Skip to content

Conversation

@Jakuje
Copy link
Member

@Jakuje Jakuje commented Feb 25, 2020

Fixes #1854

This patch set implements first batch of PKCS#11 3.0 features, mostly Ed25519 and curve25519 keys and related algorithms in the OpenSC itself and in the OpenPGP driver (as @jans23 provided me with NitroKey Start, which is equipped with GNUK). The card was initialized using gpg so the card initialization is not in place (yet).

There are many changes across the board including the p11test testsuite, which worked for me fine, but more testing would be appreciated. This is a transcript of p11test with current branch testing sign and derive mechanisms using these new keys:

[jjelen@t470s p11test (eddsa)]$ ./p11test -p 123456
[==========] Running 8 test(s).
[ RUN      ] wait_test
To test wait, run in interactive mode (-i switch).
[  SKIPPED ] wait_test
[ RUN      ] supported_mechanisms_test
[      MECHANISM      ] [ KEY SIZE ] [  FLAGS   ]
[        CKM_*        ] [ MIN][ MAX] [          ]
[SHA_1                ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA224               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA256               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA384               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA512               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[MD5                  ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[RIPEMD160            ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[GOSTR3411            ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[EDDSA                ] [ 255][ 255] [0x00000801] CKF_HW CKF_SIGN
[ECDH1_DERIVE         ] [ 255][ 255] [0x00080001] CKF_HW CKF_DERIVE
[       OK ] supported_mechanisms_test
[ RUN      ] readonly_tests
[KEY ID] [LABEL]
[ TYPE ] [ SIZE ] [PUBLIC] [SIGN&VERIFY] [ENC&DECRYPT] [WRAP&UNWR] [ DERIVE ]

[03    ] [Authentication key]
[ EC_E ] [   255] [      ] [[./]  [./] ] [[  ]  [  ] ] [[  ] [  ]] [[  ][  ]]
  [ EDDSA                ] [   [./]    ] [           ] [         ] [        ]

[02    ] [Encryption key]
[ EC_M ] [   255] [      ] [[  ]  [  ] ] [[  ]  [  ] ] [[  ] [  ]] [[  ][./]]
  no usable attributes found ... ignored
 Public == Cert -----^       ^  ^  ^       ^  ^  ^       ^----^- Attributes
 Sign Attribute -------------'  |  |       |  |  '---- Decrypt Attribute
 Sign&Verify functionality -----'  |       |  '------- Enc&Dec functionality
 Verify Attribute -----------------'       '---------- Encrypt Attribute
[       OK ] readonly_tests
[ RUN      ] multipart_tests
[KEY ID] [TYPE] [ SIZE ] [PUBLIC] [SIGN&VERIFY] [LABEL]
[03    ] [EC_E] [   255] [      ] [[./]  [./] ] [Authentication key]
         [ EDDSA                ] [   [./]    ]

[02    ] [EC_M] [   255] [      ] [[  ]  [  ] ] [Encryption key]

 Public == Cert ------------^       ^  ^  ^
 Sign Attribute --------------------'  |  |
 Sign&Verify functionality ------------'  |
 Verify Attribute ------------------------'
[       OK ] multipart_tests
[ RUN      ] ec_sign_size_test
[       OK ] ec_sign_size_test
[ RUN      ] usage_test
[KEY ID] [LABEL]
[ TYPE ] [ SIZE ] [PUBLIC] [SIGN&VERIFY] [ENC&DECRYPT] [WRAP&UNWR] [ DERIVE ] [ALWAYS_AUTH]

[03    ] [Authentication key]
[ EC_E ] [   255] [      ] [[./]  [./] ] [[  ]  [  ] ] [[  ] [  ]] [[  ][  ]] [    [  ]   ]

[02    ] [Encryption key]
[ EC_M ] [   255] [      ] [[  ]  [  ] ] [[  ]  [  ] ] [[  ] [  ]] [[  ][./]] [    [  ]   ]
 Public == Cert -----^       ^-----^       ^-----^       ^----^      ^---^
 Sign & Verify Attributes ------'             |            |           |
 Encrypt & Decrypt Attributes ----------------'            |           |
 Wrap & Unwrap Attributes ---------------------------------'           |
 Public and Private key Derive Attributes -----------------------------'
[       OK ] usage_test
[ RUN      ] pss_oaep_test
Token does not support any RSA-PSS or OAEP mechanisms. Skipping.
[  SKIPPED ] pss_oaep_test
[ RUN      ] derive_tests
[KEY ID] [LABEL]
[ TYPE ] [ SIZE ]  [ PUBLIC ] [  DERIVE  ]

