New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

support cards which only have ALG_RSA_CRT #5

Open

fishsoupisgood wants to merge 1 commit into makinako:master from fishsoupisgood:alg_rsa_crt_support

fishsoupisgood commented Feb 25, 2018

None of the smartcards I tried (various JavaCOS, NXP, SmartCafe Expert) supported KeyPair(KeyPair.ALG_RSA, ...) only KeyPair.ALG_RSA_CRT.

This patch detects that and switches to using KeyPair.ALG_RSA_CRT.


          support cards which only have ALG_RSA_CRT

8adcbcf

darconeous reviewed

View reviewed changes

darconeous left a comment

I'm not associated with this project, but I had a look over the changes and figured I would throw in my $0.02. Take it with a grain of salt.

You may want to consider gating this capability by adding a feature flag.

Now that you added support for RSAPrivateCrtKey, consider implementing all of the types (ELEMENT_RSA_P, ELEMENT_RSA_Q, etc.) that RSAPrivateCrtKey seems to support:

OpenFIPS201/src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

Lines 108 to 133 in 8adcbcf

    
                   /* 
        
                   // RSA Prime Exponent P 
        
                   case ELEMENT_RSA_P: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA Prime Exponent Q 
        
                   case ELEMENT_RSA_Q: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA D mod P - 1 
        
                   case ELEMENT_RSA_DP: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA D mod Q - 1 
        
                   case ELEMENT_RSA_DQ: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA Inverse Q 
        
                   case ELEMENT_RSA_PQ: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   */

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

                    */
                   public void setPrivateExponent(byte[] buffer, short offset, short length) {
                       if (privateKey == null) allocate();
-                      privateKey.setExponent(buffer, offset, length);
+                      ISOException.throwIt(ISO7816.SW_FUNC_NOT_SUPPORTED);

darconeous Dec 11, 2019

Given the next few lines, I'm guessing this line was included in error.

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

                */
               public final class PIVKeyObjectPKI extends PIVKeyObject {
-                  private RSAPrivateKey privateKey;
+                  private Key privateKey;

darconeous Dec 11, 2019

Instead of Key, should this be PrivateKey?

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

                    */
                   public void setModulus(byte[] buffer, short offset, short length) {
                       if (privateKey == null || publicKey == null) allocate();
-                      privateKey.setModulus(buffer, offset, length);
+                      ISOException.throwIt(ISO7816.SW_FUNC_NOT_SUPPORTED);

darconeous Dec 11, 2019

Same comment as that from line 156 above: I'm guessing this line was added in error.

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

+                          try {
+                              keyPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_1024);
+                          } catch (CryptoException e) {
+              	        if (e.getReason() == CryptoException.NO_SUCH_ALGORITHM) {

darconeous Dec 11, 2019

Inconsistent whitespace.

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

+                          try {
+                              keyPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_2048);
+                          } catch (CryptoException e) {
+              	        if (e.getReason() == CryptoException.NO_SUCH_ALGORITHM) {

darconeous Dec 11, 2019

Inconsistent whitespace.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment