sc-hsm: Initialize card with public key auth

src/libopensc/card-sc-hsm.c

@@ -4,6 +4,7 @@
  * Driver for the SmartCard-HSM, a light-weight hardware security module
  *
  * Copyright (C) 2012 Andreas Schwier, CardContact, Minden, Germany, and others
+ * Copyright (C) 2018 GSMK - Gesellschaft für Sichere Mobile Kommunikation mbH
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -1235,7 +1236,7 @@ static int sc_hsm_initialize(sc_card_t *card, sc_cardctl_sc_hsm_init_param_t *pa
  int r;
  size_t tilen;
  sc_apdu_t apdu;
- u8 ibuff[64+0xFF], *p;
+ u8 ibuff[68+0xFF], *p;
 
  LOG_FUNC_CALLED(card->ctx);
 
@@ -1268,6 +1269,13 @@ static int sc_hsm_initialize(sc_card_t *card, sc_cardctl_sc_hsm_init_param_t *pa
  *p++ = (u8)params->dkek_shares;
  }
 
+ if (params->num_of_pub_keys > 0) {
+ *p++ = 0x93; // Use public key authentication
+ *p++ = 0x02;
+ *p++ = params->num_of_pub_keys; // Total number of public keys used for public authentication
+ *p++ = params->required_pub_keys; // Number of public keys required for authentication
+ }
+
  if (params->bio1.len) {
  *p++ = 0x95;
  *p++ = params->bio1.len;
@@ -1279,7 +1287,7 @@ static int sc_hsm_initialize(sc_card_t *card, sc_cardctl_sc_hsm_init_param_t *pa
  *p++ = params->bio2.len;
  memcpy(p, params->bio2.value, params->bio2.len);
  p += params->bio2.len;
- }
+ }
 
  sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, 0x50, 0x00, 0x00);
  apdu.cla = 0x80;

src/libopensc/cardctl.h

@@ -2,6 +2,7 @@
  * cardctl.h: card_ctl command numbers
  *
  * Copyright (C) 2003 Olaf Kirch <[email protected]>
+ * Copyright (C) 2018 GSMK - Gesellschaft für Sichere Mobile Kommunikation mbH
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -1021,6 +1022,8 @@ typedef struct sc_cardctl_sc_hsm_init_param {
  struct sc_aid bio2; /* AID of biometric server for template 2 */
  u8 options[2]; /* Initialization options */
  signed char dkek_shares; /* Number of DKEK shares, 0 for card generated, -1 for none */
+ signed char num_of_pub_keys; /* Total number of public keys used for public authentication (if > 0) */
+ u8 required_pub_keys; /* Number of public keys required for authentication (if public auth. is used) */
  char *label; /* Token label to be set in EF.TokenInfo (2F03) */
 } sc_cardctl_sc_hsm_init_param_t;
 

src/tools/sc-hsm-tool.c

@@ -573,15 +573,15 @@ static int initialize(sc_card_t *card, const char *so_pin, const char *user_pin,
  char *_so_pin = NULL, *_user_pin = NULL;
  int r;
 
- if (num_of_pub_keys != 1 && num_of_pub_keys < 1) {
+ if (num_of_pub_keys != -1 && num_of_pub_keys < 1) {
  fprintf(stderr, "Total number of public keys for authentication must be > 0\n");
  return -1;
  }
  if (required_pub_keys < 1) {
  fprintf(stderr, "Number of public keys required for authentication must be > 0\n");
  return -1;
  }
- if (required_pub_keys > num_of_pub_keys) {
+ if (num_of_pub_keys != -1 && required_pub_keys > num_of_pub_keys) {
  fprintf(stderr, "Required public keys must be <= total number of public keys\n");
  return -1;
  }
@@ -673,6 +673,8 @@ static int initialize(sc_card_t *card, const char *so_pin, const char *user_pin,
  }
 
  param.dkek_shares = (char)dkek_shares;
+ param.num_of_pub_keys = (char)num_of_pub_keys;
+ param.required_pub_keys = (u8)required_pub_keys;
  param.label = (char *)label;
 
  r = sc_card_ctl(card, SC_CARDCTL_SC_HSM_INITIALIZE, (void *)&param);