[Opensc-commits] [OpenSC/OpenSC] 52d537: asn1.c don't use strict mode

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

  Branch: refs/heads/master
  Home:   https://github.com/OpenSC/OpenSC
  Commit: 52d5370c1e3bb1480d82f5f81cabdaf5767354a8
      https://github.com/OpenSC/OpenSC/commit/52d5370c1e3bb1480d82f5f81cabdaf5767354a8
  Author: Doug Engert <dee...@gm...>
  Date:   2020-05-09 (Sat, 09 May 2020)

  Changed paths:
    M src/libopensc/asn1.c

  Log Message:
  -----------
  asn1.c don't use strict mode

see:
https://github.com/OpenSC/OpenSC/issues/1995#issuecomment-607490809

 On branch cardos-5.3
 Changes to be committed:
	modified:   asn1.c

  Commit: f5fe292ae13687e722ec3167fec28e62e5aae3ab
      https://github.com/OpenSC/OpenSC/commit/f5fe292ae13687e722ec3167fec28e62e5aae3ab
  Author: Doug Engert <dee...@gm...>
  Date:   2020-05-09 (Sat, 09 May 2020)

  Changed paths:
    M src/tools/pkcs11-tool.c

  Log Message:
  -----------
  pkcs11-tool - use valid data for decription tests

In tests, make sute test data is either padded, or "zero" padded
so size if data <=  modlen - 11. The smallest pad in 11 bytes,
00 | NN | PS | 00. PS is at least 8 bytes.
"zero" padding has N = 00, PS >= 8 byte of 00.

 On branch cardos-5.3
 Changes to be committed:
	modified:   tools/pkcs11-tool.c

  Commit: 3f21dc57b73de829a69c99583916c55b97483da0
      https://github.com/OpenSC/OpenSC/commit/3f21dc57b73de829a69c99583916c55b97483da0
  Author: Doug Engert <dee...@gm...>
  Date:   2020-05-09 (Sat, 09 May 2020)

  Changed paths:
    M src/libopensc/pkcs15-prkey.c
    M src/libopensc/pkcs15-skey.c
    M src/libopensc/pkcs15.c
    M src/libopensc/types.h

  Log Message:
  -----------
  Increase SC_MAX_SUPPORTED_ALGORITHMS from 8 to 16

CardOS cards may have more then 8 supported_algo_info entries in tokenInfo.
We may bemissing some. We have seen 8 in some pkcs15-tool -i -v output.

Simple fix is to incrase the limit. More appropriate fix is to remove the limit,
much like is done with sc_algorithm_info. and use realloc of the array.

 On branch cardos-5.3
 Changes to be committed:
	modified:   src/libopensc/pkcs15-prkey.c
	modified:   src/libopensc/pkcs15-skey.c
	modified:   src/libopensc/pkcs15.c
	modified:   src/libopensc/types.h

  Commit: c03efeee405efe4810b6a35aad7f54c0c689205c
      https://github.com/OpenSC/OpenSC/commit/c03efeee405efe4810b6a35aad7f54c0c689205c
  Author: Doug Engert <dee...@gm...>
  Date:   2020-05-09 (Sat, 09 May 2020)

  Changed paths:
    M src/libopensc/opensc.h
    M src/libopensc/pkcs15.c

  Log Message:
  -----------
  sc_supported_algo_info - Put ECDSA OID as inline

    Mismatch of ASN1 parsing of tokeninfo.supported_algos[n].paramters
    in one place parameter was treated as a pointer to sc_object_id
    and in another as inline structure. This caused segfaults
    in pkcs15-tool when it tried to print the OID.

