From d7559f154666efd0d639b572bc4cd94082097a40 Mon Sep 17 00:00:00 2001 From: Lukas Wunner Date: Sat, 3 Oct 2015 11:55:55 +0200 Subject: [PATCH] card-gemsafeV1: Support signing SHA256 GemSAFE V1 cards support signing 36 bytes of free form data. When signing a hash, the hash must be prepended by the DigestInfo header. The PKCS#1 padding is done on the card. The 36 bytes limit is sufficient for MD5 (16 + 18 bytes for the header), SHA1 and RIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1 (16 + 20 bytes, no header). The algorithm reference ("cryptographic mechanism reference" in ISO 7816 parlance) for signing free form data is 0x12. GemSAFE V3 cards changed the algorithm reference for signing free form data to 0x02. In addition, they gained the ability to sign SHA256. Since SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header), it must be sent to the card *without* DigestInfo header. The header will be prepended by the card and it is instructed to do so by sending algorithm reference 0x42. This scheme is also supported for SHA1, the algorithm reference is 0x12 in this case. However using this is not necessary as SHA1 fits within the 36 bytes limit, including the header. Supporting SHA256 is straightforward, we just add it to the flags before adding the RSA algorithms. When sc_pkcs15_compute_signature() calls sc_get_encoding_flags(), the input will be "iFlags 0x202, card capabilities 0x8000021A" and the output will be "pad flags 0x0, secure algorithm flags 0x202". I.e. the hash is neither prepended by the DigestInfo header nor PKCS#1 padded and the hash algorithm is passed to gemsafe_set_security_env() which can send the appropriate algorithm reference 0x42 to the card. However there's a catch: Once we add SHA256 to the flags, PKCS#11 applications will be unable to use the other hashes like SHA1 or RIPEMD160. That's because register_mechanisms() checks if the card supports no hashes, and if so, adds all of them: if (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) { rsa_flags |= SC_ALGORITHM_RSA_HASHES; } We cannot add these missing hashes to the flags like we did with SHA256 because like SHA256, they would be sent to the card *without* DigestInfo header. What we want is to send all hashes *with* DigestInfo header, *except* for SHA256. We can achieve that by registering a fake RSA algorithm which includes the missing hashes in its flags. This fake algorithm is never used because sc_card_find_rsa_alg() searches the algorithm list in-order and we register the fake algorithm *after* the real algorithms. The fake algorithm persuades register_mechanisms() to register the missing hashes because it ORs the flags of all RSA algorithms together: num = card->algorithm_count; while (num--) { switch (alg_info->algorithm) { case SC_ALGORITHM_RSA: rsa_flags |= alg_info->flags; break; } } So when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature() calls sc_get_encoding_flags(), the input will be "iFlags 0x102, card capabilities 0x8000021A" and the output will be "pad flags 0x100, secure algorithm flags 0x2". This will result in the hash being prepended by the DigestInfo header, which is what we want. --- src/libopensc/card-gemsafeV1.c | 35 +++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/src/libopensc/card-gemsafeV1.c b/src/libopensc/card-gemsafeV1.c index be3ea5b5..28ba39a4 100644 --- a/src/libopensc/card-gemsafeV1.c +++ b/src/libopensc/card-gemsafeV1.c @@ -28,6 +28,11 @@ #include "asn1.h" #include "cardctl.h" +#define GEMSAFEV1_ALG_REF_FREEFORM 0x12 +#define GEMSAFEV3_ALG_REF_FREEFORM 0x02 +#define GEMSAFEV3_ALG_REF_SHA1 0x12 +#define GEMSAFEV3_ALG_REF_SHA256 0x42 + static struct sc_card_operations gemsafe_ops; static struct sc_card_operations *iso_ops = NULL; @@ -199,10 +204,27 @@ static int gemsafe_init(struct sc_card *card) flags |= SC_ALGORITHM_ONBOARD_KEY_GEN; flags |= SC_ALGORITHM_RSA_HASH_NONE; + /* GemSAFE V3 cards support SHA256 */ + if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID || + card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) + flags |= SC_ALGORITHM_RSA_HASH_SHA256; + _sc_card_add_rsa_alg(card, 512, flags, 0); _sc_card_add_rsa_alg(card, 768, flags, 0); _sc_card_add_rsa_alg(card, 1024, flags, 0); _sc_card_add_rsa_alg(card, 2048, flags, 0); + + /* fake algorithm to persuade register_mechanisms() + * to register these hashes */ + if (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID || + card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) { + flags = SC_ALGORITHM_RSA_HASH_SHA1; + flags |= SC_ALGORITHM_RSA_HASH_MD5; + flags |= SC_ALGORITHM_RSA_HASH_MD5_SHA1; + flags |= SC_ALGORITHM_RSA_HASH_RIPEMD160; + + _sc_card_add_rsa_alg(card, 512, flags, 0); + } } card->drv_data = exdata; @@ -363,15 +385,21 @@ static u8 gemsafe_flags2algref(struct sc_card *card, const struct sc_security_en u8 ret = 0; if (env->operation == SC_SEC_OPERATION_SIGN) { - if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1) + if (env->algorithm_flags & SC_ALGORITHM_RSA_HASH_SHA256) + ret = GEMSAFEV3_ALG_REF_SHA256; + else if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1) ret = (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID || - card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ? 0x02 : 0x12; + card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ? + GEMSAFEV3_ALG_REF_FREEFORM : + GEMSAFEV1_ALG_REF_FREEFORM; else if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_ISO9796) ret = 0x11; } else if (env->operation == SC_SEC_OPERATION_DECIPHER) { if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1) ret = (card->type == SC_CARD_TYPE_GEMSAFEV1_PTEID || - card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ? 0x02 : 0x12; + card->type == SC_CARD_TYPE_GEMSAFEV1_SEEID) ? + GEMSAFEV3_ALG_REF_FREEFORM : + GEMSAFEV1_ALG_REF_FREEFORM; } return ret; @@ -429,6 +457,7 @@ static int gemsafe_compute_signature(struct sc_card *card, const u8 * data, SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE); + /* the card can sign 36 bytes of free form data */ if (data_len > 36) { sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "error: input data too long: %lu bytes\n", data_len); return SC_ERROR_INVALID_ARGUMENTS;