Description of problem: We are currently having an issue with successfully enrolling the Safenet330J token with Dogtag and TPS. The actual reason for the failure could be anywhere from TPS down to the applet , or even the card itself. Creating a bug against TPS as a starting point until we know more. Version-Release number of selected component (if applicable): Dogtag 1.0.0 How reproducible: Always Steps to Reproduce: 1. Setup CA, TKS and TPS 2. Attempt an enrollment with ESC of the safenet card 3. Actual results: The enrollment will fail when the applet tries to perform the function "decryptVerifyKey" which tries to decrypt a random challenge generated by TPS. Expected results: The enrollment should finish successfully. Additional info:
The first attachment will be for TPS code needed to allow "decryptVerifyKey" on the applet to succeed. It turns out that we need to change the apdu to have a format similar to the PutKey command. The main difference is that the algorith id "80" is to be prepended before the wrapped challenge. This allows decryptVerifyKey to work on the Safenet Token and it still works for our other tokens...
Created attachment 329061 [details] Patch to help generate key on token
cfu, can you review 329061?
(In reply to comment #2) > Created an attachment (id=329061) [details] > Patch to help generate key on token +cfu
I've done some more testing here. Specifically with server side keygen. I found out that the data being sent to "decryptVerifyKey" in the server sidd keygen case needs to be modified as well. Next patch attachment addresses this issue.
Created attachment 329764 [details] Revised patch for this fix.
CFU, can you please review this change?
Created attachment 329765 [details] Spec file for change.
Sending apdu/Generate_Key_APDU.cpp Transmitting file data . Committed revision 186. Sending channel/Secure_Channel.cpp Transmitting file data . Committed revision 187. Sending processor/RA_Enroll_Processor.cpp Transmitting file data . Committed revision 188. Sending pki-tps.spec Transmitting file data . Committed revision 189.
Verified. Token Enrollment with Safenet 330J token is successful on ESC installed on Windows (XP and Vista) and RHEL 5.3 platforms with the CS 8.0 installed on RHEL 5.3 (x86 and x86_64).