Validate pss params.

crypto/evp/evp_ctx.c

@@ -220,7 +220,11 @@ int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx) {
   }
 
   ctx->operation = EVP_PKEY_OP_SIGN;
-  return 1;
+  if ((ctx->pmeth->sign_init == NULL) || (ctx->pmeth->sign_init(ctx))) {
+    return 1;
+  }
+  ctx->operation = EVP_PKEY_OP_UNDEFINED;
+  return 0;
 }
 
 int EVP_PKEY_sign(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *sig_len,
@@ -243,7 +247,11 @@ int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx) {
     return 0;
   }
   ctx->operation = EVP_PKEY_OP_VERIFY;
-  return 1;
+  if ((ctx->pmeth->verify_init == NULL) || (ctx->pmeth->verify_init(ctx))) {
+    return 1;
+  }
+  ctx->operation = EVP_PKEY_OP_UNDEFINED;
+  return 0;
 }
 
 int EVP_PKEY_verify(EVP_PKEY_CTX *ctx, const uint8_t *sig, size_t sig_len,

crypto/evp/evp_extra_test.cc

@@ -238,8 +238,9 @@ static const uint8_t kExampleRSAKeyPKCS8[] = {
     0x08, 0xf1, 0x2d, 0x86, 0x9d, 0xa5, 0x20, 0x1b, 0xe5, 0xdf,
 };
 
-// kExampleRSAPSSKeyPKCS8 is encoded in a PKCS #8 PrivateKeyInfo.
-// kExampleRSAPSSKeyPKCS8 contains pss params for decoding params test.
+// kExampleRSAPSSKeyPKCS8 contains a DER-encoded RSASSA-PSS-params:
+//    Hash Algorithm: sha256
+//    Mask Algorithm: mgf1 with sha256
 static const uint8_t kExampleRSAPSSKeyPKCS8[] = {
     0x30, 0x82, 0x04, 0xea, 0x02, 0x01, 0x00, 0x30, 0x38, 0x06, 0x09, 0x2a,
     0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x2b, 0xa0, 0x0d,
@@ -348,6 +349,119 @@ static const uint8_t kExampleRSAPSSKeyPKCS8[] = {
     0xe5, 0x7a, 0xa5, 0x8c, 0x31, 0xe5, 0xae, 0xe3, 0x27, 0xa7, 0x8e, 0xa8,
     0x94, 0xc2};
 
