Oaep label #2484
Oaep label #2484
Conversation
src/tools/pkcs11-tool.c
Outdated
| return 0; | ||
| } | ||
| if (param_len != 0 && param != NULL) { | ||
| /* label is ownership of openssl, do not free this ptr! */ |
There was a problem hiding this comment.
| /* label is ownership of openssl, do not free this ptr! */ | |
| /* label is in ownership of openssl, do not free this ptr! */ |
src/tools/pkcs11-tool.c
Outdated
| p11_mgf_to_name(oaep_params.mgf)); | ||
|
|
||
| if (param != NULL && param_len > 0) { | ||
| oaep_params.source = 1UL; |
There was a problem hiding this comment.
I think we should use in this case the pkcs11 constant CKZ_DATA_SPECIFIED instead of the magic number 1. Similarly as with the other places where the source is used.
|
Do you know if this is used in some real-world application/protocol outside of the tests right now? Is there some other pkcs11 module implementing this? The implementation looks quite simple and straight-forward. |
For OAEP encryption, RFC8017 allow us to use an optional "label" to be associated with the message. This "label" is represented in PKCS#11 as optional encoding parameter in CK_RSA_PKCS_OAEP_PARAMS. This patch introduces the ability to use this optional "label". Fixes OpenSC#2363
"pkcs11-tool -l -t" now attempts to use optional "label" in OAEP decipher.
|
I don't know any other pkcs#11 module with OAEP support which also includes support for "label". I tested the use of "label" in OAEP encryption using openssl (from debian, 1.1.1k-1 + deb11u1), where an undocumented switch is available that allows you to specify a "label" using a hexadecimal string, for example: -pkeyopt rsa_oaep_label: 314F I tested oaep encryption, including "label" with openssl and decryption with OpenSC's pkcs#11 module (using this PR). I plan to add code to "pkcs11-tool" so that "label" can be entered on the command line. This PR is already fixed as you suggested and is rebased to current master. |
Thanks. Looks good. Do you plan to add this API to this PR or a next one after we will merge this one? |
|
I think this PR should be merged. I will prepare the changes in pkcs11-tool as a separate PR. |
after merging OpenSC/OpenSC#2484 added the mechanism argument the build on OSX failed.
2 participants
(pkcs11-tool -l -t, MyEID card)