[02    ] [Encryption key]
[ EC_M ] [   255] [        ]  [ [  ][./] ]
  [ ECDH1_DERIVE            ] [   [./]   ]
 Public == Cert -----^          ^
 ECDH Derive functionality -----'
[       OK ] derive_tests
[==========] 8 test(s) run.
[  PASSED  ] 6 test(s).
[  SKIPPED ] 2 test(s), listed below:
[  SKIPPED ] wait_test
[  SKIPPED ] pss_oaep_test

 2 SKIPPED TEST(S)
[jjelen@t470s p11test (eddsa)]$ ./p11test -s 1 -p 123456
[==========] Running 8 test(s).
[ RUN      ] wait_test
To test wait, run in interactive mode (-i switch).
[  SKIPPED ] wait_test
[ RUN      ] supported_mechanisms_test
[      MECHANISM      ] [ KEY SIZE ] [  FLAGS   ]
[        CKM_*        ] [ MIN][ MAX] [          ]
[SHA_1                ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA224               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA256               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA384               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[SHA512               ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[MD5                  ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[RIPEMD160            ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[GOSTR3411            ] [   0][   0] [CKF_DIGEST] CKF_DIGEST
[EDDSA                ] [ 255][ 255] [0x00000801] CKF_HW CKF_SIGN
[ECDH1_DERIVE         ] [ 255][ 255] [0x00080001] CKF_HW CKF_DERIVE
[       OK ] supported_mechanisms_test
[ RUN      ] readonly_tests
[KEY ID] [LABEL]
[ TYPE ] [ SIZE ] [PUBLIC] [SIGN&VERIFY] [ENC&DECRYPT] [WRAP&UNWR] [ DERIVE ]

[01    ] [Signature key]
[ EC_E ] [   255] [      ] [[./]  [./] ] [[  ]  [  ] ] [[  ] [  ]] [[  ][  ]]
  [ EDDSA                ] [   [./]    ] [           ] [         ] [        ]
 Public == Cert -----^       ^  ^  ^       ^  ^  ^       ^----^- Attributes
 Sign Attribute -------------'  |  |       |  |  '---- Decrypt Attribute
 Sign&Verify functionality -----'  |       |  '------- Enc&Dec functionality
 Verify Attribute -----------------'       '---------- Encrypt Attribute
[       OK ] readonly_tests
[ RUN      ] multipart_tests
[KEY ID] [TYPE] [ SIZE ] [PUBLIC] [SIGN&VERIFY] [LABEL]
[01    ] [EC_E] [   255] [      ] [[./]  [./] ] [Signature key]
         [ EDDSA                ] [   [./]    ]

 Public == Cert ------------^       ^  ^  ^
 Sign Attribute --------------------'  |  |
 Sign&Verify functionality ------------'  |
 Verify Attribute ------------------------'
[       OK ] multipart_tests
[ RUN      ] ec_sign_size_test
[       OK ] ec_sign_size_test
[ RUN      ] usage_test
[KEY ID] [LABEL]
[ TYPE ] [ SIZE ] [PUBLIC] [SIGN&VERIFY] [ENC&DECRYPT] [WRAP&UNWR] [ DERIVE ] [ALWAYS_AUTH]

[01    ] [Signature key]
[ EC_E ] [   255] [      ] [[./]  [./] ] [[  ]  [  ] ] [[  ] [  ]] [[  ][  ]] [    [  ]   ]
 Public == Cert -----^       ^-----^       ^-----^       ^----^      ^---^
 Sign & Verify Attributes ------'             |            |           |
 Encrypt & Decrypt Attributes ----------------'            |           |
 Wrap & Unwrap Attributes ---------------------------------'           |
 Public and Private key Derive Attributes -----------------------------'
[       OK ] usage_test
[ RUN      ] pss_oaep_test
Token does not support any RSA-PSS or OAEP mechanisms. Skipping.
[  SKIPPED ] pss_oaep_test
[ RUN      ] derive_tests
[KEY ID] [LABEL]
[ TYPE ] [ SIZE ]  [ PUBLIC ] [  DERIVE  ]
 Public == Cert -----^          ^
 ECDH Derive functionality -----'
[       OK ] derive_tests
[==========] 8 test(s) run.
[  PASSED  ] 6 test(s).
[  SKIPPED ] 2 test(s), listed below:
[  SKIPPED ] wait_test
[  SKIPPED ] pss_oaep_test

 2 SKIPPED TEST(S)

I tested only PKCS#11 module so for future, there will be certainly needed some work for minidriver (if it can use these keys?), maybe for macOS?

Comments welcomed

Checklist
  • Documentation is added or updated
  • PKCS#11 module is tested
  • Windows minidriver is tested
  • macOS tokend is tested

@Jakuje
Copy link
Member Author

Jakuje commented Feb 25, 2020

I am working on interoperability tests with SoftHSM, but for now it looks like they announce wrong limits to mechanism key sizes: softhsm/SoftHSMv2#522
Additionally they do not seem to handle correctly the EC_PARAMS: softhsm/SoftHSMv2#523 so before having some interoperability at least with softhsm, it will take some time.