+// badRSAPSSKeyPKCS8_SaltLengthTooLarge is encoded in a PKCS #8 PrivateKeyInfo.
+// badRSAPSSKeyPKCS8_SaltLengthTooLarge contains a DER-encoded RSASSA-PSS-params:
+//    Hash Algorithm: sha256
+//    Mask Algorithm: mgf1 with sha256
+//    Salt Length: 511
+static const uint8_t badRSAPSSKeyPKCS8_SaltLengthTooLarge[] = {
+    0x30, 0x82, 0x04, 0xed, 0x02, 0x01, 0x00, 0x30, 0x3e, 0x06, 0x09, 0x2a,
+    0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x31, 0xa0, 0x0d,
+    0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02,
+    0x01, 0xa1, 0x1a, 0x30, 0x18, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+    0x0d, 0x01, 0x01, 0x08, 0x30, 0x0b, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
+    0x65, 0x03, 0x04, 0x02, 0x01, 0xa2, 0x04, 0x02, 0x02, 0x01, 0xff, 0x04,
+    0x82, 0x04, 0xa6, 0x30, 0x82, 0x04, 0xa2, 0x02, 0x01, 0x00, 0x02, 0x82,
+    0x01, 0x01, 0x00, 0xc4, 0xd8, 0xc8, 0x45, 0x0c, 0x9a, 0xc6, 0x5a, 0xf0,
+    0xe8, 0x34, 0x3b, 0x9d, 0x73, 0x01, 0xe0, 0x71, 0xb5, 0x3a, 0x55, 0x9e,
+    0xc6, 0xcd, 0xdc, 0xdb, 0x98, 0x29, 0xea, 0x75, 0x4f, 0xf9, 0xa9, 0x5c,
+    0xc1, 0x40, 0x1d, 0x7c, 0x7d, 0x60, 0x8f, 0x1e, 0x1d, 0xde, 0xb1, 0x9b,
+    0xca, 0x8d, 0x7d, 0x83, 0x09, 0xce, 0x56, 0x94, 0x22, 0x5e, 0xce, 0xa3,
+    0x5f, 0x66, 0x3e, 0x24, 0x08, 0x78, 0x05, 0xc1, 0xe2, 0x11, 0x08, 0x0d,
+    0x58, 0x1c, 0xec, 0xd3, 0xfd, 0xdb, 0x36, 0x39, 0x74, 0x7d, 0x79, 0xef,
+    0xd2, 0x32, 0x99, 0xb2, 0x44, 0xa0, 0x77, 0xf8, 0x88, 0x7e, 0x16, 0x9b,
+    0x39, 0x40, 0x48, 0x48, 0x4f, 0x66, 0x26, 0xc9, 0xee, 0x7a, 0xdd, 0xfa,
+    0xf8, 0x74, 0xf6, 0xdb, 0xbc, 0x57, 0x5a, 0xc3, 0x4e, 0xd2, 0xb3, 0x5d,
+    0xe6, 0xb9, 0x6e, 0x63, 0x72, 0x46, 0xde, 0xe4, 0xff, 0x60, 0x9f, 0x00,
+    0x0b, 0x2b, 0x6b, 0xf2, 0xc9, 0x41, 0x0d, 0x0e, 0x99, 0x62, 0xda, 0xeb,
+    0x52, 0x5f, 0xfd, 0x37, 0x04, 0xae, 0x56, 0x48, 0x44, 0x6f, 0x2c, 0x86,
+    0x06, 0xce, 0x4c, 0x19, 0x84, 0x86, 0x73, 0x0c, 0x9a, 0xb6, 0x89, 0x0e,
+    0x42, 0x81, 0xe8, 0xcf, 0x25, 0x3a, 0x4c, 0x3b, 0xd4, 0xaf, 0xec, 0xaf,
+    0x99, 0x5c, 0x27, 0x7c, 0x02, 0x4a, 0xdb, 0x1d, 0x52, 0x00, 0x48, 0x4c,
+    0x6b, 0x06, 0x9b, 0x2a, 0xaa, 0x38, 0xc0, 0xac, 0x3d, 0xf9, 0xc2, 0x06,
+    0x2b, 0x18, 0xc5, 0x48, 0x56, 0x3f, 0xe4, 0xab, 0x5a, 0x2b, 0x3e, 0x87,
+    0x3d, 0x29, 0xbb, 0x93, 0x05, 0x6c, 0xcd, 0xaa, 0xd0, 0x0a, 0x13, 0x2f,
+    0x96, 0xcd, 0xe4, 0xa8, 0xa4, 0x7b, 0xc1, 0x39, 0x1d, 0x27, 0xc3, 0x20,
+    0xa0, 0xc0, 0xe5, 0x05, 0xc6, 0x6e, 0x8e, 0x46, 0x77, 0x46, 0xfb, 0xdc,
