| ︙ | | |
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
|
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
|
-
+
+
-
+
-
+
|
* RETURN VALUE
* ...
*
* NOTES
* ...
*
*/
static ssize_t cackey_signdecrypt(struct cackey_slot *slot, struct cackey_identity *identity, unsigned char *buf, size_t buflen, unsigned char *outbuf, size_t outbuflen) {
static ssize_t cackey_signdecrypt(struct cackey_slot *slot, struct cackey_identity *identity, unsigned char *buf, size_t buflen, unsigned char *outbuf, size_t outbuflen, int padInput, int unpadOutput) {
unsigned char *tmpbuf, *tmpbuf_s;
unsigned char bytes_to_send, p1;
unsigned char blocktype;
cackey_ret send_ret;
uint16_t respcode;
ssize_t retval;
ssize_t retval = 0, unpadoffset;
size_t tmpbuflen, padlen, tmpoutbuflen;
int free_tmpbuf = 0;
int free_tmpbuf = 0, sepByte = -1;
int le;
CACKEY_DEBUG_PRINTF("Called.");
if (buflen > 255) {
CACKEY_DEBUG_PRINTF("Error. buflen is greater than 255 (buflen = %lu)", (unsigned long) buflen);
|
| ︙ | | |
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
|
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
|
+
-
-
-
-
+
+
+
+
-
-
+
+
-
-
-
+
+
+
-
+
-
-
-
-
-
+
+
+
+
+
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-
-
|
/* Determine identity Key size */
if (identity->pcsc_identity->keysize < 0) {
identity->pcsc_identity->keysize = x509_to_keysize(identity->pcsc_identity->certificate, identity->pcsc_identity->certificate_len);
}
/* Pad message to key size */
if (padInput) {
if (identity->pcsc_identity->keysize > 0) {
if (buflen != identity->pcsc_identity->keysize) {
if (buflen > (identity->pcsc_identity->keysize + 3)) {
CACKEY_DEBUG_PRINTF("Error. Message is too large to sign/decrypt");
if (identity->pcsc_identity->keysize > 0) {
if (buflen != identity->pcsc_identity->keysize) {
if (buflen > (identity->pcsc_identity->keysize + 3)) {
CACKEY_DEBUG_PRINTF("Error. Message is too large to sign/decrypt");
return(-1);
}
return(-1);
}
tmpbuflen = identity->pcsc_identity->keysize;
tmpbuf = malloc(tmpbuflen);
free_tmpbuf = 1;
tmpbuflen = identity->pcsc_identity->keysize;
tmpbuf = malloc(tmpbuflen);
free_tmpbuf = 1;
padlen = tmpbuflen - buflen - 3;
padlen = tmpbuflen - buflen - 3;
tmpbuf[0] = 0x00;
tmpbuf[1] = 0x01;
memset(&tmpbuf[2], 0xFF, padlen);
tmpbuf[padlen + 2]= 0x00;
memcpy(&tmpbuf[padlen + 3], buf, buflen);
tmpbuf[0] = 0x00;
tmpbuf[1] = 0x01;
memset(&tmpbuf[2], 0xFF, padlen);
tmpbuf[padlen + 2]= 0x00;
memcpy(&tmpbuf[padlen + 3], buf, buflen);
CACKEY_DEBUG_PRINTBUF("Unpadded:", buf, buflen);
CACKEY_DEBUG_PRINTBUF("Padded:", tmpbuf, tmpbuflen);
} else {
CACKEY_DEBUG_PRINTBUF("Unpadded:", buf, buflen);
CACKEY_DEBUG_PRINTBUF("Padded:", tmpbuf, tmpbuflen);
} else {
tmpbuf = buf;
tmpbuflen = buflen;
free_tmpbuf = 0;
padlen = 0;
}
} else {
CACKEY_DEBUG_PRINTF("Unable to determine key size, hoping the message is properly padded!");
tmpbuf = buf;
tmpbuflen = buflen;
free_tmpbuf = 0;
padlen = 0;
}
} else {
CACKEY_DEBUG_PRINTF("Unable to determine key size, hoping the message is properly padded!");
|
| ︙ | | |
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
|
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
|
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
|
CACKEY_DEBUG_PRINTF("Outbuflen exceeds maximum value, returning in failure. (max = %li, outbuflen = %lu)", (long) _POSIX_SSIZE_MAX, (unsigned long) outbuflen);
return(-1);
}
# endif
#endif
/* Unpad reply */
if (unpadOutput) {
if (retval < 2) {
CACKEY_DEBUG_PRINTF("Reply is too small, we are not able to unpad -- passing back and hoping for the best!");
return(retval);
}
