Bug 1701233

Summary:

[RFE] support setting supported signature methods on the token

Product:

Red Hat Enterprise Linux 8

Reporter:

Alicja Kario <hkario>

Component:

softhsm

Assignee:

Alexander Bokovoy <abokovoy>

Status:

CLOSED ERRATA

QA Contact:

Kaleem <ksiddiqu>

Severity:

low

Docs Contact:

Priority:

high

Version:

8.0

CC:

jjelen, pasik, pcech, szidek

Target Milestone:

Keywords:

FutureFeature, Triaged

Target Release:

8.0

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

softhsm-2.6.0-1.el8

Doc Type:

If docs needed, set a value

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2020-11-04 02:50:13 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

Bug Blocks:

1681006, 1681045, 1681178, 1681274, 1681278, 1685470, 1711438

Attachments:

Description	Flags
verification steps with console output	none

Description Alicja Kario 2019-04-18 12:54:32 UTC

Description of problem:
It's not possible to create a PKCS#11 token that will support only specific RSA signature methods (e.g. only "RSA-PKCS#1 v1.5" or only "rsassa-pss", without raw RSA).

Additional info:
This is necessary to test fallback mechanism in TLS libraries, as RSA-PSS signatures are mandatory in TLS 1.3, but not all hardware PKCS#11 tokens support them.

Comment 4 Kaleem 2020-03-31 07:14:41 UTC

Hubert,

How this change can be tested?

Comment 5 Jakub Jelen 2020-03-31 11:13:44 UTC

(In reply to Kaleem from comment #4)
> Hubert,
> 
> How this change can be tested?

Part of the upstream pull request is a test, which is invoked with `make check`. If you want a downstream test for this particular use case, you can start with the upstream configuration file for reference (token.mechanisms is the new configuration option):

https://github.com/opendnssec/SoftHSMv2/pull/455/files#diff-a6a5b67fa56bb9bc79e2bd033854b5f1

When you will have inititialized softhsm2 token, you can use pkcs11-tool to list supported mechanisms of the pkcs11 module.

pkcs11-tool -M --module /path/to/libsofthsm2.so

By default, there will be lots of mechanisms. You can try to remove some by specifying them in the above option prefixed with "-" (as described in manual page, which is also updated in this PR), or specify just limited list, which should be reflected in the list reported in pkcs11-tool.

Comment 6 Alexander Bokovoy 2020-04-01 06:28:43 UTC

Sorry, this is RHEL8 bugzilla, mixed up with RHEL7 one.

Comment 7 Alexander Bokovoy 2020-04-01 07:11:33 UTC

Will be fixed in idm:DL1 module stream build that includes softhsm-2.6.0-1.el8

Comment 12 Kaleem 2020-07-17 11:04:07 UTC

Created attachment 1701538 [details]
verification steps with console output

Comment 13 Kaleem 2020-07-17 11:05:41 UTC

Verified based on test execution done and console output attached for same in https://bugzilla.redhat.com/show_bug.cgi?id=1701233#c12 

[root@master tokens]# rpm -q softhsm
softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d.x86_64
[root@master tokens]# 

For negative option, reported a bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1857272

Comment 17 errata-xmlrpc 2020-11-04 02:50:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4670