+    0xbb, 0x1f, 0x3c, 0x6e, 0xc8, 0xd3, 0xdb, 0x02, 0x03, 0x01, 0x00, 0x01,
+    0x02, 0x82, 0x01, 0x00, 0x30, 0x00, 0xe5, 0xa5, 0xe1, 0x13, 0x05, 0x78,
+    0x3b, 0xf3, 0x84, 0x79, 0x5d, 0x46, 0x24, 0x99, 0x05, 0x61, 0xba, 0x9e,
+    0x12, 0xa0, 0x4c, 0xa7, 0xa5, 0x6d, 0x90, 0x1b, 0x3b, 0x0c, 0x8b, 0xc7,
+    0xbf, 0x74, 0xe9, 0x1b, 0xc7, 0xb6, 0x13, 0x8c, 0x13, 0x3e, 0x19, 0x86,
+    0x9a, 0x85, 0x64, 0xc7, 0xcc, 0xe2, 0xe1, 0x4c, 0xbf, 0xc7, 0x39, 0xf3,
+    0x8e, 0x67, 0xbf, 0x59, 0x3c, 0x14, 0x4c, 0xa0, 0xaa, 0xcd, 0x64, 0x75,
+    0xe0, 0x3b, 0x32, 0xa2, 0x96, 0x77, 0xfb, 0xb3, 0x57, 0x83, 0x8e, 0xed,
+    0xe3, 0x8c, 0x11, 0x06, 0xe6, 0x30, 0x52, 0x29, 0xaf, 0x94, 0x29, 0x9b,
+    0x7d, 0xb3, 0x12, 0x78, 0x0e, 0x1a, 0x3e, 0xc1, 0x0a, 0xd1, 0x7b, 0x69,
+    0x12, 0xc0, 0xf0, 0x55, 0x1a, 0xf4, 0xed, 0x20, 0x97, 0x2c, 0x6b, 0xb9,
+    0x8e, 0x16, 0xab, 0xf5, 0xbd, 0x8e, 0xaa, 0xb5, 0xc4, 0x86, 0x7a, 0x9b,
+    0x1d, 0x6f, 0xe3, 0xf8, 0x4f, 0x27, 0xde, 0x5d, 0x05, 0x9a, 0x4d, 0xa6,
+    0xd7, 0xb2, 0x18, 0x54, 0xbe, 0x5c, 0x35, 0x4e, 0xb8, 0x62, 0xb5, 0x96,
+    0xc8, 0xb3, 0x41, 0xae, 0x74, 0x51, 0x48, 0x45, 0xa1, 0xaa, 0xad, 0x64,
+    0x3d, 0x2a, 0x78, 0xd0, 0xf4, 0x49, 0xcb, 0xd5, 0x24, 0x56, 0x23, 0x48,
+    0x42, 0x20, 0x3f, 0xbe, 0x03, 0x91, 0xc1, 0xb8, 0x1a, 0xcc, 0x26, 0x0b,
+    0xdc, 0x9f, 0x24, 0x75, 0x12, 0xf8, 0xd5, 0x0c, 0xbc, 0x84, 0xdc, 0x7a,
+    0x94, 0xb8, 0x9d, 0x3a, 0x3c, 0x0e, 0xcf, 0x06, 0xfc, 0xf1, 0xe4, 0xf8,
+    0x46, 0xc3, 0xa0, 0x8f, 0x09, 0x0d, 0xbc, 0xcc, 0x15, 0x0c, 0x4e, 0x92,
+    0x21, 0xe6, 0x45, 0x5a, 0x5e, 0xe0, 0xbe, 0x8d, 0xab, 0x1d, 0x3c, 0x32,
+    0xa7, 0x7c, 0x36, 0xda, 0xc9, 0x5a, 0xae, 0xd1, 0xf1, 0x0f, 0x4c, 0x2f,
+    0xbf, 0x57, 0x0d, 0x7c, 0x70, 0x3a, 0x71, 0x11, 0x02, 0x81, 0x81, 0x00,
+    0xfd, 0x50, 0xa3, 0xb7, 0x52, 0xfa, 0x64, 0x84, 0x50, 0x1a, 0x35, 0x8c,
+    0xe0, 0xe9, 0x23, 0x8a, 0x47, 0xdb, 0x99, 0x4a, 0xa4, 0x22, 0xff, 0xa6,
+    0x30, 0x03, 0x38, 0x2e, 0x11, 0x99, 0xeb, 0x27, 0x45, 0x96, 0x2f, 0xb6,
+    0xae, 0x28, 0x82, 0xad, 0x32, 0xbd, 0x9a, 0xf8, 0xd2, 0x2c, 0xea, 0xe0,
+    0x49, 0xd2, 0x3c, 0x17, 0x92, 0xf0, 0xe1, 0x0b, 0xb4, 0xec, 0xfd, 0xf2,
+    0xac, 0x76, 0xa5, 0xf5, 0x89, 0x91, 0xe7, 0x0c, 0x7b, 0xe4, 0x5a, 0x02,
+    0x88, 0xf9, 0xf7, 0x10, 0x40, 0x3b, 0x0a, 0x12, 0x83, 0x5c, 0x4b, 0x62,
+    0x7b, 0xdb, 0xbe, 0x7f, 0x6b, 0x44, 0x81, 0xaa, 0xab, 0x6a, 0x2f, 0x72,
+    0xf2, 0x72, 0xa2, 0x84, 0x3a, 0x6a, 0x38, 0x7b, 0x03, 0x16, 0x77, 0x4b,
+    0xd8, 0x41, 0x44, 0xfe, 0xcb, 0xb1, 0x3c, 0x4c, 0x96, 0x1c, 0x01, 0x75,
