Attachment 317492 Details for Bug 463343 – ServerSide keygen on drm with nethsm fix

ServerSide keygen on drm with nethsm fix

ServerKeygen_hsm_dogtag.fix (text/plain), 3.00 KB, created by Christina Fu on 2008-09-23 16:54:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christina Fu

Created: 2008-09-23 16:54:59 UTC

Size: 3.00 KB

patch

obsolete

>Index: src/com/netscape/kra/NetkeyKeygenService.java
>===================================================================
>--- src/com/netscape/kra/NetkeyKeygenService.java	(revision 111)
>+++ src/com/netscape/kra/NetkeyKeygenService.java	(working copy)
>@@ -143,12 +143,57 @@
> 
>         CryptoToken token = mKRA.getKeygenToken();
> 	
>-	CMS.debug("NetkeyKeygenService: key pair is to be generated on slot: "+token.getName());
>+        CMS.debug("NetkeyKeygenService: key pair is to be generated on slot: "+token.getName());
>+
>+        /*
>+	       make it temporary so can work with HSM
>+           netHSM works with
>+              temporary == true
>+              sensitive == <do not specify>
>+              extractable == <do not specify>
>+           LunaSA2 works with
>+              temporary == true
>+              sensitive == true
>+              extractable == true
>+        */
>         KeyPairGenerator kpGen = token.getKeyPairGenerator(kpAlg);
>-	// make it temporary so can work with HSM
>-	kpGen.temporaryPairs(true);
>-    kpGen.sensitivePairs(true);
>-    kpGen.extractablePairs(true);
>+        IConfigStore config = CMS.getConfigStore();
>+        IConfigStore kgConfig = config.getSubStore("kra.keygen");
>+        boolean tp = false;
>+        boolean sp = false;
>+        boolean ep = false;
>+        if (kgConfig != null) {
>+          try {
>+            tp = kgConfig.getBoolean("temporaryPairs", false);
>+            sp = kgConfig.getBoolean("sensitivePairs", false);
>+            ep = kgConfig.getBoolean("extractablePairs", false);
>+            // by default, let nethsm work
>+            if ((tp == false) && (sp == false) && (ep == false)) {
>+                tp = true;
>+            }
>+          } catch (Exception e) {
>+	        CMS.debug("NetkeyKeygenService: kgConfig.getBoolean failed");
>+            // by default, let nethsm work
>+            tp = true;
>+          }
>+        } else {
>+            // by default, let nethsm work
>+            CMS.debug("NetkeyKeygenService: cannot find config store: kra.keygen, assume temporaryPairs==true");
>+            tp = true;
>+        }
>+        /* only specified to "true" will it be set */
>+        if (tp == true) {
>+	        CMS.debug("NetkeyKeygenService: setting temporaryPairs to true");
>+	        kpGen.temporaryPairs(true);
>+        }
>+        if (sp == true) {
>+	        CMS.debug("NetkeyKeygenService: setting sensitivePairs to true");
>+            kpGen.sensitivePairs(true);
>+        }
>+        if (ep == true) {
>+	        CMS.debug("NetkeyKeygenService: setting extractablePairs to true");
>+            kpGen.extractablePairs(true);
>+        }
>  
>         if (kpAlg == KeyPairAlgorithm.DSA) {
>             if (pqg == null) {
>@@ -161,9 +206,11 @@
>         }
> 
>         if (pqg == null) {
>-			KeyPair kp;
>+			KeyPair kp = null;
> 			synchronized (new Object()) {
>+                CMS.debug("NetkeyKeygenService: key pair generation begins");
>             	kp = kpGen.genKeyPair();
>+                CMS.debug("NetkeyKeygenService: key pair generation done");
> 				mKRA.addEntropy(true);
> 			}
> 			return kp;

Actions: View

Attachments on bug 463343: 317492 | 317493