Hide Forgot
+++ This bug was initially created as a clone of Bug #1001299 +++ Description of problem: Now that we can make ECC signatures, this requires often that the signature data has to be padded or truncated correctly based on what is returned by the card and what is required by NSS. We already have a method to do this but it only handles the truncation case, not the padding case. Version-Release number of selected component (if applicable): Latest rhel5 coolkey How reproducible: Always. Steps to reproduce. 1. Enroll a 384 bit or higher token with rhcs ecc upcoming errata candidate. 2. Run BobR's smartcard test program. Actual results: Some of the signatures attempted by the tool will fail. Expected results: We want all support signature types to be performed correctly. --- Additional comment from Suzanne Forsberg on 2013-08-29 10:22:57 EDT --- Since 5.10 is only accepting blocker bugs at this point(they have already built a release candidate), I am recommending that we defer this fix until 5.11 and we consider fixing this in 5.10.z. --- Additional comment from Bob Relyea on 2013-11-26 20:36:03 EST --- Jack please clone this bug for RHEL6 (target 6.6) and RHEL 7
running smartcard tests I get: bobslaptop.local(78) smartcard Running Smart Card tests... Starting thread for Module NSS Internal Crypto Services Starting thread for Module CoolKey PKCS #11 Module Waiting for card insert SmartCardThread for NSS Internal Crypto Services started SmartCardThread for CoolKey PKCS #11 Module started event for slot NSS Application Slot 00000004 insert NSS system database into slot NSS Application Slot 00000004 Found Smart cart NSS system database. running Tests event for slot OmniKey CardMan 3121 00 00 insert jmagne into slot OmniKey CardMan 3121 00 00 -----Found Cert 1: CN=Test ECC P-256 CA for Test PIV Cards,OU=Test CA,O=Test Certificates 2010,C=US -Not a user cert, skipping key tests -----Found Cert 2: CN=Test ECC P-384 CA for Test PIV Cards,OU=Test CA,O=Test Certificates 2010,C=US -Not a user cert, skipping key tests -----Found Cert 3: CN=Test RSA 2048-bit CA for Test PIV Cards,OU=Test CA,O=Test Certificates 2010,C=US -Not a user cert, skipping key tests -----Found Cert 4: CN=Test PIV-I RSA 2048-bit CA for Test PIV Cards,OU=Test CA,O=Test Certificates 2010,C=US -Not a user cert, skipping key tests -----Found Cert 5: CN=Test RSA 3072-bit CA for Test PIV Cards,OU=Test CA,O=Test Certificates 2010,C=US -Not a user cert, skipping key tests -----Found Cert 6: CN=Test Trust Anchor for Test PIV Cards,OU=Test CA,O=Test Certificates 2010,C=US -Not a user cert, skipping key tests -----Found Cert 7: CN=DOD CLASS 3 JITC CA-9,OU=PKI,OU=DoD,O=U.S. Government,C=US -Not a user cert, skipping key tests -----Found Cert 8: CN=DOD JITC CA-23,OU=PKI,OU=DoD,O=U.S. Government,C=US -Not a user cert, skipping key tests -----Found Cert 9: CN=DOD JITC CA-19,OU=PKI,OU=DoD,O=U.S. Government,C=US -Not a user cert, skipping key tests Waiting for card insert Found Smart cart jmagne. running Tests Password for jmagne? -----Found Cert 1: UID=jmagne,O=Token Key User KeyType: ECC CertID [1] = 01 KeyID [1] = 01 Key can sign.. Testing Signing signature len = 96 signing with SHA1 length = 20 signature length = 96 sign with SHA1 test succeeded signing with SHA224 length = 28 signature length = 96 sign with SHA224 test succeeded signing with SHA256 length = 32 signature length = 96 sign with SHA256 test succeeded signing with SHA384 length = 48 signature length = 96 sign with SHA384 test succeeded signing with SHA512 length = 64 signature length = 96 sign with SHA512 test succeeded **signing test succeeded -----Found Cert 2: UID=jmagne,O=Token Key User KeyType: ECC CertID [1] = 02 KeyID [1] = 02 Key can do key agreement... Testing key agreement Key [32] = ac f8 00 14 e8 7d 2f 63 bc ca 8b a3 c8 c9 56 1b cc 58 01 44 4e ec 1d 83 1e 0e 52 2c bb 6e 9b 10 Key2 [32] = ac f8 00 14 e8 7d 2f 63 bc ca 8b a3 c8 c9 56 1b cc 58 01 44 4e ec 1d 83 1e 0e 52 2c bb 6e 9b 10 **derive test succeeded Waiting for card insert NOTE that the SHA384 token was able to sign with SHA512, which seems to indicate that this is already fixed in RHEL-6.5. coolkey-1.1.0-31.el6.x86_64 bob
Also tested ECC 256 coolkey from Jack, and it works. So I'm closing this WORKSFORME. If we find a new card that it doesn't work on we can reopen this bug. Found Smart cart jmagne. running Tests Password for jmagne? -----Found Cert 1: UID=jmagne,O=Token Key User KeyType: ECC CertID [1] = 01 KeyID [1] = 01 Key can sign.. Testing Signing signature len = 64 signing with SHA1 length = 20 signature length = 64 sign with SHA1 test succeeded signing with SHA224 length = 28 signature length = 64 sign with SHA224 test succeeded signing with SHA256 length = 32 signature length = 64 sign with SHA256 test succeeded signing with SHA384 length = 48 signature length = 64 sign with SHA384 test succeeded signing with SHA512 length = 64 signature length = 64 sign with SHA512 test succeeded **signing test succeeded