+    0x00, 0x09, 0xa2, 0xae, 0xe5, 0x7c, 0x1b, 0xff, 0x02, 0x81, 0x81, 0x00,
+    0xc6, 0xee, 0xeb, 0x24, 0x69, 0x78, 0xda, 0x36, 0x9a, 0xb0, 0xf9, 0x11,
+    0x57, 0xc3, 0x5a, 0x63, 0xa4, 0x57, 0x50, 0xc7, 0x1e, 0xf7, 0x46, 0xd0,
+    0xa7, 0xac, 0x58, 0x9c, 0xdc, 0x93, 0x6d, 0x57, 0x78, 0xb7, 0x76, 0x88,
+    0x65, 0x2f, 0x13, 0xb6, 0x8c, 0x2e, 0xb9, 0x73, 0xc4, 0x33, 0x63, 0x8e,
+    0x70, 0xfb, 0x79, 0x68, 0x0d, 0x76, 0xf2, 0x6a, 0x01, 0x65, 0x07, 0x13,
+    0x5d, 0x14, 0x4c, 0xd8, 0x62, 0x2d, 0x7e, 0xa0, 0x13, 0xbf, 0x94, 0x28,
+    0xee, 0xb5, 0x60, 0x94, 0x8e, 0xfe, 0x4b, 0xdd, 0x6e, 0xef, 0xf8, 0xe0,
+    0x80, 0x71, 0x18, 0x69, 0x44, 0xab, 0x74, 0xed, 0x36, 0x2c, 0x5a, 0xfc,
+    0xc0, 0x5a, 0xbd, 0x21, 0x61, 0x44, 0x65, 0x31, 0x9e, 0x00, 0x2a, 0x3c,
+    0x99, 0x06, 0x9c, 0x4d, 0xc3, 0x97, 0x09, 0x1c, 0xc0, 0xd5, 0xd2, 0x4e,
+    0xf7, 0x7e, 0xa1, 0xd1, 0xa6, 0x47, 0x38, 0x25, 0x02, 0x81, 0x80, 0x01,
+    0x4f, 0x70, 0x79, 0x5b, 0x49, 0x86, 0x49, 0x94, 0xec, 0x7d, 0xc8, 0x6b,
+    0xc5, 0x68, 0xf4, 0xa7, 0x28, 0x80, 0xa3, 0x7d, 0x33, 0xdd, 0x24, 0xab,
+    0xec, 0xe8, 0x56, 0x7c, 0xaa, 0xd2, 0x27, 0x92, 0xd9, 0x93, 0x07, 0x9b,
+    0xe1, 0x03, 0xc4, 0x07, 0x96, 0x29, 0x7e, 0x0e, 0x00, 0x43, 0x7a, 0xc3,
+    0x86, 0xfd, 0xde, 0x95, 0x58, 0xff, 0xa1, 0x02, 0xdf, 0x92, 0xf4, 0xb5,
+    0x65, 0xab, 0xb8, 0x18, 0x6d, 0x13, 0xc7, 0xe1, 0xc0, 0x2d, 0xa3, 0x03,
+    0xb8, 0x5f, 0x49, 0xcb, 0x3b, 0x42, 0xf3, 0x13, 0x90, 0xdf, 0xa6, 0xf3,
+    0xc3, 0x10, 0x3a, 0x32, 0x80, 0xd9, 0x36, 0xdb, 0xca, 0x21, 0xd2, 0xb3,
+    0x64, 0x5a, 0x68, 0xda, 0xb0, 0x7f, 0xf8, 0x4a, 0xec, 0xcb, 0xd3, 0x2d,
+    0x9c, 0x30, 0xd2, 0x2c, 0x95, 0x8f, 0x1d, 0x4a, 0x4d, 0x7c, 0xc8, 0x71,
+    0x26, 0x9b, 0x9b, 0xd1, 0xfe, 0x11, 0x5b, 0x02, 0x81, 0x80, 0x22, 0x7a,
+    0xc0, 0x98, 0xc4, 0x0b, 0x25, 0x4f, 0x37, 0x8a, 0x9a, 0xf0, 0xcd, 0x94,
+    0x57, 0x73, 0x53, 0xc5, 0xaa, 0x83, 0x88, 0xb3, 0x75, 0x3b, 0xaf, 0x04,
+    0x29, 0x2b, 0xae, 0xf3, 0x82, 0x8d, 0x19, 0xa8, 0x3a, 0xcc, 0x33, 0x35,
+    0x70, 0xa6, 0x40, 0x2f, 0xcd, 0x06, 0xea, 0xa7, 0xb9, 0x86, 0xb3, 0xc0,
+    0x72, 0x6f, 0x7d, 0x7d, 0xf3, 0x50, 0x3a, 0x43, 0xa7, 0x71, 0x4c, 0xbd,
+    0xba, 0xff, 0xfa, 0x2c, 0x46, 0x79, 0x3a, 0x53, 0x07, 0x3b, 0xfc, 0xfb,
+    0xc4, 0xec, 0x9a, 0xc8, 0x2a, 0xa0, 0x0b, 0x9d, 0x5e, 0x36, 0x93, 0x2c,
+    0x86, 0xfd, 0x9f, 0xe0, 0x53, 0xd8, 0xd5, 0x7d, 0xe4, 0x9b, 0x50, 0x3f,
+    0xa9, 0xee, 0x42, 0x2c, 0x97, 0x99, 0x7c, 0xf8, 0x2c, 0x59, 0xea, 0x70,
+    0x01, 0xe1, 0x5c, 0x98, 0x2e, 0x05, 0x24, 0xcb, 0x2a, 0xb3, 0x73, 0x24,