blocktype = outbuf[0];
unpadoffset = 0;
switch (blocktype) {
case 0x00:
/* Padding Scheme 1, the first non-zero byte is the start of data */
for (unpadoffset = 1; unpadoffset < retval; unpadoffset++) {
if (outbuf[unpadoffset] != 0x00) {
break;
}
}
break;
case 0x01:
/* Padding Scheme 2, pad bytes are 0xFF followed by 0x00 */
for (unpadoffset = 1; unpadoffset < retval; unpadoffset++) {
if (outbuf[unpadoffset] != 0xFF) {
if (outbuf[unpadoffset] == 0x00) {
unpadoffset++;
break;
} else {
CACKEY_DEBUG_PRINTF("Invalid padding data found, returning in failure, should have been 0x00 found 0x%02x", (unsigned int) outbuf[unpadoffset]);
return(-1);
}
} else {
CACKEY_DEBUG_PRINTF("Invalid padding data found, returning in failure, should have been 0xFF found 0x%02x", (unsigned int) outbuf[unpadoffset]);
return(-1);
}
}
break;
case 0x02:
/* Padding Scheme 3, pad bytes are non-zero first non-zero byte found is the pad byte */
for (unpadoffset = 1; unpadoffset < retval; unpadoffset++) {
if (outbuf[unpadoffset] == 0x00) {
continue;
}
if (sepByte == -1) {
sepByte = outbuf[unpadoffset];
continue;
}
if (outbuf[unpadoffset] == sepByte) {
unpadoffset++;
break;
}
}
break;
}
if (unpadoffset > retval) {
CACKEY_DEBUG_PRINTF("Offset greater than reply size, aborting. (unpadoffset = %lu, retval = %lu)", (unsigned long) unpadoffset, (unsigned long) retval);
return(-1);
}
CACKEY_DEBUG_PRINTBUF("Padded:", outbuf, retval);
retval -= unpadoffset;
memmove(outbuf + unpadoffset, outbuf, retval);
CACKEY_DEBUG_PRINTBUF("Unpadded:", outbuf, retval);
}
CACKEY_DEBUG_PRINTF("Returning in success.");
CACKEY_DEBUG_PRINTF("Returning in success, signed %li bytes", (long) retval);
return(retval);
}
/*
* SYNPOSIS
* ...
|
| ︙ | | |
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
|
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
|
-
+
|
return(CKR_OPERATION_NOT_INITIALIZED);
}
switch (cackey_sessions[hSession].decrypt_mechanism) {
case CKM_RSA_PKCS:
/* Ask card to decrypt */
buflen = cackey_signdecrypt(&cackey_slots[cackey_sessions[hSession].slotID], cackey_sessions[hSession].decrypt_identity, pEncryptedPart, ulEncryptedPartLen, buf, sizeof(buf));
buflen = cackey_signdecrypt(&cackey_slots[cackey_sessions[hSession].slotID], cackey_sessions[hSession].decrypt_identity, pEncryptedPart, ulEncryptedPartLen, buf, sizeof(buf), 0, 1);
if (buflen < 0) {
/* Decryption failed. */
retval = CKR_GENERAL_ERROR;
} else if (((unsigned long) buflen) > *pulPartLen && pPart) {
/* Decrypted data too large */
retval = CKR_BUFFER_TOO_SMALL;
|
| ︙ | | |
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
|
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
|
-
+
|
return(CKR_OPERATION_NOT_INITIALIZED);
}
switch (cackey_sessions[hSession].sign_mechanism) {
case CKM_RSA_PKCS:
/* Ask card to sign */
CACKEY_DEBUG_PRINTF("Asking to decrypt from identity %p in session %lu", cackey_sessions[hSession].sign_identity, (unsigned long) hSession);
sigbuflen = cackey_signdecrypt(&cackey_slots[cackey_sessions[hSession].slotID], cackey_sessions[hSession].sign_identity, cackey_sessions[hSession].sign_buf, cackey_sessions[hSession].sign_buflen, sigbuf, sizeof(sigbuf));
sigbuflen = cackey_signdecrypt(&cackey_slots[cackey_sessions[hSession].slotID], cackey_sessions[hSession].sign_identity, cackey_sessions[hSession].sign_buf, cackey_sessions[hSession].sign_buflen, sigbuf, sizeof(sigbuf), 1, 0);
if (sigbuflen < 0) {
/* Signing failed. */
retval = CKR_GENERAL_ERROR;
} else if (((unsigned long) sigbuflen) > *pulSignatureLen && pSignature) {
/* Signed data too large */
retval = CKR_BUFFER_TOO_SMALL;
|
| ︙ | | |