Skip to content

piv-tool: Fix RSA key generation #3158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Jakuje merged 1 commit into from
Jun 13, 2024
Merged

piv-tool: Fix RSA key generation #3158

Jakuje merged 1 commit into from
Jun 13, 2024

Conversation

@invis-z
Copy link
Contributor

@invis-z invis-z commented May 25, 2024

params = OSSL_PARAM_BLD_to_param(bld) was called twice, once inside if condition and once after the if. Removed the second one to resolve issue generating RSA keys with OpenSSL 3.0.

Someone else please verify this is the correct fix, I am far from understanding all the code and only did some preliminary tests to check if it is working after the fix.

Also, maybe consider adding a test for piv-tool inside the piv test routine (with PivApplet)?

Fixes #3156

Checklist
  • Documentation is added or updated
  • New files have a LGPL 2.1 license statement
  • PKCS#11 module is tested
  • Windows minidriver is tested
  • macOS tokend is tested

@dengert
Copy link
Member

dengert commented May 25, 2024

Tested using Yubikey 4 with PIV applet with OpenSC master and OpenSSL 3.2.1 on Ubuntu 22.04.

Jakuje
Jakuje approved these changes May 27, 2024
View reviewed changes
Copy link
Member

@Jakuje Jakuje left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch! Thanks!

You mentioned you tested this with Yubikey, does the piv-took key generation work also with the applet in CI, so we could use the piv-tool for enrollment instead of (or in addition to) the yubico-piv-tool?

@dengert
Copy link
Member

dengert commented May 27, 2024

I did use my enrolment scripts which call piv-tool to test this patch.

The OpenSC piv-tool could be used, but many of the operations such as deleting a cert or setting a pin are done using -s "apdu" option. Creating some objects such as a CHUID are done via a separate program which has not been generally published.

(There used to be a WIKI pages with all of this, but I can't find it. Any way to find deleted WIKI pages?)

The piv-tool when generating a key saves the public key to a file and scripts must be used to create a certificate either self signed or via a certificate request signed using libp11. if pkcs15-piv.c does not find a certificate on the card it will look for an environment variable pointing at the saved public key. https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/pkcs15-piv.c#L1023-L1072

Yubikey piv tool when generating a key writes a dummy certificate to the card as part of the key gen process, which simplifies the process.

One main difference between Yubikey piv tool and piv-tool is piv-tool expects objects to be written (other then a certificate) to be contained in the 7E or 5C tag and length. Yubikey piv tool wraps the input in 7E or 5C.

piv-tool can take a certificate and optionally gzip it and place in a certificate object and write the certificate object to the card.

The piv-tool was written in 2004 to do the minimal needed to write to test cards, not to be a general support tool, as PIV cards at that time were only issued by government agencies and card vendors provided the card management systems.

I have no real interest it trying to make any substantial changes to piv-tool.

I did provide my enrolment scripts to my employer at the time to be used to generate temporary PIV cards, for new hires while waiting for a gov issued card, or a card that broke, was lost, or was left at home. The PIV cards tmp or gov issued were used to authenticate to Active Directory, so these people could still get some work done.

@invis-z
Copy link
Contributor Author

invis-z commented May 27, 2024

good catch! Thanks!

You mentioned you tested this with Yubikey, does the piv-took key generation work also with the applet in CI, so we could use the piv-tool for enrollment instead of (or in addition to) the yubico-piv-tool?

Yes, that is actually how I did my preliminary test. I modified .github/test-piv.sh to use github actions to test key generation (with PivApplet). I am not familiar with the CI tools used here so I just read the log to find if there is a key.

However, the problem here is to generate the certificate, as I don't see how to use piv-tool to sign the self-signed cert with only the key slot number. I am not very familiar with all the tools so there is a high chance that I missed something.