+    0x28, 0xa9, 0xec, 0xb7, 0x05, 0x5d, 0x02, 0x81, 0x80, 0x51, 0x25, 0xc5,
+    0xc4, 0x8c, 0xa1, 0xdc, 0x5a, 0x7f, 0xf2, 0xe3, 0xf7, 0x3f, 0xb8, 0x10,
+    0x6e, 0xea, 0x71, 0x19, 0x24, 0x58, 0x85, 0xb8, 0x08, 0x06, 0x66, 0x86,
+    0x70, 0x7f, 0xcb, 0x0e, 0xe4, 0xa8, 0xd8, 0x20, 0xf3, 0xd2, 0xa8, 0xaa,
+    0xac, 0xe6, 0x31, 0x05, 0x91, 0x46, 0x23, 0xe3, 0xb9, 0x1c, 0xb8, 0x5e,
+    0x46, 0x4f, 0xc6, 0x28, 0x13, 0x3f, 0xa6, 0xd5, 0x43, 0xe5, 0xa0, 0xab,
+    0xa2, 0xce, 0xa9, 0x62, 0x6c, 0x39, 0x93, 0x75, 0x7b, 0xdc, 0x98, 0x36,
+    0xec, 0x7c, 0x83, 0x27, 0xbe, 0x39, 0x99, 0x1d, 0xce, 0x44, 0x28, 0xcf,
+    0xc0, 0xeb, 0xa8, 0x37, 0x3b, 0x5f, 0xbc, 0x8c, 0x4e, 0x96, 0x25, 0x5c,
+    0x1e, 0xb1, 0x35, 0x33, 0x2f, 0xfd, 0x55, 0x32, 0x9b, 0xd3, 0xdd, 0x1d,
+    0xe1, 0x8a, 0x4b, 0x1f, 0xf9, 0xd4, 0x0a, 0xa9, 0xf7, 0xdc, 0xae, 0x75,
+    0x85, 0x32, 0x66, 0xed, 0x53};
+
 // kExampleECKeyDER is a sample EC private key encoded as an ECPrivateKey
 // structure.
 static const uint8_t kExampleECKeyDER[] = {
@@ -898,3 +1012,98 @@ TEST(EVPExtraTest, Ed25519Keygen) {
   ASSERT_TRUE(EVP_DigestVerify(ctx.get(), sig, len,
                                reinterpret_cast<const uint8_t *>("hello"), 5));
 }
+
+struct RsassaPssParamsMatchTestInput {
+  const uint8_t *der;
+  size_t der_len;
+  const EVP_MD *signature_md;
+  const EVP_MD *rsa_mgf1_md;
+  int match;
+} kRsassaPssParamsMatchTestInputs[] = {
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha1(),
+     EVP_sha1(), 0},
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha224(),
+     EVP_sha224(), 0},
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha256(),
+     EVP_sha256(), 1},
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha384(),
+     EVP_sha384(), 0},
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha512(),
+     EVP_sha512(), 0},
+    {kExampleRSAPSSKeyPKCS8, sizeof(kExampleRSAPSSKeyPKCS8), EVP_sha512_256(),
+     EVP_sha512_256(), 0},
+};
+
+class EVPRsaPssExtraTest
+    : public testing::TestWithParam<RsassaPssParamsMatchTestInput> {};
+
+// This test checks params match.
+// All parameters in the signature structure algorithm identifier MUST
+// match the parameters in the key structure algorithm identifier except
+// the saltLength field.
+// See 3.3. https://tools.ietf.org/html/rfc4055#section-3.3
+TEST_P(EVPRsaPssExtraTest, PssParamsMatch) {
+  const auto &param = GetParam();
+  const uint8_t *p = param.der;
+  const EVP_MD *signature_md = param.signature_md;
