giomba
/
opensc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

PKCS#11 hashes for cards without RAW (see #241) 

The framework-pkcs15.c did not add hashes correctly if the card did not support RSA RAW.
    This change fixes that and only adds hashes if the card did not specify a list of hashes.
    It also will not add hashes done in software if ENABLE_OPENSSL is not specified.
    Some error conditions are also tested for EC mechanisms.

    See bug report #241 for more information.
This commit is contained in:
Doug Engert 2014-10-13 10:29:27 -05:00
parent 9a82a95132
commit 189e998486
1 changed files with 41 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
src/pkcs11/framework-pkcs15.c
View File

@ -4560,13 +4560,15 @@ static int register_ec_mechanisms(struct sc_pkcs11_card *p11card, int flags,
mech_info.flags |= CKF_DERIVE;
mt = sc_pkcs11_new_fw_mechanism(CKM_ECDH1_COFACTOR_DERIVE, &mech_info, CKK_EC, NULL);
if (!mt)
return CKR_HOST_MEMORY;
rc = sc_pkcs11_register_mechanism(p11card, mt);
if (rc != CKR_OK)
return rc;
mt = sc_pkcs11_new_fw_mechanism(CKM_ECDH1_DERIVE, &mech_info, CKK_EC, NULL);
if (!mt)
return CKR_HOST_MEMORY;
rc = sc_pkcs11_register_mechanism(p11card, mt);
if (rc != CKR_OK)
return rc;
@ -4672,46 +4674,59 @@ register_mechanisms(struct sc_pkcs11_card *p11card)
if (rc != CKR_OK)
return rc;
/* If the card supports RAW, it should by all means
* have registered everything else, too. If it didn't
* we help it a little
* FIXME? This may force us to support these in software
*/
flags |= SC_ALGORITHM_RSA_PAD_PKCS1;
#ifdef ENABLE_OPENSSL
/* all our software hashes are in OpenSSL */
flags |= SC_ALGORITHM_RSA_HASHES;
#endif
}
/* Check for PKCS1 */
/* We support PKCS1 padding in software */
/* either the card supports it or OpenSC does */
flags |= SC_ALGORITHM_RSA_PAD_PKCS1;
#ifdef ENABLE_OPENSSL
/* all our software hashes are in OpenSSL */
/* Only if card did not lists the hashs, will we
* help it a little, by adding all the OpenSSL hashes
* that have PKCS#11 mechanisms.
*/
if (!(flags & SC_ALGORITHM_RSA_HASHES)) {
flags |= SC_ALGORITHM_RSA_HASHES;
#if OPENSSL_VERSION_NUMBER < 0x00908000L
/* turn off hashes not in openssl 0.9.8 */
flags &= ~(SC_ALGORITHM_RSA_HASH_SHA256 | SC_ALGORITHM_RSA_HASH_SHA384 | SC_ALGORITHM_RSA_HASH_SHA512 | SC_ALGORITHM_RSA_HASH_SHA224);
#endif
}
#endif
/* No need to Check for PKCS1 We support it in software and turned it on above so always added it */
if (flags & SC_ALGORITHM_RSA_PAD_PKCS1) {
mt = sc_pkcs11_new_fw_mechanism(CKM_RSA_PKCS, &mech_info, CKK_RSA, NULL);
rc = sc_pkcs11_register_mechanism(p11card, mt);
if (rc != CKR_OK)
return rc;
/* if the driver doesn't say what hashes it supports,
* claim we will do all of them */
/* FIXME? This may force us to support these in software */
/* FIXME? and we only do hashes if OpenSSL is enabled */
if (!(flags & (SC_ALGORITHM_RSA_HASHES|SC_ALGORITHM_RSA_HASH_NONE)))
flags |= SC_ALGORITHM_RSA_HASHES;
#ifdef ENABLE_OPENSSL
/* sc_pkcs11_register_sign_and_hash_mechanism expects software hash */
/* All hashes are in OpenSSL
* Either the card set the hashes or we helped it above */
if (flags & SC_ALGORITHM_RSA_HASH_SHA1) {
rc = sc_pkcs11_register_sign_and_hash_mechanism(p11card, CKM_SHA1_RSA_PKCS, CKM_SHA_1, mt);
if (rc != CKR_OK)
return rc;
}
#if OPENSSL_VERSION_NUMBER >= 0x00908000L
if (flags & SC_ALGORITHM_RSA_HASH_SHA256) {
rc = sc_pkcs11_register_sign_and_hash_mechanism(p11card, CKM_SHA256_RSA_PKCS, CKM_SHA256, mt);
if (rc != CKR_OK)
return rc;
}
#endif
if (flags & SC_ALGORITHM_RSA_HASH_SHA384) {
rc = sc_pkcs11_register_sign_and_hash_mechanism(p11card, CKM_SHA384_RSA_PKCS, CKM_SHA384, mt);
if (rc != CKR_OK)
return rc;
}
if (flags & SC_ALGORITHM_RSA_HASH_SHA512) {
rc = sc_pkcs11_register_sign_and_hash_mechanism(p11card, CKM_SHA512_RSA_PKCS, CKM_SHA512, mt);
if (rc != CKR_OK)
return rc;
}
if (flags & SC_ALGORITHM_RSA_HASH_MD5) {
rc = sc_pkcs11_register_sign_and_hash_mechanism(p11card, CKM_MD5_RSA_PKCS, CKM_MD5, mt);
if (rc != CKR_OK)
@ -4722,7 +4737,10 @@ register_mechanisms(struct sc_pkcs11_card *p11card)
if (rc != CKR_OK)
return rc;
}
#endif
#endif /* ENABLE_OPENSSL */
}
/* TODO support other padding mechanisms */
if (flags & SC_ALGORITHM_ONBOARD_KEY_GEN) {
mech_info.flags = CKF_GENERATE_KEY_PAIR;
@ -4733,7 +4751,6 @@ register_mechanisms(struct sc_pkcs11_card *p11card)
if (rc != CKR_OK)
return rc;
}
}
return CKR_OK;
}