Skip to content

[pkcs11-tool] Add support for CKM_AES_GCM encryption #3195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Jakuje merged 4 commits into from
Jul 5, 2024
Merged

[pkcs11-tool] Add support for CKM_AES_GCM encryption #3195

Jakuje merged 4 commits into from
Jul 5, 2024

Conversation

@b-ori
Copy link
Contributor

@b-ori b-ori commented Jul 3, 2024 •
edited
Loading

Hi,
This pull request adds the support for the CKM_AES_GCM mechanism for encryption and decryption in pkcs11-tool.
I also took the opportunity to fix a few coding style issues reported by the the CI.
The changes were validated using the Trustonic TEE HSM.
Best regards,
Rémy

@b-ori b-ori force-pushed the trustonic_pkcs11_tool_add_aes_gcm branch from c8b17eb to 615c5b3 Compare July 3, 2024 21:03
@b-ori b-ori force-pushed the trustonic_pkcs11_tool_add_aes_gcm branch from 77a0b02 to 79f47cb Compare July 4, 2024 07:10
@b-ori b-ori marked this pull request as ready for review July 4, 2024 07:27
Jakuje
Jakuje approved these changes Jul 4, 2024
View reviewed changes
Copy link
Member

@Jakuje Jakuje left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@b-ori b-ori changed the title feat(pkcs11-tool): add support for CKM_AES_GCM encryption [pkcs11-tool] Add support for CKM_AES_GCM encryption Jul 5, 2024
@b-ori b-ori mentioned this pull request Jul 5, 2024
Merged
@Jakuje Jakuje merged commit 9af4154 into OpenSC:master Jul 5, 2024
@Jakuje Jakuje mentioned this pull request Jul 5, 2024
Closed
3 tasks
@b-ori b-ori deleted the trustonic_pkcs11_tool_add_aes_gcm branch July 26, 2024 12:39
@xhanulik xhanulik mentioned this pull request Aug 29, 2024
Closed
dangowrt added a commit to dangowrt/packages that referenced this pull request Apr 26, 2025
@dangowrt
opensc: update to version 0.26.1
9fd64e9 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248)

Signed-off-by: Daniel Golle <[email protected]>
dangowrt added a commit to dangowrt/packages that referenced this pull request Apr 26, 2025
@dangowrt
opensc: update to version 0.26.1
e63fb4d 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248)

Signed-off-by: Daniel Golle <[email protected]>
dangowrt added a commit to dangowrt/packages that referenced this pull request Apr 26, 2025
@dangowrt
opensc: update to version 0.26.1
7054b6a 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248)

Signed-off-by: Daniel Golle <[email protected]>
dangowrt added a commit to openwrt/packages that referenced this pull request Apr 27, 2025
@dangowrt
opensc: update to version 0.26.1
33f9b3a 
New in 0.26.1; 2025-01-14
General improvements

    Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
    Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)

pkcs11-spy

    Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)

TCOS

    Fix reading certificate (OpenSC/OpenSC#3296)

New in 0.26.0; 2024-11-13
Security

    CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
    CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
    CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)

General improvements

    Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
    Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
    Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
    Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
    Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer

PKCS#15

    Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)

minidriver

    Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)

pkcs11-tool

    Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
    Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
    Add support for AES CMAC (OpenSC/OpenSC#3184)
    Add support for AES GCM encryption (OpenSC/OpenSC#3195)
    Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
    Add support for HKDF (OpenSC/OpenSC#3193)
    Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
    Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)

pkcs15-crypt

    Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)

piv-tool

    Fix RSA key generation (OpenSC/OpenSC#3158)
    Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)

sc-hsm-tool

    Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)

pkcs11-register

    Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)

IDPrime

    Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
    Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
    Reorder ATRs for matching cards (OpenSC/OpenSC#3154)

OpenPGP

    Fix state tracking after erasing card (OpenSC/OpenSC#3024)

Belpic

    Disable Applet V1.8 (OpenSC/OpenSC#3109)

MICARDO

    Deactivate driver (OpenSC/OpenSC#3152)

SmartCard-HSM

    Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)

eOI

    Set model via sc_card_ctl function (OpenSC/OpenSC#3189)

Rutoken

    increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)

JPKI

    Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)

D-Trust

    Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC##3248)

Signed-off-by: Daniel Golle <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Jakuje Jakuje Jakuje approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@b-ori @Jakuje