+  const EVP_MD *rsa_mgf1_md = param.rsa_mgf1_md;
+  // Holds ownership of heap-allocated EVP_PKEY.
+  bssl::UniquePtr<EVP_PKEY> pkey_up(
+      d2i_AutoPrivateKey(nullptr, &p, param.der_len));
+  ASSERT_TRUE(pkey_up);
+  EXPECT_EQ(param.der + param.der_len, p);
+  EXPECT_EQ(EVP_PKEY_RSA_PSS, EVP_PKEY_id(pkey_up.get()));
+  // Holds ownership of heap-allocated EVP_PKEY_CTX.
+  bssl::UniquePtr<EVP_PKEY_CTX> pkey_ctx_up(
+      EVP_PKEY_CTX_new(pkey_up.get(), nullptr));
+  ASSERT_TRUE(pkey_ctx_up);
+  EVP_PKEY_CTX *pkey_ctx = pkey_ctx_up.get();
+  // Init pss params by calling |EVP_PKEY_sign_init|.
+  // These pss params are fetched from the key structure.
+  ASSERT_TRUE(EVP_PKEY_sign_init(pkey_ctx));
+  EXPECT_TRUE(EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING));
+  // Compare one way hash func.
+  EXPECT_EQ(EVP_PKEY_CTX_set_signature_md(pkey_ctx, signature_md), param.match);
+  // Compare one way hash func of mask gen.
+  EXPECT_EQ(EVP_PKEY_CTX_set_rsa_mgf1_md(pkey_ctx, rsa_mgf1_md), param.match);
+  EXPECT_TRUE(
+      EVP_PKEY_CTX_set_rsa_pss_saltlen(pkey_ctx, RSA_PSS_SALTLEN_DIGEST));
+  ERR_clear_error();
+}
+
+INSTANTIATE_TEST_SUITE_P(All, EVPRsaPssExtraTest,
+                         testing::ValuesIn(kRsassaPssParamsMatchTestInputs));
+
+struct BadPssKeyTestInput {
+  const uint8_t *der;
+  size_t der_len;
+} kBadPssKeyTestInputs[] = {
+    {badRSAPSSKeyPKCS8_SaltLengthTooLarge, sizeof(badRSAPSSKeyPKCS8_SaltLengthTooLarge)},
+};
+
+class EVPRsaPssBadKeyTest : public testing::TestWithParam<BadPssKeyTestInput> {
+};
+
+// This test checks pss salt length.
+TEST_P(EVPRsaPssBadKeyTest, InvalidSaltLength) {
+  const auto &param = GetParam();
+  const uint8_t *p = param.der;
+  // Holds ownership of heap-allocated EVP_PKEY.
+  bssl::UniquePtr<EVP_PKEY> pkey_up(
+      d2i_AutoPrivateKey(nullptr, &p, param.der_len));
+  ASSERT_TRUE(pkey_up);
+  EXPECT_EQ(param.der + param.der_len, p);
+  EXPECT_EQ(EVP_PKEY_RSA_PSS, EVP_PKEY_id(pkey_up.get()));
+  // Holds ownership of heap-allocated EVP_PKEY_CTX.
+  bssl::UniquePtr<EVP_PKEY_CTX> pkey_ctx_up(
+      EVP_PKEY_CTX_new(pkey_up.get(), nullptr));
+  ASSERT_TRUE(pkey_ctx_up);
+  EVP_PKEY_CTX *pkey_ctx = pkey_ctx_up.get();
+  // Init pss params by calling |EVP_PKEY_sign_init|.
+  // During initialization, the salt length is validated.
+  ASSERT_FALSE(EVP_PKEY_sign_init(pkey_ctx));
+  ERR_clear_error();
+}
+
+INSTANTIATE_TEST_SUITE_P(All, EVPRsaPssBadKeyTest,
+                         testing::ValuesIn(kBadPssKeyTestInputs));

