scd: Allow generating ECC curves on PIV cards.

* scd/app-piv.c (genkey_parse_ecc): New.
(get_keygrip_by_tag): Call that one.
(do_readkey): Call that one.
* scd/command.c (cmd_genkey): Add option --algo.

Signed-off-by: Werner Koch <wk@gnupg.org>

scd/app-piv.c

@@ -178,6 +178,8 @@ static gpg_error_t get_keygrip_by_tag (app_t app, unsigned int tag,
                                        char **r_keygripstr, int *got_cert);
 static gpg_error_t genkey_parse_rsa (const unsigned char *data, size_t datalen,
                                      gcry_sexp_t *r_sexp);
+static gpg_error_t genkey_parse_ecc (const unsigned char *data, size_t datalen,
+                                     int mechanism, gcry_sexp_t *r_sexp);
 
 
 
@@ -1144,6 +1146,9 @@ get_keygrip_by_tag (app_t app, unsigned int tag,
     {
       if (mechanism == PIV_ALGORITHM_RSA)
         err = genkey_parse_rsa (certbuf, certbuflen, &s_pkey);
+      else if (mechanism == PIV_ALGORITHM_ECC_P256
+               || mechanism == PIV_ALGORITHM_ECC_P384)
+        err = genkey_parse_ecc (certbuf, certbuflen, mechanism, &s_pkey);
       else
         err = gpg_error (GPG_ERR_PUBKEY_ALGO);
       if (err)
@@ -1308,6 +1313,9 @@ do_readkey (app_t app, int advanced, const char *keyrefstr,
   /* Convert the public key into the expected s-expression.  */
   if (mechanism == PIV_ALGORITHM_RSA)
     err = genkey_parse_rsa (cert, certlen, &s_pkey);
+  else if (mechanism == PIV_ALGORITHM_ECC_P256
+           || mechanism == PIV_ALGORITHM_ECC_P384)
+    err = genkey_parse_ecc (cert, certlen, mechanism, &s_pkey);
   else
     err = gpg_error (GPG_ERR_PUBKEY_ALGO);
   if (err)
@@ -2155,6 +2163,48 @@ genkey_parse_rsa (const unsigned char *data, size_t datalen,
 }
 
 
+/* Parse an ECC response object, consisting of the content of tag
+ * 0x7f49, into a gcrypt s-expression object and store that R_SEXP.
+ * On error NULL is stored at R_SEXP.  MECHANISM specifies the
+ * curve.  */
+static gpg_error_t
+genkey_parse_ecc (const unsigned char *data, size_t datalen, int mechanism,
+                  gcry_sexp_t *r_sexp)
+{
+  gpg_error_t err;
+  const unsigned char *ecc_q;
+  size_t ecc_qlen;
+  const char *curve;
+
+  *r_sexp = NULL;
+
+  ecc_q = find_tlv (data, datalen, 0x0086, &ecc_qlen);
+  if (!ecc_q)
+    {
+      log_error (_("response does not contain the EC public key\n"));
+      err = gpg_error (GPG_ERR_CARD);
+      goto leave;
+    }
+
+  if (mechanism == PIV_ALGORITHM_ECC_P256)
+    curve = "nistp256";
+  else if (mechanism == PIV_ALGORITHM_ECC_P384)
+    curve = "nistp384";
+  else
+    {
+      err = gpg_error (GPG_ERR_BUG); /* Call with wrong parameters.  */
+      goto leave;
+    }
+
+
+  err = gcry_sexp_build (r_sexp, NULL, "(public-key(ecc(curve%s)(q%b)))",
+                         curve, (int)ecc_qlen, ecc_q);
+
+ leave:
+  return err;
+}
+
+
 /* Create a new keypair for KEYREF.  If KEYTYPE is NULL a default
  * keytype is selected, else it may be one of the strings:
  *  "rsa2048", "nistp256, or "nistp384".
@@ -2303,6 +2353,9 @@ do_writecert (app_t app, ctrl_t ctrl,
 
   /* FIXME: Check that the authentication has already been done.  */
 
+  /* FIXME: Check that the public key parameters from the certificate
+   * match an already stored key.  */
+
   flush_cached_data (app, dobj->tag);
   err = put_data (app->slot, dobj->tag,
                   (int)0x70, (size_t)certlen, cert,/* Certificate */

scd/command.c

@@ -1126,10 +1126,10 @@ cmd_writekey (assuan_context_t ctx, char *line)
 
 
 static const char hlp_genkey[] =
-  "GENKEY [--force] [--timestamp=<isodate>] <no>\n"
+  "GENKEY [--force] [--timestamp=<isodate>] <keyref>\n"
   "\n"
-  "Generate a key on-card identified by NO, which is application\n"
+  "Generate a key on-card identified by <keyref>, which is application\n"
-  "specific.  Return values are application specific.  For OpenPGP\n"
+  "specific.  Return values are also application specific.  For OpenPGP\n"
   "cards 3 status lines are returned:\n"
   "\n"
   "  S KEY-FPR  <hexstring>\n"
@@ -1154,10 +1154,12 @@ static gpg_error_t
 cmd_genkey (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
-  int rc;
+  gpg_error_t err;
-  char *keyno;
+  char *keyref_buffer = NULL;
+  char *keyref;
   int force;
   const char *s;
+  char *opt_algo = NULL;
   time_t timestamp;
 
   force = has_option (line, "--force");
@@ -1173,30 +1175,38 @@ cmd_genkey (assuan_context_t ctx, char *line)
   else
     timestamp = 0;
 
+  err = get_option_value (line, "--algo", &opt_algo);
+  if (err)
+    goto leave;
 
   line = skip_options (line);
   if (!*line)
     return set_error (GPG_ERR_ASS_PARAMETER, "no key number given");
-  keyno = line;
+  keyref = line;
   while (*line && !spacep (line))
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl)))
+  if ((err = open_card (ctrl)))
-    return rc;
+    goto leave;
 
   if (!ctrl->app_ctx)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
-  keyno = xtrystrdup (keyno);
+  keyref = keyref_buffer = xtrystrdup (keyref);
-  if (!keyno)
+  if (!keyref)
-    return out_of_core ();
+    {
-  rc = app_genkey (ctrl->app_ctx, ctrl, keyno, NULL,
+      err = gpg_error_from_syserror ();
-                   force? APP_GENKEY_FLAG_FORCE : 0,
+      goto leave;
-                   timestamp, pin_cb, ctx);
+    }
-  xfree (keyno);
+  err = app_genkey (ctrl->app_ctx, ctrl, keyref, opt_algo,
+                    force? APP_GENKEY_FLAG_FORCE : 0,
+                    timestamp, pin_cb, ctx);
 
-  return rc;
+ leave:
+  xfree (keyref_buffer);
+  xfree (opt_algo);
+  return err;
 }