@lgtm-com
Copy link

lgtm-com bot commented Feb 26, 2020

This pull request introduces 1 alert when merging 0067663 into 8f4a6c7 - view on LGTM.com

new alerts:

  • 1 for Wrong type of arguments to formatting function

Copy link

@ueno ueno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At first glance, it generally looks good to me. I've added comments but they are mostly cosmetic or questions.

Copy link

@ueno ueno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me now (though my review is superficial)

@alex-nitrokey
Copy link
Contributor

I tested this PR with naive key generation attempt but I did not had any luck:

$ pkcs15-init --verify --auth-id 3 --pin 12345678 --delete-objects privkey,pubkey --id 3 --generate-key ec/cv25519
Using reader with a card: Nitrokey Nitrokey Start (FSIJ-1.2.10-67111047) 00 00
NOTE: couldn't find pubkey 03 to delete
Deleted 1 objects
Failed to generate key: Not supported
$ pkcs15-init --verify --auth-id 3 --pin 12345678 --delete-objects privkey,pubkey --id 2 --generate-key ec/ed25519
Using reader with a card: Nitrokey Nitrokey Start (FSIJ-1.2.10-67111047) 00 00
NOTE: couldn't find pubkey 02 to delete
Deleted 1 objects
Failed to generate key: Card command failed

Of course, I can provide logs but at first I wanted to know if I am just doing it wrong?

@Jakuje
Copy link
Member Author

Jakuje commented Mar 24, 2020

The current version implements only reading and using of existing keys (I used keys generated through gpg tools). The key deletion and generation is not implemented in current code. I will check the rest of comments ruing next days/weeks.

@alex-nitrokey
Copy link
Contributor

I see, makes sense. Do you need any help in implementing this or do you plan to do so yourself?
btw thanks a lot for introducing cv25519 to OpenSC :)

@Jakuje
Copy link
Member Author

Jakuje commented Mar 24, 2020

I would like to continue working on that, but just now, I have few other things to catch up (and test and review @dengert changes -- I left the token in work so I need to stop there to pick it up in coming days). If you or somebody else would like to follow up on the keygen and missing functions feel free to do the work :) I hope we will be able to move on with review, testing and merging during this week.

@alex-nitrokey
Copy link
Contributor

The current version implements only reading and using of existing keys (I used keys generated through gpg tools).

A little heads up: as far as I can see only the slot 1 key is recognized so far. At least this is all I got for a key that got all three slots equipped with keys by GnuPG beforehand.

$ pkcs15-tool -c -k
Using reader with a card: Nitrokey Nitrokey Start (FSIJ-1.2.10-67111047) 00 00
Private EDDSA Key [Signature key]
        Object Flags   : [0x03], private, modifiable
        Usage          : [0x20C], sign, signRecover, nonRepudiation
        Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
        FieldLength    : 255
        Key ref        : 0 (0x00)
        Native         : yes
        Auth ID        : 01
        ID             : 01
        MD:guid        : eaa385f7-cc9d-062a-2353-4c8ebb133f8a

@dengert
Copy link
Member

dengert commented Mar 24, 2020

What do these report:
pkcs11-tool --list-slots
pkcs15-tool --ist-pins
pkcs15-tool --dump

You might need to add --auth-id <arg> to your pkcs15-tool -c -k

@dengert
Copy link
Member

dengert commented Mar 24, 2020

Using `gpg4win (3.1.1) on Windows 10, (command line following the Nitro instructions)to populate the Nitro Pro with 3 keys.
Using Open SC master 3/32/2020 d5ecafc I can see 3 keys.

pkcs15-tool -c -k
Using reader with a card: Nitrokey Nitrokey Pro (0000000000000000000080B8) 00 00
Private EC Key [Signature key]
	Object Flags   : [0x03], private, modifiable
	Usage          : [0x20C], sign, signRecover, nonRepudiation
	Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
	FieldLength    : 0
	Key ref        : 0 (0x00)
	Native         : yes
	Auth ID        : 01
	ID             : 01
	MD:guid        : 80a469b7-f397-03e4-7fc7-3275067bbe94

Private EC Key [Encryption key]
	Object Flags   : [0x03], private, modifiable
	Usage          : [0x22], decrypt, unwrap
	Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
	FieldLength    : 0
	Key ref        : 1 (0x01)
	Native         : yes
	Auth ID        : 02
	ID             : 02
	MD:guid        : d85c0417-97a1-1d74-c593-0305f9ec101a

Private RSA Key [Authentication key]
	Object Flags   : [0x03], private, modifiable
	Usage          : [0x222], decrypt, unwrap, nonRepudiation
	Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
	ModLength      : 2048
	Key ref        : 2 (0x02)
	Native         : yes
	Auth ID        : 02
	ID             : 03
	MD:guid        : 0afc7d32-41d6-5d4c-15e8-f76cb7bd75cc

@alex-nitrokey
Copy link
Contributor

Using `gpg4win (3.1.1) on Windows 10, (command line following the Nitro instructions)to populate the Nitro Pro with 3 keys.

