[crypto] Allow algorithms to be included without being OID-identifiable

There are many ways in which the object for a cryptographic algorithm
may be included, even if not explicitly enabled in config/crypto.h.
For example: the MD5 algorithm is required by TLSv1.1 or earlier, by
iSCSI CHAP authentication, by HTTP digest authentication, and by NTLM
authentication.

In the current implementation, inclusion of an algorithm for any
reason will result in the algorithm's ASN.1 object identifier being
included in the "asn1_algorithms" table, which consequently allows the
algorithm to be used for any ASN1-identified purpose.  For example: if
the MD5 algorithm is included in order to support HTTP digest
authentication, then iPXE would accept a (validly signed) TLS
certificate using an MD5 digest.

Split the ASN.1 object identifiers into separate files that are
required only if explicitly enabled in config/crypto.h.  This allows
an algorithm to be omitted from the "asn1_algorithms" table even if
the algorithm implementation is dragged in for some other purpose.

The end result is that only the algorithms that are explicitly enabled
in config/crypto.h can be used for ASN1-identified purposes such as
signature verification.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

2 files changed, 62 insertions, 12 deletions

diff --git a/src/config/config_crypto.c b/src/config/config_crypto.c
index 1e125d8..440bf4c 100644
--- a/src/config/config_crypto.c
+++ b/src/config/config_crypto.c
@@ -33,6 +33,56 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 
 PROVIDE_REQUIRING_SYMBOL();
 
+/* RSA */
+#if defined ( CRYPTO_PUBKEY_RSA )
+REQUIRE_OBJECT ( oid_rsa );
+#endif
+
+/* MD4 */
+#if defined ( CRYPTO_DIGEST_MD4 )
+REQUIRE_OBJECT ( oid_md4 );
+#endif
+
+/* MD5 */
+#if defined ( CRYPTO_DIGEST_MD5 )
+REQUIRE_OBJECT ( oid_md5 );
+#endif
+
+/* SHA-1 */
+#if defined ( CRYPTO_DIGEST_SHA1 )
+REQUIRE_OBJECT ( oid_sha1 );
+#endif
+
+/* SHA-224 */
+#if defined ( CRYPTO_DIGEST_SHA224 )
+REQUIRE_OBJECT ( oid_sha224 );
+#endif
+
+/* SHA-256 */
+#if defined ( CRYPTO_DIGEST_SHA256 )
+REQUIRE_OBJECT ( oid_sha256 );
+#endif
+
+/* SHA-384 */
+#if defined ( CRYPTO_DIGEST_SHA384 )
+REQUIRE_OBJECT ( oid_sha384 );
+#endif
+
+/* SHA-512 */
+#if defined ( CRYPTO_DIGEST_SHA512 )
+REQUIRE_OBJECT ( oid_sha512 );
+#endif
+
+/* SHA-512/224 */
+#if defined ( CRYPTO_DIGEST_SHA512_224 )
+REQUIRE_OBJECT ( oid_sha512_224 );
+#endif
+
+/* SHA-512/256 */
+#if defined ( CRYPTO_DIGEST_SHA512_256 )
+REQUIRE_OBJECT ( oid_sha512_256 );
+#endif
+
 /* RSA and MD5 */
 #if defined ( CRYPTO_PUBKEY_RSA ) && defined ( CRYPTO_DIGEST_MD5 )
 REQUIRE_OBJECT ( rsa_md5 );
diff --git a/src/config/crypto.h b/src/config/crypto.h
index cc86573..a87cf92 100644
--- a/src/config/crypto.h
+++ b/src/config/crypto.h
@@ -18,25 +18,19 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 /** AES-CBC block cipher */
 #define CRYPTO_CIPHER_AES_CBC
 
-/** MD5 digest algorithm
- *
- * Note that use of MD5 is implicit when using TLSv1.1 or earlier.
- */
+/** MD4 digest algorithm */
+//#define CRYPTO_DIGEST_MD4
+
+/** MD5 digest algorithm */
 #define CRYPTO_DIGEST_MD5
 
-/** SHA-1 digest algorithm
- *
- * Note that use of SHA-1 is implicit when using TLSv1.1 or earlier.
- */
+/** SHA-1 digest algorithm */
 #define CRYPTO_DIGEST_SHA1
 
 /** SHA-224 digest algorithm */
 #define CRYPTO_DIGEST_SHA224
 
-/** SHA-256 digest algorithm
- *
- * Note that use of SHA-256 is implicit when using TLSv1.2.
- */
+/** SHA-256 digest algorithm */
 #define CRYPTO_DIGEST_SHA256
 
 /** SHA-384 digest algorithm */
@@ -45,6 +39,12 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 /** SHA-512 digest algorithm */
 #define CRYPTO_DIGEST_SHA512
 
+/** SHA-512/224 digest algorithm */
+//#define CRYPTO_DIGEST_SHA512_224
+
+/** SHA-512/256 digest algorithm */
+//#define CRYPTO_DIGEST_SHA512_256
+
 /** Margin of error (in seconds) allowed in signed timestamps
  *
  * We default to allowing a reasonable margin of error: 12 hours to