sc-hsm-tool: Add options to initialize with public key authentication #2301
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 task
frankmorgner
requested changes
Apr 20, 2021
src/libopensc/pkcs15-sc-hsm.c
Outdated
| { | ||
| assert(asn1_cvc_pubkey_len >= C_ASN1_CVC_PUBKEY_SIZE); | ||
| assert(asn1_cvc_body_len >= C_ASN1_CVC_BODY_SIZE); | ||
| assert(asn1_cvcert_len >= C_ASN1_CVCERT_SIZE); |
There was a problem hiding this comment.
please avoid assert and use return; (and maybe debug output) instead
There was a problem hiding this comment.
changed to return an error that gets propagated through
charredlot
force-pushed
the
pka
branch
2 times, most recently
from
7642a87
to
3f58e36
Compare
frankmorgner
requested changes
Apr 21, 2021
This reverts commit a98d1c5.
This is mainly to make future parsing of sc_cvc_t easier by providing storage for the lengths.
The outerSignature may be allocated.
Before parsing, sc_pkcs15emu_sc_hsm_decode_cvc sets up sc_asn1_entry structs to match the expected ASN.1 format and populate the sc_cvc_t struct. Extract the struct setup code so it can be reused for parsing other SmartCard HSM formats in the future.
For public key authentication, SmartCard HSMs have two
formats for exporting the public key:
1. Older format
SEQUENCE (0x30)
authenticatedrequest for public key details (0x67)
...
device CVC (0x7F21)
...
device issuer CA CVC (0x7F21)
...
2. Newer format (e.g. if exported from scsh3)
SEQUENCE (0x30)
OID (0x6) 1.3.6.1.4.1.24991.4.3.1
Application 1 (0x61)
device CVC (0x7F21)
...
Application 2 (0x62)
device issuer CA CVC (0x7F21)
...
Application 3 (0x63)
authenticatedrequest for public key details (0x67)
...
- Add a function to parse these two formats
- Use asn1 callbacks to save a pointer to portions of
the file. The HSM commands will require the ASN.1-encoded
cert bodies.
- Remove get_CAR and get_CHR functions - Remove parsing from sc-hsm-tool.c - Pass the entire file through sc_card_ctl for parsing by the functions in pkcs15-sc-hsm.c - Tweak sc_hsm_register_public_key to parse the public key file into its components and use those results - Tweak verify_certificate to use the parsed sc_cvc_t - Return the public key authentication (PKA) status in the sc_card_ctl argument for sc-hsm-tool.c to print.
card-sc-hsm should quietly return the info and let the caller (in this case, sc-hsm-tool) display it to the user.
LOLSOR23
approved these changes
Aug 8, 2021
Jakuje
approved these changes
Aug 24, 2021
|
Looks good to me. I think we should be fine merging this unless there would be some more comments. |
frankmorgner
approved these changes
Aug 31, 2021
|
Congrats on this, looking forward to testing this in 0.23.0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR rebases #1711 and reworks the CVC decoding per suggestions.
Tested on Nitrokey HSM 2 (SmartCard-HSM)
Checklist