security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-04-17 15:44:34 +02:00
Code Activity

Some implementations don't offer the information of key mechanisms.

Browse Source 
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
This commit is contained in:
NIIBE Yutaka 2023-02-24 14:50:41 +09:00
parent 88b832dfab
commit 34abc6cd9b
No known key found for this signature in database
GPG Key ID: 640114AF89DE6054
1 changed files with 52 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
tkd/pksign.c
View File

@ -101,6 +101,7 @@ struct key {
unsigned char id[256]; unsigned char id[256];
unsigned long id_len; unsigned long id_len;
/* Allowed mechanisms??? */ /* Allowed mechanisms??? */
ck_mechanism_type_t mechanism;
}; };
struct token { struct token {
@ -309,14 +310,6 @@ examine_public_key (struct token *token, struct key *k, unsigned long keytype,
unsigned long mechanisms[3]; unsigned long mechanisms[3];
int i; int i;
/* Yubkey YKCS doesn't offer CKA_ALLOWED_MECHANISMS,
unfortunately. */
#if 0
templ[0].type = CKA_ALLOWED_MECHANISMS;
templ[0].pValue = (void *)mechanisms;
templ[0].ulValueLen = sizeof (mechanisms);
#endif
if (keytype == CKK_RSA) if (keytype == CKK_RSA)
{ {
k->valid = 1; k->valid = 1;
@ -355,6 +348,8 @@ examine_public_key (struct token *token, struct key *k, unsigned long keytype,
modulus, templ[0].ulValueLen, modulus, templ[0].ulValueLen,
exponent, templ[1].ulValueLen); exponent, templ[1].ulValueLen);
puts (k->keygrip); puts (k->keygrip);
k->mechanism = CKM_RSA_PKCS;
} }
else if (keytype == CKK_EC) else if (keytype == CKK_EC)
{ {
@ -394,6 +389,33 @@ examine_public_key (struct token *token, struct key *k, unsigned long keytype,
puts (curve); puts (curve);
compute_keygrip_ec (k->keygrip, curve, ecpoint, templ[1].ulValueLen); compute_keygrip_ec (k->keygrip, curve, ecpoint, templ[1].ulValueLen);
puts (k->keygrip); puts (k->keygrip);
templ[0].type = CKA_ALLOWED_MECHANISMS;
templ[0].pValue = (void *)mechanisms;
templ[0].ulValueLen = sizeof (mechanisms);
err = ck->f->C_GetAttributeValue (token->session, obj, templ, 1);
if (!err)
{
if (templ[0].ulValueLen)
{
/* Scute works well. */
printf ("mechanism: %x %d\n", mechanisms[0], templ[0].ulValueLen);
k->mechanism = mechanisms[0];
}
else
{
puts ("SoftHSMv2???");
k->mechanism = CKM_ECDSA;
}
}
else
{
/* Yubkey YKCS doesn't offer CKA_ALLOWED_MECHANISMS,
unfortunately. */
puts ("Yubikey???");
k->mechanism = CKM_ECDSA_SHA256;
}
} }
return 0; return 0;
@ -543,7 +565,7 @@ check_public_keys (struct token *token)
&& memcmp (label, k->label, k->label_len) == 0 && memcmp (label, k->label, k->label_len) == 0
&& ((keytype == CKK_RSA && k->key_type == KEY_RSA) && ((keytype == CKK_RSA && k->key_type == KEY_RSA)
|| (keytype == CKK_EC && k->key_type == KEY_EC)) || (keytype == CKK_EC && k->key_type == KEY_EC))
&& k->id_len == templ[0].ulValueLen && k->id_len == templ[2].ulValueLen
&& memcmp (id, k->id, k->id_len) == 0) && memcmp (id, k->id, k->id_len) == 0)
break; break;
} }
@ -714,6 +736,7 @@ do_pksign (struct key *key,
unsigned char data[1024]; unsigned char data[1024];
unsigned long data_len; unsigned long data_len;
mechanism = key->mechanism;
if (key->key_type == KEY_RSA) if (key->key_type == KEY_RSA)
{ {
size_t asnlen = sizeof (data); size_t asnlen = sizeof (data);
@ -722,11 +745,23 @@ do_pksign (struct key *key,
gcry_md_hash_buffer (GCRY_MD_SHA256, data+asnlen, gcry_md_hash_buffer (GCRY_MD_SHA256, data+asnlen,
u_data, u_data_len); u_data, u_data_len);
data_len = asnlen+gcry_md_get_algo_dlen (GCRY_MD_SHA256); data_len = asnlen+gcry_md_get_algo_dlen (GCRY_MD_SHA256);
mechanism = CKM_RSA_PKCS;
} }
else if (key->key_type == KEY_EC) else if (key->key_type == KEY_EC)
mechanism = CKM_ECDSA_SHA256; {
if (mechanism == CKM_ECDSA)
{
/* SoftHSMv2 */
memcpy (data, u_data, u_data_len);
data_len = u_data_len;
}
else
{
/* Scute, YKCS11 */
/* XXX: check hash algo and dispatch */
gcry_md_hash_buffer (GCRY_MD_SHA256, data, u_data, u_data_len);
data_len = gcry_md_get_algo_dlen (GCRY_MD_SHA256);
}
}
else if (key->key_type == KEY_EDDSA) else if (key->key_type == KEY_EDDSA)
mechanism = CKM_EDDSA; mechanism = CKM_EDDSA;
@ -736,6 +771,11 @@ do_pksign (struct key *key,
err = ck->f->C_SignInit (token->session, &mechanism_struct, err = ck->f->C_SignInit (token->session, &mechanism_struct,
key->p11_keyid); key->p11_keyid);
if (err)
{
printf ("C_SignInit error: %d", err);
return err;
}
err = ck->f->C_Sign (token->session, err = ck->f->C_Sign (token->session,
data, data_len, data, data_len,