But this PR is about adding curve25519 which is only support by NK Start/Gnuk devices, isn't it?
You are trying a NK Pro which is working fine for the corresponding curves for me as well.

@alex-nitrokey
Copy link
Contributor

What do these report:

All these only show the PIN slots and the one signature slot I was mentioning before.

@dengert
Copy link
Member

dengert commented Mar 26, 2020

@alex-nitrokey Nitro sent me a Nitrokey Pro. The comment was a hint that if I they send me a card, which supports curve25519 I could help debug it too.

@alex-nitrokey
Copy link
Contributor

I see, did not understand the hint :)
We would be glad to provide you with a device. Please just send me a mail with your address to support at nitrokey.com

@Jakuje
Copy link
Member Author

Jakuje commented May 19, 2020

I rebased this patch set on top of master. We will probably not get everything in before 0.21.0, but I would like to get in at least the first bunch of fixup commits not directly related to the eddsa support (if preferred, I can submit them in separate PR).

@frankmorgner
Copy link
Member

lgtm brought up a simple issue:
image

Copy link
Member

@frankmorgner frankmorgner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks very nice. I had only some minor comments.

Indeed, this PR would be a nice feature for the next release. I'd like to hold it back and concentrate on the bugfixes #1999 and #1963 ...

@lgtm-com
Copy link

lgtm-com bot commented May 25, 2020

This pull request introduces 1 alert when merging 964caae into 0a17188 - view on LGTM.com

new alerts:

  • 1 for Wrong type of arguments to formatting function

@Jakuje
Copy link
Member Author

Jakuje commented May 25, 2020

Fixed previous comments. Last failing test is now the osx build because missing build signing keys.

Jakuje and others added 20 commits March 1, 2021 15:42
Since 09a594d bringing ECC support to openPGP card, it did not count
with GNUK. This adds exception for GNUK to unbreak ECC signatures
as GNUK presents BCD version < 3.
…9 keys (with few tweaks)

The Ed25519 implementation in SoftHSM is now broken /non-interoperable. After fixing that,
the interoperability tests should work with this script:

 * SoftHSMv2#528: Avoid creating duplicate mechanisms
 * SoftHSMv2#522: Fix advertised min and max mechanism sizes according to final PKCS#11 3.0 specification
 * SoftHSMv2#526: Adjust EDDSA code to return valid EC_PARAMS according to the final PKCS OpenSC#11 3.0 specification
card-opennpgp.c and pkcs15-openpgp.c have a strang way of
using sc_object_id_t to store what they call a binary_oid
or oid_binary.  It is used to convert the EC curve asn1
returned in the cxdata.

This code uses asn1_decode_object_id to use sc_object_id_t
as used in the rest of the code.

The code and ec_curve tabes in card-openpgp.c where not changed.

pkcs15-openpgp.c was channge si to can use:
algorithm_info = sc_card_find_ec_alg(card, 0, &oid);
to retried the key_length to add to the pubkey and prkey entries.
The EC and EDDSA needs (i.e. field_length)  to run.

 On branch eddsa
 Your branch is up to date with 'Jakuje/eddsa'.

 Changes to be committed:
	modified:   card.c
	modified:   pkcs15-openpgp.c
This is the current interpretation of the specs after talking with
several members of PKCS OpenSC#11 TC.
@Jakuje
Copy link
Member Author

Jakuje commented Mar 1, 2021

Rebased and tested with Nitrokey Start. There were some conflicts around the things modified recently by @popovec around support for additional EC mechanisms so I would like you to have a look if it makes sense. Here, we have a new keys EC_MONTGOMERY that are using EC algorithms but only CKM_ECDH1_DERIVE and not the CKM_EC, which needed the additional conditions in register_ec_mechanisms().

@frankmorgner
Copy link
Member

The resolved conflicts are looking good from my perspective, but let's wait a bit to see if @popovec has some comments.

@popovec
Copy link
Member

popovec commented Mar 17, 2021

I have checked b8266a4, I did not find any problem that would interfere with the functionality of already mentioned modifications for EC mechanisms (ECDSA verify, ECDSA Signatures with hashes). I propose to accept this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add curve25519 support in OpenSC

7 participants