crypto/evp/internal.h

@@ -208,12 +208,13 @@ struct evp_pkey_method_st {
 
   int (*keygen)(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey);
 
+  int (*sign_init)(EVP_PKEY_CTX *ctx);
   int (*sign)(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *siglen,
               const uint8_t *tbs, size_t tbslen);
 
   int (*sign_message)(EVP_PKEY_CTX *ctx, uint8_t *sig, size_t *siglen,
                       const uint8_t *tbs, size_t tbslen);
-
+  int (*verify_init)(EVP_PKEY_CTX *ctx);
   int (*verify)(EVP_PKEY_CTX *ctx, const uint8_t *sig, size_t siglen,
                 const uint8_t *tbs, size_t tbslen);
 

crypto/evp/p_ec.c

@@ -259,8 +259,10 @@ const EVP_PKEY_METHOD ec_pkey_meth = {
     pkey_ec_copy,
     pkey_ec_cleanup,
     pkey_ec_keygen,
+    NULL /* sign_init */,
     pkey_ec_sign,
     NULL /* sign_message */,
+    NULL /* verify_init */,
     pkey_ec_verify,
     NULL /* verify_message */,
     NULL /* verify_recover */,

crypto/evp/p_ed25519.c

@@ -91,8 +91,10 @@ const EVP_PKEY_METHOD ed25519_pkey_meth = {
     pkey_ed25519_copy,
     NULL /* cleanup */,
     pkey_ed25519_keygen,
+    NULL /* sign_init */,
     NULL /* sign */,
     pkey_ed25519_sign_message,
+    NULL /* verify_init */,
     NULL /* verify */,
     pkey_ed25519_verify_message,
     NULL /* verify_recover */,