEY-----
5155
bool(true)
5256
bool(true)
5357
object(OpenSSLAsymmetricKey)#%d (0) {

0 commit comments

Comments
 (0)