I tried to get around this by generating a temporary CA and sign a dummy cert with the correct pubkey, load the certificate to the correct slot, use openssl with pkcs11-module to generate another self-signed certificate (now the slot can be accessed because it has a corresponding certfiicate), and load that cert to the slot again. I was able make it work without ever needing yubico-piv-tool.

@dengert
Copy link
Member

dengert commented May 27, 2024

One way to generate a certificate or certificate request is by using PKCS11. The CKA_ID of the certificate, public key and private key are the same. In my test scripts I used the openssl , CA.pl and openssl.conf with a pkcs11 engine or provider.
Since the PIV card did not have a certificate, the public key was passed by the env variable as outlined in: https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/pkcs15-piv.c#L1023-L1072

The test scripts would make a copy of openssl.conf and using sed make changes based on the username, email, which CKA_ID and other extensions to sign a CSR which was then sent to an AD CA or my test CA which used CA.pl to call openssl to sign the CSR and create a certificate using a test CA certificate. The certificate was then loaded onto the card using piv-tool.
All of this was run on Linux.

@invis-z
Copy link
Contributor Author

invis-z commented May 28, 2024

So, if I am understanding correctly, since there is no deletion needed in test-piv.sh, the following code provides the same functionality in the test (if openssl is already configured to use pkcs11 provider):

OpenSC/.github/test-piv.sh

Lines 56 to 71 in 36df028

PIN="123456"
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9e -a generate -A RSA2048 | tee 9e.pub
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9e -S'/CN=barCard/OU=test/O=example.com/' -averify -aselfsign < 9e.pub | tee 9e.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9e -aimport-certificate < 9e.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9a -a generate -A RSA2048 | tee 9a.pub
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9a -S'/CN=bar/OU=test/O=example.com/' -averify -aselfsign < 9a.pub | tee 9a.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9a -aimport-certificate < 9a.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9c -a generate -A ECCP256 | tee 9c.pub
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9c -S'/CN=bar/OU=test/O=example.com/' -averify -aselfsign < 9c.pub | tee 9c.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9c -aimport-certificate < 9c.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9d -a generate -A ECCP256 | tee 9d.pub
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9d -S'/CN=bar/OU=test/O=example.com/' -averify -aselfsign < 9d.pub | tee 9d.cert
yubico-piv-tool -v 9999 -r 'Virtual PCD 00 00' -P "$PIN" -s 9d -aimport-certificate < 9d.cert 

PIN="123456"
echo '01:02:03:04:05:06:07:08:01:02:03:04:05:06:07:08:01:02:03:04:05:06:07:08' > key
export PIV_EXT_AUTH_KEY="$(pwd)/key"

piv-tool -v -A A:9B:03 -G 9E:07 -o 9e.pub
export PIV_9E_KEY="$(pwd)/9e.pub"
openssl req -key "pkcs11:id=%04;type=private;pin-value=$PIN" -subj "/CN=barCard/OU=test/O=example.com/" -new -x509 -out 9e.cert
piv-tool -v -A A:9B:03 -C 9E -i 9e.cert

piv-tool -v -A A:9B:03 -G 9A:07 -o 9a.pub
export PIV_9A_KEY="$(pwd)/9a.pub"
openssl req -key "pkcs11:id=%01;type=private;pin-value=$PIN" -subj "/CN=bar/OU=test/O=example.com/" -new -x509 -out 9a.cert
piv-tool -v -A A:9B:03 -C 9A -i 9a.cert

piv-tool -v -A A:9B:03 -G 9C:11 -o 9c.pub
export PIV_9C_KEY="$(pwd)/9c.pub"
openssl req -key "pkcs11:id=%02;type=private;pin-value=$PIN" -subj "/CN=bar/OU=test/O=example.com/" -new -x509 -out 9c.cert
piv-tool -v -A A:9B:03 -C 9C -i 9c.cert

piv-tool -v -A A:9B:03 -G 9D:11 -o 9d.pub
export PIV_9D_KEY="$(pwd)/9d.pub"
openssl req -key "pkcs11:id=%03;type=private;pin-value=$PIN" -subj "/CN=bar/OU=test/O=example.com/" -new -x509 -out 9d.cert
piv-tool -v -A A:9B:03 -C 9D -i 9d.cert

@Jakuje
Copy link
Member

Jakuje commented May 28, 2024

(There used to be a WIKI pages with all of this, but I can't find it. Any way to find deleted WIKI pages?)

