giomba
/
opensc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

card-gemsafeV1: Support signing SHA256 

GemSAFE V1 cards support signing 36 bytes of free form data.
When signing a hash, the hash must be prepended by the DigestInfo
header. The PKCS#1 padding is done on the card. The 36 bytes limit
is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and
RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1
(16 + 20 bytes, no header). The algorithm reference ("cryptographic
mechanism reference" in ISO 7816 parlance) for signing free form data
is 0x12.

GemSAFE V3 cards changed the algorithm reference for signing free
form data to 0x02. In addition, they gained the ability to sign SHA256.
Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),
it must be sent to the card *without* DigestInfo header. The header
will be prepended by the card and it is instructed to do so by sending
algorithm reference 0x42.

This scheme is also supported for SHA1, the algorithm reference is
0x12 in this case. However using this is not necessary as SHA1 fits
within the 36 bytes limit, including the header.

Supporting SHA256 is straightforward, we just add it to the flags
before adding the RSA algorithms. When sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card
capabilities 0x8000021A" and the output will be "pad flags 0x0, secure
algorithm flags 0x202". I.e. the hash is neither prepended by the
DigestInfo header nor PKCS#1 padded and the hash algorithm is passed
to gemsafe_set_security_env() which can send the appropriate algorithm
reference 0x42 to the card.

However there's a catch: Once we add SHA256 to the flags, PKCS#11
applications will be unable to use the other hashes like SHA1 or
RIPEMD160. That's because register_mechanisms() checks if the card
supports no hashes, and if so, adds all of them:

		if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {
			rsa_flags |= SC_ALGORITHM_RSA_HASHES;
		}

We cannot add these missing hashes to the flags like we did with SHA256
because like SHA256, they would be sent to the card *without* DigestInfo
header. What we want is to send all hashes *with* DigestInfo header,
*except* for SHA256.

We can achieve that by registering a fake RSA algorithm which includes
the missing hashes in its flags. This fake algorithm is never used
because sc_card_find_rsa_alg() searches the algorithm list in-order
and we register the fake algorithm *after* the real algorithms.

The fake algorithm persuades register_mechanisms() to register the
missing hashes because it ORs the flags of all RSA algorithms together:

	num = card->algorithm_count;
	while (num--) {
		switch (alg_info->algorithm) {
			case SC_ALGORITHM_RSA:
				rsa_flags |= alg_info->flags;
				break;
		}
	}

So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()
calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card
capabilities 0x8000021A" and the output will be "pad flags 0x100, secure
algorithm flags 0x2". This will result in the hash being prepended by
the DigestInfo header, which is what we want.
This commit is contained in:
Lukas Wunner 2015-10-03 11:55:55 +02:00 committed by Frank Morgner
parent e8d8f9f2bb
commit d7559f1546
1 changed files with 32 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
src/libopensc/card-gemsafeV1.c
View File

@ -28,6 +28,11 @@
#include "asn1.h"
#include "cardctl.h"
#define GEMSAFEV1_ALG_REF_FREEFORM 0x12
#define GEMSAFEV3_ALG_REF_FREEFORM 0x02
#define GEMSAFEV3_ALG_REF_SHA1 0x12
#define GEMSAFEV3_ALG_REF_SHA256 0x42
static struct sc_card_operations gemsafe_ops;
static struct sc_card_operations *iso_ops = NULL;
@ -199,10 +204,27 @@ static int gemsafe_init(struct sc_card *card)
flags |= SC_ALGORITHM_ONBOARD_KEY_GEN;
flags |= SC_ALGORITHM_RSA_HASH_NONE;
/* GemSAFE V3 cards support SHA256 */
if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID)
flags |= SC_ALGORITHM_RSA_HASH_SHA256;
_sc_card_add_rsa_alg(card, 512, flags, 0);
_sc_card_add_rsa_alg(card, 768, flags, 0);
_sc_card_add_rsa_alg(card, 1024, flags, 0);
_sc_card_add_rsa_alg(card, 2048, flags, 0);
/* fake algorithm to persuade register_mechanisms()
* to register these hashes */
if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) {
flags = SC_ALGORITHM_RSA_HASH_SHA1;
flags |= SC_ALGORITHM_RSA_HASH_MD5;
flags |= SC_ALGORITHM_RSA_HASH_MD5_SHA1;
flags |= SC_ALGORITHM_RSA_HASH_RIPEMD160;
_sc_card_add_rsa_alg(card, 512, flags, 0);
}
}
card->drv_data = exdata;
@ -363,15 +385,21 @@ static u8 gemsafe_flags2algref(struct sc_card *card, const struct sc_security_en
u8 ret = 0;
if (env->operation == SC_SEC_OPERATION_SIGN) {
if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1)
if (env->algorithm_flags & SC_ALGORITHM_RSA_HASH_SHA256)
ret = GEMSAFEV3_ALG_REF_SHA256;
else if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1)
ret = (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ? 0x02 : 0x12;
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ?
GEMSAFEV3_ALG_REF_FREEFORM :
GEMSAFEV1_ALG_REF_FREEFORM;
else if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_ISO9796)
ret = 0x11;
} else if (env->operation == SC_SEC_OPERATION_DECIPHER) {
if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1)
ret = (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID ||
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ? 0x02 : 0x12;
card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ?
GEMSAFEV3_ALG_REF_FREEFORM :
GEMSAFEV1_ALG_REF_FREEFORM;
}
return ret;
@ -429,6 +457,7 @@ static int gemsafe_compute_signature(struct sc_card *card, const u8 * data,
SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
/* the card can sign 36 bytes of free form data */
if (data_len > 36) {
sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "error: input data too long: %lu bytes\n", data_len);
return SC_ERROR_INVALID_ARGUMENTS;