1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds C`
. ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
. if \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. if !\nF==2 \{\
. nr % 0
. nr F 2
. \}
. \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "X509_DIGEST 3ssl"
.TH X509_DIGEST 3ssl 2024-01-30 3.2.1 OpenSSL
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
X509_digest,
X509_digest_sig,
X509_CRL_digest,
X509_pubkey_digest,
X509_NAME_digest,
X509_REQ_digest,
PKCS7_ISSUER_AND_SERIAL_digest
\&\- get digest of various objects
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 1
\& #include <openssl/x509.h>
\&
\& int X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
\& unsigned int *len);
\& ASN1_OCTET_STRING *X509_digest_sig(const X509 *cert,
\& EVP_MD **md_used, int *md_is_fallback);
\&
\& int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type, unsigned char *md,
\& unsigned int *len);
\&
\& int X509_pubkey_digest(const X509 *data, const EVP_MD *type,
\& unsigned char *md, unsigned int *len);
\&
\& int X509_REQ_digest(const X509_REQ *data, const EVP_MD *type,
\& unsigned char *md, unsigned int *len);
\&
\& int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type,
\& unsigned char *md, unsigned int *len);
\&
\& #include <openssl/pkcs7.h>
\&
\& int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,
\& const EVP_MD *type, unsigned char *md,
\& unsigned int *len);
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
\&\fBX509_digest_sig()\fR calculates a digest of the given certificate \fIcert\fR
using the same hash algorithm as in its signature, if the digest
is an integral part of the certificate signature algorithm identifier.
Otherwise, a fallback hash algorithm is determined as follows:
SHA512 if the signature algorithm is ED25519,
SHAKE256 if it is ED448, otherwise SHA256.
The output parameters are assigned as follows.
Unless \fImd_used\fR is NULL, the hash algorithm used is provided
in \fI*md_used\fR and must be freed by the caller (if it is not NULL).
Unless \fImd_is_fallback\fR is NULL,
the \fI*md_is_fallback\fR is set to 1 if the hash algorithm used is a fallback,
otherwise to 0.
.PP
\&\fBX509_pubkey_digest()\fR returns a digest of the DER representation of the public
key in the specified X509 \fIdata\fR object.
.PP
All other functions described here return a digest of the DER representation
of their entire \fIdata\fR objects.
.PP
The \fItype\fR parameter specifies the digest to
be used, such as \fBEVP_sha1()\fR. The \fImd\fR is a pointer to the buffer where the
digest will be copied and is assumed to be large enough; the constant
\&\fBEVP_MAX_MD_SIZE\fR is suggested. The \fIlen\fR parameter, if not NULL, points
to a place where the digest size will be stored.
.SH "RETURN VALUES"
.IX Header "RETURN VALUES"
\&\fBX509_digest_sig()\fR returns an ASN1_OCTET_STRING pointer on success, else NULL.
.PP
All other functions described here return 1 for success and 0 for failure.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBEVP_sha1\fR\|(3)
.SH HISTORY
.IX Header "HISTORY"
The \fBX509_digest_sig()\fR function was added in OpenSSL 3.0.
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright 2017\-2022 The OpenSSL Project Authors. All Rights Reserved.
.PP
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
<https://www.openssl.org/source/license.html>.
|