 Changes to be committed:
	modified:   src/libopensc/opensc.h
	modified:   src/libopensc/pkcs15.c

  Commit: 8a5a1435f1a7d1b22e3255d2726d8020c15a6658
      https://github.com/OpenSC/OpenSC/commit/8a5a1435f1a7d1b22e3255d2726d8020c15a6658
  Author: Doug Engert <dee...@gm...>
  Date:   2020-05-09 (Sat, 09 May 2020)

  Changed paths:
    M configure.ac
    M src/tools/Makefile.am
    M src/tools/Makefile.mak
    M src/tools/pkcs15-tool.c

  Log Message:
  -----------
  pkcs15-tool.c - print Supported_algorithms from tokenInfo

Some cards can provide supported algorithms in tokenInfo
which contain ECDSA OID, and PKCS11 mechanism

Don't know how many Algo_refs were actually read,
and a ref of 0 may be valid. print at least one Algo_refs.

Print the mechanism from PKCS11, and print operations
Use the $(top_srcdir)/src/pkcs11/pkcs11-display.c  on Unix
Use the $(TOPDIR)\src\pkcs11\pkcs11-display.obj on Windows

pkcs15.tool.c treat ECDSA OID as inline

pkcs15-tool prints PKCS11 mechanisms using pkcs11-display.c
Automake now warns that the default will change, in the future
so "[subdir-objects]" is added to configure.ac

 Changes to be committed:
	modified:   configure.ac
	modified:   src/tools/Makefile.am
	modified:   src/tools/Makefile.mak
	modified:   src/tools/pkcs15-tool.c

  Commit: db41cd9ab1033e0c63c894e2dcdd3da14edec3cf
      https://github.com/OpenSC/OpenSC/commit/db41cd9ab1033e0c63c894e2dcdd3da14edec3cf
  Author: Doug Engert <dee...@gm...>
  Date:   2020-05-09 (Sat, 09 May 2020)

  Changed paths:
    M src/libopensc/Makefile.am
    M src/libopensc/Makefile.mak
    M src/libopensc/card-cardos.c
    M src/libopensc/cardctl.h
    M src/libopensc/cards.h
    A src/libopensc/pkcs15-cardos.c
    M src/libopensc/pkcs15-syn.c
    M src/libopensc/pkcs15-syn.h

  Log Message:
  -----------
  Various CardOS V5_* improvements

Treat CardOS V5_0 and V5_3 cards differently then older versions:

Use card->dvr_data as a pointer to cardos_data_t to store private driver
data to pass internally, especially between set security environment
and the crypto operations. Sc_get_encoding_flags sets sec_flags from
algo_info->flags in pkcs15-sec.c and it passed to decipher.

Some cards when doing a decipher may drop leading 00 byte when
returning data from RSA_RAW decipher. Add leading byte(s) as needed.

Get Cryptographic Mechanism Reference from Key Reference:

Key reference byte appears to be a 4 bit Cryptographic Mechanism Reference
and a 4 bit key reference.

This is only done if key reference & 0xF0 != 0  i.e. default Cryptographic
mechanism reference is 0. which appears to be the case for RSA RAW.
PKCS1 appears to be 0x10 and ECDSA 0x30

    See iso 7816-4 table 55 for DST:
      84 Reference of a private key
      95 Usage qualifier byte - Table 57 - 40 looks OK
      80 Cryptographic mechanism reference and referes to section 9.2

The 4 bit key reference limits card to 16 keys. In future this may not work,
but we can derive a Cryptographic Mechanism Reference from what OpenSC
thinks the card needs to do. Only know RSA RAW, PKCS1 and ECDSA.

ECDSA code has not been tested, but expected to work.

Allow setting CardOS type and flags from opensc.conf using card_atr stanza
This is a fallback if newer cards are added or older cards have problems
giving us time to make need changes in next release.

