I'm having exactly the same problem. As long as the certificate is 1024 bit everything works. With a certificate of 2048 bit it no longer works. I compiled a version with MAX-SLOTS 8 too. But the problem persists.

I'll need a 2048K key card that is failing. I seem to remember that some work has been done to support 2K keys, but I have no 2K tokens to verify.

Also, are we talking PIV, CAC or coolkey applets on the card (it matters).

Finally what 'MAX-SLOTS' thing are you talking about?

Anyway If I have a card in hand, I'll dev_ack+ this.

bob

I can't provide my active identity activkey :-(. I'm not sure what PIV is. I believe that it's CAC. There is a patch from CAC that adjusts slots.h and slots.cpp. In this patch adds a #define MAX-SLOTS=3. 

Is there away that I can help you like running in debug mode. One of my code workers has this working with the new token cert 2k on Ubuntu. It's the weekend so I'm waiting to hear back from from him.

Here is an update.  With some help from a fellow friend that was running Ubuntu 10.04 who had the same problem was able to use my process and fix his system.  We then took a diff on his coolkey source files and discovered the following missing from Fedora and Red Hat Source files.  When you add these changes in to the coolkey source files the PKCS11_INSPECT works again. 

There is a new problem with the pkcs11_inspect and other tools where it can't read the 2048-bit key.  

List of changes below that need to be an addtional patch to coolkey for the active_key_patching.

--- ./coolkey-1.1.0.stdpatched/src/coolkey/object.cpp	2012-12-13 11:20:50.356151100 -0800
+++ ./coolkey-1.1.0/src/coolkey/object.cpp	2012-12-13 10:42:00.028178027 -0800
@@ -1027,7 +1027,7 @@
 
     /* So we know what the key is supposed to be used for based on
      * the instance */
-    if (instance == 2) {
+    if (instance >= 2) {
 	decrypt = TRUE;
     }
 
@@ -1041,7 +1041,12 @@
     setAttribute(CKA_ID, &id);
     CKYBuffer_FreeData(&id);
     setAttributeULong(CKA_CERTIFICATE_TYPE, CKC_X_509);
-    setAttribute(CKA_LABEL, CAC_Label[instance]);
+    int keyIndex = instance;
+    /* ActivKey has up to 8 slots, read only the first cert from slots > 2 */
+    if(instance > 2) {
+	keyIndex = 0;
+    }
+    setAttribute(CKA_LABEL, CAC_Label[keyIndex]);
 
     CKYBuffer derSerial; CKYBuffer_InitEmpty(&derSerial);
     CKYBuffer derSubject; CKYBuffer_InitEmpty(&derSubject);
--- ./coolkey-1.1.0.stdpatched/src/coolkey/slot.cpp	2012-12-13 11:20:50.432151131 -0800
+++ ./coolkey-1.1.0/src/coolkey/slot.cpp	2012-12-13 10:26:38.802139604 -0800
@@ -2287,7 +2287,7 @@
 	if (instance == 0) throw e;
 	// If the CAC doesn't have instance '2', and we were updating
 	// the shared memory, set it to valid now.
-	if ((instance == 2) && !shmem.isValid()) {
+	if ((instance >= 2) && !shmem.isValid()) {
 	    shmem.setValid();
 	}
 	return;
@@ -2297,7 +2297,12 @@
 						 instance, OSTimeNow() - time);
 
     if (instance == 0) {
-	readCACCertificateFirst(&rawCert, &nextSize, true);
+    /* do not fail if 0 instance is not found */
+	readCACCertificateFirst(&rawCert, &nextSize, false);
+	if(CKYBuffer_Size (&rawCert) == 0) {
+	   shmem.clearValid(0);
+	   return;
+	}
 	log->log("CAC Cert %d: fetch CAC Cert:  %d ms\n", 
 						instance, OSTimeNow() - time);
     }
@@ -2312,7 +2317,7 @@
 	CKYSize shmCertSize = CKYBuffer_Size(&shmCert);
 	const CKYByte *shmData = CKYBuffer_Data(&shmCert);
 
-	if (instance != 0) {
+	if ((instance > 0) && (instance <=2)) {
 	    needRead = 0;
 	}
 
@@ -2343,7 +2348,7 @@
 	    if (status != CKYSUCCESS) {
 		/* CAC only requires the Certificate in pki '0' */
 		/* if pki '1' or '2' are empty, treat it as a non-fatal error*/
-		if (instance == 2) {
+		if (instance == MAX_CERT_SLOTS -1) {
 		    /* we've attempted to read all the certs, shared memory
 		     * is now valid */
 		    shmem.setValid();
@@ -2361,7 +2366,7 @@
 	    handleConnectionError();
 	}
 	shmem.writeCACCert(&rawCert, instance);
-	if (instance == 2) {
+	if (instance >= 2) {
 	    shmem.setValid();
 	}
     }
@@ -2436,9 +2441,9 @@
     std::list<ListObjectInfo>::iterator iter;
 
     if (state & CAC_CARD) {
-	loadCACCert(0);
-	loadCACCert(1);
-	loadCACCert(2);
+	for(int i = 0; i < MAX_CERT_SLOTS; ++i) {
+		loadCACCert(i);
+	}
 	status = trans.end();
 	loadReaderObject();
 	return;
--- ./coolkey-1.1.0.stdpatched/src/libckyapplet/cky_base.h	2012-12-13 11:20:50.353151098 -0800
+++ ./coolkey-1.1.0/src/libckyapplet/cky_base.h	2012-12-13 10:39:44.963172867 -0800
@@ -45,6 +45,15 @@
     void *reserved4; \
     void *reserved5;
 
+#define CKYBUFFER_PRIVATE \
+    CKYSize len; \
+    CKYSize size; \
+    CKYByte *data; \
+    void  *reserved;
+
+#define CKYAPDU_PRIVATE \
+    CKYBuffer apduBuf; \
+    void *reserved;
 
 typedef struct _CKYBuffer {
 #ifdef CKYBUFFER_PRIVATE

Here is the new error from PKCS11_INSPECT.  Note the key is 2048-bit versus 1024-bit.

laddr@(none) coolkey-1.1.0]$ pkcs11_inspect 
PIN for token: 
ERROR:pkcs11_inspect.c:142: verify_certificate() failed: 
[laddr@(none) coolkey-1.1.0]$

The error message is resolved this was due to the fact that I needed to import the new 2048-bit key with certutil

So the issue wasn't 2K keys, the issue was that the token has more than 3 certs. (or at least the has certs in non-standard slots 4-7).

This is why I really need tokens in hand that have the same configuration. If Both Asha and I have test tokens, we can test new versions of coolkey against these tokens to make sure there are no regressions.

Adding a blind patch without tokens to test is not a good idea (not to meantion this patch will kill the performance of real CAC and PIV cards, so I can't just take it).

So... unless someone sends me a card that has certs in slots those upper slots, I really can't support that configuration.

bob

Hi Bob,

I cannot provided you an Activkey with the certificate enabled, these keys contain our certificate and access information to our corp environment.  I would be more than willing to test your fixes and help in any other way I can.

Please advise.  Is there away I can private message you?

I dont need certs enabled for an active environment, only cards with certs in a test environment that follow the environment's deployment model. If you can issue some active Cards with test certs (even expired certs will work for testing the coolkey module) in the extra slots beyond the 3 DoD slots, I can use that 1) make sure I'm supporting that configuration, and 2) to test for regressions.  

Actually I need 2 cards, one for me and one for our QA team.

bob

QE doesn't have smart card to verify this bug.

Quality Engineering Management has reviewed and declined this request.
You may appeal this decision by reopening this request.