security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity

scd:piv: Allow signing using PSS. 

* scd/app-piv.c (do_sign): Allow for PSS.
--

This has been tested with Scute and Openvpn.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2020-08-10 10:22:03 +02:00
parent bb096905b9
commit cbf203801e
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
scd/app-piv.c
View File

@ -2284,6 +2284,14 @@ do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
indatalen -= oidbuflen;
}
}
else if (mechanism == PIV_ALGORITHM_RSA
&& indatalen == 2048/8 && indata[indatalen-1] == 0xBC)
{
/* If the provided data length matches the supported RSA
* framelen and the last octet of the data is 0xBC, we assume
* this is PSS formatted data and we use it verbatim; PIV cards
* accept PSS as well as PKCS#1. */
}
else if (mechanism == PIV_ALGORITHM_RSA)
{
/* PIV requires 2048 bit RSA. */
@ -2471,7 +2479,8 @@ do_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
* between AUTH and SIGN is that AUTH expects that pkcs#1.5 padding
* for RSA has already been done (digestInfo part w/o the padding)
* whereas SIGN may accept a plain digest and does the padding if
* needed. This is also the reason why SIGN takes a hashalgo. */
* needed. This is also the reason why SIGN takes a hashalgo. For
* both it is also acceptable to receive fully prepared PSS data. */
static gpg_error_t
do_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
gpg_error_t (*pincb)(void*, const char *, char **),