Bug 1775673
| Summary: | RSA-PKCS-PSS signatures do not seem to work with PIV Cards | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Jakub Jelen <jjelen> |
| Component: | opensc | Assignee: | Jakub Jelen <jjelen> |
| Status: | CLOSED ERRATA | QA Contact: | PKI QE <bugzilla-pkiqe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.4 | CC: | aakkiang, sveerank |
| Target Milestone: | rc | Keywords: | Regression, Triaged |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | opensc-0.19.0-7.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:52:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jakub Jelen
2019-11-22 14:49:29 UTC
Interestingly enough, it looks like the same works for me with current Fedora package. It also works with opensc-0.19.0-5.el8.x86_64 (RHEL 8.1 package) so it is some regression in the latest update, which I accidentally hit. Adding acks and triage and I will investigate it further as it needs to get fixed. The fix addressing this issue is available now in the upstream PR with the other IDPrime changes (adding support for OAEP modes supported by this card). https://github.com/OpenSC/OpenSC/commit/6593dc9b I will provide a new build fixing this issue as soon as I will get acks. Asha? Tested as below following the test steps from https://bugzilla.redhat.com/show_bug.cgi?id=1595626#c11 Jakub Jelen, please let me know if this looks alright. # cat /etc/redhat-release Red Hat Enterprise Linux release 8.2 Beta (Ootpa) # rpm -qa opensc opensc-0.19.0-7.el8.x86_64 [root@xxx ~]# pkcs11-tool --id 02 -s -p 123456 -m SHA1-RSA-PKCS-PSS --module /usr/lib64/opensc-pkcs11.so --input-file data --output-file data.sig Using slot 0 with a present token (0x0) Using signature algorithm SHA1-RSA-PKCS-PSS PSS parameters: hashAlg=SHA-1, mgf=MGF1-SHA1, salt_len=20 B [root@xxx ~]# pkcs11-tool -r -p 123456 --id 02 --type pubkey --module /usr/lib64/opensc-pkcs11.so > 02.der Using slot 0 with a present token (0x0) [root@xxx ~]# openssl rsa -inform DER -outform PEM -in 02.der -pubin > 02.pub writing RSA key [root@xxx ~]# cat 02.pub -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Pr2EKgurc0OKhqDqqOX IlFl60FQB5z4d+8r2T61d0uDcZ0KP15q+WtNmR7vviQLazascc3B7XLe+2BAcGn8 Y4cU7nmaSWxFJf8Z5RH01SbYgfmimJgOX4ADznk1JPMvepQENHAPkK5uJlXKz+w4 5SRjQ4UM6kF4Mg4RTZtfztnxwv/G0V4hqyRQLbwJCmy8u2vptrzpglaG8TVe4iOO dghxLOzq3Mj5frgM3CDWQNCQ/nZGVrMvOSJndSboMXZUr6ulUyB8f8YDCI1tamdq J8OKLeVx3N8lnBuz1dCRX6oXXPkRzBgzmXAmF3uMLrl4nUQlXdgRVO8jSg7baMqc pQIDAQAB -----END PUBLIC KEY----- [root@xxx ~]# openssl dgst -verify 02.pub -sha1 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -signature data.sig data Verified OK Looks good to me. You should be able to try this with opensc-0.19.0-6.el8.x86_64 and the same steps should fail, but I do not think it is mandatory now. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:1843 |