It will help in identifying what flags are needed for each card.
As user can report what combination of flags work for them. They do this by
adding to opensc.conf with something like this. (Change the ATR to your card's ATR):

        card_atr 3b:d2:18:00:81:31:fe:58:c9:03:16 {
                driver = "cardos";
                # type is decimal from cards.h:
                # SC_CARD_TYPE_CARDOS_V5_0 is 1009
                # SC_CARD_TYPE_CARDOS_V5_3 is 1010
                type = 1010;

                # flags is hex from opensc.h:
                #define SC_ALGORITHM_ONBOARD_KEY_GEN    0x80000000
                #define SC_ALGORITHM_NEED_USAGE         0x40000000

                #define SC_ALGORITHM_RSA_RAW            0x00000001 /* RSA_RAW is PAD_NONE */
                #define SC_ALGORITHM_RSA_PAD_NONE       0x00000001
                #define SC_ALGORITHM_RSA_PAD_PKCS1      0x00000002 /* PKCS#1 v1.5 padding */
                #define SC_ALGORITHM_RSA_PAD_ANSI       0x00000004
                #define SC_ALGORITHM_RSA_PAD_ISO9796    0x00000008
                #define SC_ALGORITHM_RSA_PAD_PSS        0x00000010 /* PKCS#1 v2.0 PSS */
                #define SC_ALGORITHM_RSA_PAD_OAEP       0x00000020 /* PKCS#1 v2.0 OAEP */
                #define SC_ALGORITHM_RSA_HASH_NONE      0x00000100 /* only applies to PKCS1 padding */
                # example: SC_ALGORITHM_ONBOARD_KEY_GEN | SC_ALGORITHM_RSA_HASH_NONE |  SC_ALGORITHM_RSA_RAW
                flags = 80000101;
                #example: SC_ALGORITHM_ONBOARD_KEY_GEN | SC_ALGORITHM_RSA_PAD_PKCS1
                flags = 80000002;
        }

For V5_0 and v5_3 cards, use sc_get_max_send_size and sc_get_max_recv_size
which takes care or reader sizes even on Windows where SCardControl can not get PART_10 sizes.

(commit eddea6f3c2d3dafc2c09eba6695c745a61b5186f on Windows forces reader sizes to 255, 256
in reader-pcsc.c if not already set. It should not do this, but leave that up to card drivers.)

pkcs15-cardos.c added:

New file, pkcs15-cardos.c, added as emulation only for CardOS
V5_0 and V5_3 cards.

sc_pkcs15_bind_internal is called to get tokenInfo as CardOS
cards are substantially PKCS15 cards. But some V5_* cards have
errors in the tokenInfo, Which are corrected.

For older CardOS cards, card-cardos.c will create all the
card->algorithms.

Pkcs15-cardos.c will check for card->algorithms and if there
are none, it will do the following:

SC_CARDCTL_CARDOS_PASS_ALGO_FLAGS is called twice. First to get
the flags as set by user via opensc.conf card_atr or default
flags set by the card driver.  Then after determining from the
tokenInfo what algorithms the card can support, the new flags
are passed to card_cardos.c to create card->algorithms.

https://atos.net/wp-content/uploads/2018/11/CT_181026_LPM_CardOS_V5-3_Multifunctionality_FS_en3_web.pdf
says card supports: "“Command chaining” in accordance with ISO/IEC 7816-4"

To take advantage of this with older readers, max_send_size and max_recv_size
is now based on minimum of reader limits and  "data_field_length" from card.
This should allow card to work in older readers not capable of extended APDU.
So far current cards we have seen do no appear to support “Command chaining”.

 Changes to be committed:
	modified:   src/libopensc/Makefile.am
	modified:   src/libopensc/Makefile.mak
	modified:   src/libopensc/card-cardos.c
	modified:   src/libopensc/cardctl.h
	modified:   src/libopensc/cards.h
	new file:   src/libopensc/pkcs15-cardos.c
	modified:   src/libopensc/pkcs15-syn.c
	modified:   src/libopensc/pkcs15-syn.h

Compare: https://github.com/OpenSC/OpenSC/compare/797414be0522...db41cd9ab103

[Opensc-commits] [OpenSC/OpenSC] 52d537: asn1.c don't use strict mode

OpenSC - tools and libraries for smart cards

[Opensc-commits] [OpenSC/OpenSC] 52d537: asn1.c don't use strict mode