opensc-devel Mailing List for OpenSC (Page 28)

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi again,

thanks for your suggestions!
I took another look at this, but I did not find a nice solution to pass the information of the modlen 
to the lower layers without having to change the API, which would probably be too much of a hazzle for everyone else.

But what about checking the returned length in sc_pkcs15_compute_signature itself? By this we'd still make the 
entire outlen available to the drivers (in case someone needs more than modlen e.g. for temporary data), and would only
alter something if the retured data is less than modlen (but no error code), which to my understanding would 
always be unwanted behavior.
 
The modified patch looks like this:

diff --git a/src/libopensc/pkcs15-sec.c b/src/libopensc/pkcs15-sec.c
index 019d8a1..9c78acb
--- a/src/libopensc/pkcs15-sec.c
+++ b/src/libopensc/pkcs15-sec.c
@@ -433,6 +433,14 @@ int sc_pkcs15_compute_signature(struct sc_pkcs15_card *p15card,
 
        r = use_key(p15card, obj, &senv, sc_compute_signature, tmp, inlen,
                        out, outlen);
+
+       if (r >= 0 && (size_t)r < modlen) // returned size smaller than expected, add leading zeros
+       {
+               memmove(out + (modlen -r ), out, r); /* overlapping */
+               memset(out, 0, modlen -r );
+               r = modlen;
+       }
+
        LOG_TEST_RET(ctx, r, "use_key() failed");

 
This is working fine for me, I tested it with about 10000 different input strings, but obviously just with my card and
with this one use case.



Gesendet: Montag, 22. Februar 2016 um 19:16 Uhr
Von: "Douglas E Engert" <dee...@gm...>
An: ope...@li...
Betreff: Re: [Opensc-devel] Bad signature generated by pkcs15-crypt ?
On 2/22/2016 9:51 AM, Joe...@we... wrote:
> Thanks for providing this patch, with this I got it _almost_ working :-)
> I ran into one real and two minor issues:
> 1) The real issue is that the outlen does not seem to be the expected signature length,
> but the size of the buffer with some extra space. In my case it is 1024 and not the expected
> 512, so this does not work. But I guess it would be possible to compute the expected signature
> length in a general way?

sc_pkcs15_compute_signature set modlen lines 324-336 from the type of key and its size, then tests if outlen is big enough:

339 if (inlen > sizeof(buf) || outlen < modlen)

But then it passes to lower levels, it passes outlen:

434 r = use_key(p15card, obj, &senv, sc_compute_signature, tmp, inlen,
435 out, outlen);

In all cases other then the card you have this is not a problem.

So one possible fix is to set line 435 to:
out, modlen);
then do the memmove stuff if its too short.

BUT THIS IS A GLOBAL CHANGE, and would need testing for other cards. I don't see why it would be an issue,
but you never know...

If you try and do an openpgp only fix, it looks like by the time pgp_set_security_env and pgp_compute_signature
are called, they size of the key is not known, just the outlen. Som info cold be saved in the

Another way: card-openpgp.c only supports RSA. And only 4K, 2K and maybe 1K keys are used.
So if apdu.resplen within 4 bytes of one of these values, assume it is dropped 1, 2, 3 or 4 bytes,
and do the memmove stuff then. (Not perfect, but chance of failure to catch a short signature is 1/2^32)

There may be more info in the OpenPGP documents that would show how to save the key size internally
in one of the card-openpgp.c internal structures.


> 2) Minor techical issues: the apdu was not updated in the end to return the new length,
> and src and dest were mixed up in the memmove

OK, I never tested the code. good to here you got it working.