The whole wiki pages history should be here: https://github.com/OpenSC/Wiki. Searching through git I managed to find
PivTool.textile which was destroyed with OpenSC/Wiki@58193e3

I vaguely remember we discussed that this was more confusing users than helping as it could not do all the operations the Yubico piv tool could do, but the commit message is not very descriptive.

So, if I am understanding correctly, since there is no deletion needed in test-piv.sh, the following code provides the same functionality in the test (if openssl is already configured to use pkcs11 provider):

Thanks! This looks reasonable. But if I am right, the pkcs11-provider is not yet in standard ubuntu repositories (especially not in the old images in GH actions) so we would need to build it as part of the CI (instead of the yubico-piv-tool).

The only thing I found is ppc64el version in universe: https://packages.ubuntu.com/noble/ppc64el/libs/pkcs11-provider

I think this does not have to happen now in this PR, but at very least, we should create an issue with the notes from here as they are certainly helpful for writing the test.

xhanulik
xhanulik approved these changes May 29, 2024
View reviewed changes
Copy link
Member

@xhanulik xhanulik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please fix the spelling errors.

@invis-z
Copy link
Contributor Author

invis-z commented May 29, 2024

Please fix the spelling errors.

All the spelling error is not related to this PR, I only deleted one line of code.

@invis-z
piv-tool: Fix RSA key generation
e0ff8c8 
`params = OSSL_PARAM_BLD_to_param(bld)` was called twice, once inside `if` condition and once after the `if`. 
Removed the second one to resolve issue generating RSA keys with OpenSSL 3.0.
@invis-z
Copy link
Contributor Author

invis-z commented Jun 5, 2024

Rebased so that there shouldn't be typo anymore.

@Jakuje Jakuje mentioned this pull request Jun 13, 2024
Open
@Jakuje
Copy link
Member

Jakuje commented Jun 13, 2024

Created separate issue for the tests #3181 and merging this not to delay the fix even mode.

Thank you for your contribution!

@Jakuje Jakuje merged commit 1685f37 into OpenSC:master Jun 13, 2024
@xhanulik xhanulik mentioned this pull request Aug 29, 2024
Closed
dangowrt added a commit to dangowrt/packages that referenced this pull request Apr 26, 2025
@dangowrt
opensc: update to version 0.26.1
9fd64e9 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248)

Signed-off-by: Daniel Golle <[email protected]>
dangowrt added a commit to dangowrt/packages that referenced this pull request Apr 26, 2025
@dangowrt
opensc: update to version 0.26.1
e63fb4d 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248)

Signed-off-by: Daniel Golle <[email protected]>
dangowrt added a commit to dangowrt/packages that referenced this pull request Apr 26, 2025
@dangowrt
opensc: update to version 0.26.1
7054b6a 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248)

Signed-off-by: Daniel Golle <[email protected]>
dangowrt added a commit to openwrt/packages that referenced this pull request Apr 27, 2025
@dangowrt
opensc: update to version 0.26.1
33f9b3a 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC##3248)

Signed-off-by: Daniel Golle <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dengert dengert dengert approved these changes

@frankmorgner frankmorgner frankmorgner approved these changes

@Jakuje Jakuje Jakuje approved these changes

@xhanulik xhanulik xhanulik approved these changes

Assignees

No one assigned

Labels

None yet

Projects

No open projects
OpenSC 0.26.0
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Unable to generate RSA key using piv-tool

5 participants

@invis-z @dengert @Jakuje @frankmorgner @xhanulik