Quantum: Model OpenSSL EC key generation #19541
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…gen to be none, and rely implicitly on the connected algorithm length. (+1 squashed commits) (+1 squashed commits) Squashed commits: [b7cd7ba] Crypto: Modeled EC key gen for openssl. (+1 squashed commits)
0a99213 to
c3ed454
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR introduces Elliptic Curve (EC) key generation modeling for OpenSSL and unifies the getKeySizeFixed API to return an integer across multiple language models.
- Changed
getKeySizeFixedreturn type fromstringtointand updated surrounding conversions. - Added a new
ECKeyGenOperationclass to modelEC_KEY_generate_key. - Refactored algorithm instance methods to improve name parsing and removed legacy string-based key size logic.
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| shared/quantum/codeql/quantum/experimental/Model.qll | Switched getKeySizeFixed signatures to int and updated calls |
| java/ql/lib/experimental/quantum/JCA.qll | Updated stubs for getKeySizeFixed to return int |
| cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperations.qll | Imported the new ECKeyGenOperation |
| cpp/ql/lib/experimental/quantum/OpenSSL/Operations/ECKeyGenOperation.qll | Added EC key generation operation modeling stub |
| cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll | Introduced getParsedEllipticCurveName and adjusted type mapping |
| cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll | Modified getKeySizeFixed to return int using explicit size |
Comments suppressed due to low confidence (3)
cpp/ql/lib/experimental/quantum/OpenSSL/Operations/ECKeyGenOperation.qll:53
- The new ECKeyGenOperation stub for
getKeySizeFixedis currently untested and unimplemented. Add unit tests forEC_KEY_generate_keyflows and consider implementing key size inference or documenting the stub behavior.
override int getKeySizeFixed() {
java/ql/lib/experimental/quantum/JCA.qll:356
- This stub for
getKeySizeFixedin the JCA model lacks an implementation and corresponding tests. Consider implementing support for common key generators (e.g., AES-128) or adding tests to cover the placeholder behavior.
override int getKeySizeFixed() {
cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll:41
- [nitpick] The name
getParsedEllipticCurveNameclosely mirrorsgetRawEllipticCurveNamebut currently only returns the normalized name. Consider renaming or documenting the difference between 'raw' and 'parsed' to avoid confusion.
override string getParsedEllipticCurveName() {
cpp/ql/lib/experimental/quantum/OpenSSL/Operations/ECKeyGenOperation.qll
Outdated
Show resolved
Hide resolved
| @@ -0,0 +1,65 @@ | ||
| private import experimental.quantum.Language | ||
| private import experimental.quantum.OpenSSL.LibraryDetector | ||
| private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow |
Check warning
Code scanning / CodeQL
Acronyms should be PascalCase/camelCase. Warning
| private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow | ||
| private import OpenSSLOperationBase | ||
| private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers | ||
| private import semmle.code.cpp.dataflow.new.DataFlow |
Check warning
Code scanning / CodeQL
Redundant import Warning
…ration.qll Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
nicolaswill
approved these changes
May 21, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adding modeling for EC key gen for openssl