> With this hacked up version of your patch I was able to get a valid signature :-) , but obviously it works only
> for exactly my usecase with at most one leading zero:
> --- a/src/libopensc/card-openpgp.c
> +++ b/src/libopensc/card-openpgp.c
> @@ -1656,6 +1656,13 @@ pgp_compute_signature(sc_card_t *card, const u8 *data,
> r = sc_check_sw(card, apdu.sw1, apdu.sw2);
> LOG_TEST_RET(card->ctx, r, "Card returned error");
>
> + /* some cards may drop leading 0x00 byte on a signature */
> + if (apdu.resplen < 512) {
> + memmove(out + 1 , out, apdu.resplen); /* overlaping */
> + memset(out, 0, 1);
> + apdu.resplen = 512;
> + }
> +
> *Gesendet:* Sonntag, 21. Februar 2016 um 20:54 Uhr
> *Von:* "Douglas E Engert" <dee...@gm...>
> *An:* ope...@li...
> *Betreff:* Re: [Opensc-devel] Bad signature generated by pkcs15-crypt ?
> The patch I sent you has a bug:
>
> memmove(out, out -(outlen - apdu.resplen), apdu.resplen); /* overlaping */
> should be:
>
> memmove(out, out + (outlen - apdu.resplen), apdu.resplen); /* overlaping */
>
>
> I have not tried the patch.
>
> On 2/21/2016 7:53 AM, Douglas E Engert wrote:
>
> > Try the attache patch. It is against http:/github.com/OpenSC/OpenSC
> >
>
>
> --
>
> Douglas E. Engert <DEE...@gm...>
>
>
> ------------------------------------------------------------------------------
> Site24x7 APM Insight: Get Deep Visibility into Application Performance
> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
> Monitor end-to-end web transactions and take corrective actions now
> Troubleshoot faster and improve end-user experience. Signup Now!
> http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel[https://lists.sourceforge.net/lists/listinfo/opensc-devel]
>
>
> ------------------------------------------------------------------------------
> Site24x7 APM Insight: Get Deep Visibility into Application Performance
> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
> Monitor end-to-end web transactions and take corrective actions now
> Troubleshoot faster and improve end-user experience. Signup Now!
> http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140[http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140]
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opensc-devel[https://lists.sourceforge.net/lists/listinfo/opensc-devel]
>

--

Douglas E. Engert <DEE...@gm...>


------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140[http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140]
_______________________________________________
Opensc-devel mailing list
Ope...@li...
https://lists.sourceforge.net/lists/listinfo/opensc-devel[https://lists.sourceforge.net/lists/listinfo/opensc-devel]




2012	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec (1)
2013	Jan (26)	Feb (64)	Mar (78)	Apr (36)	May (51)	Jun (40)	Jul (43)	Aug (102)	Sep (50)	Oct (71)	Nov (42)	Dec (29)
2014	Jan (49)	Feb (52)	Mar (56)	Apr (30)	May (31)	Jun (52)	Jul (76)	Aug (19)	Sep (82)	Oct (95)	Nov (58)	Dec (76)
2015	Jan (135)	Feb (43)	Mar (47)	Apr (72)	May (59)	Jun (20)	Jul (17)	Aug (14)	Sep (34)	Oct (62)	Nov (48)	Dec (23)
2016	Jan (18)	Feb (55)	Mar (24)	Apr (20)	May (33)	Jun (29)	Jul (18)	Aug (15)	Sep (8)	Oct (21)	Nov (5)	Dec (23)
2017	Jan (3)	Feb	Mar (17)	Apr (4)	May	Jun (5)	Jul (1)	Aug (20)	Sep (17)	Oct (21)	Nov	Dec (3)
2018	Jan (62)	Feb (4)	Mar (4)	Apr (20)	May (16)	Jun	Jul (1)	Aug (9)	Sep (3)	Oct (11)	Nov	Dec (9)
2019	Jan (1)	Feb (1)	Mar (2)	Apr	May	Jun	Jul	Aug	Sep (2)	Oct (5)	Nov	Dec (5)
2020	Jan (11)	Feb (14)	Mar (7)	Apr	May	Jun (3)	Jul (3)	Aug (6)	Sep (2)	Oct (15)	Nov (11)	Dec (7)
2021	Jan (14)	Feb (21)	Mar (3)	Apr (1)	May (1)	Jun	Jul (1)	Aug (1)	Sep (3)	Oct	Nov	Dec
2022	Jan	Feb (1)	Mar	Apr	May	Jun (2)	Jul	Aug	Sep	Oct (4)	Nov (12)	Dec
2023	Jan (2)	Feb (4)	Mar	Apr (8)	May	Jun (2)	Jul	Aug (3)	Sep (1)	Oct	Nov (1)	Dec (1)
2024	Jan	Feb (2)	Mar (6)	Apr (1)	May	Jun (2)	Jul	Aug	Sep (1)	Oct	Nov (4)	Dec
2025	Jan (1)	Feb	Mar	Apr (5)	May	Jun	Jul (11)	Aug	Sep	Oct	Nov	Dec

opensc-devel Mailing List for OpenSC (Page 28)

OpenSC - tools and libraries for smart cards

opensc-devel — discussion of developement of OpenSC and related projects