Got the card to work with MIT Kerberos to PKINIT to PKCS#11
with Windows AD acting as KDC.
In addition to the thew changes committed by Ludovic yesterday,
I had to make the attached changes.
flags |= SC_ALGORITHM_RSA_HASH_NONE;
Tell OpenSC that the card could do an RSA operation without
doing any hash.
ret = 0x12;
The decrypt operation needed to expect PKCS1 padding. The
original code has ret = 13, which produced SW of 69 82
I think this might be a bug in the original code?
0x04, "01", SC_PKCS15_CO_FLAG_PRIVATE},
Change the key reference for thr private key from 0x03 to 0x04.
This might be the difference in the cards or the way Gemsafe
formated them. Is there some other DF on the card that could be
used to determine the key reference?
Mattes, David wrote:
-----Original Message-----
From: Ludovic Rousseau [mailto:[EMAIL PROTECTED]
Sent: Monday, November 12, 2007 2:37 AM
To: Mattes, David
Cc: [email protected]
Subject: Re: [opensc-devel] GemSafe driver
David, can you test your cards with the SVN version of OpenSC and
report if it works for you? Maybe the code need more changes to work
with OpenSC >= 0.11.4
I can read the cert off the card. I have tried pkcs15-crypt with an md5
hash in binary file (16 bytes):
pkcs15-crypt -s -k 45 -i foo.md5
returns:
Input has to be exactly 128 bytes, when using no padding.
I'll try some other tests....
_______________________________________________
opensc-devel mailing list
[email protected]
http://www.opensc-project.org/mailman/listinfo/opensc-devel
--
Douglas E. Engert <[EMAIL PROTECTED]>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
Index: card-gemsafeV1.c
===================================================================
--- card-gemsafeV1.c (revision 3300)
+++ card-gemsafeV1.c (working copy)
@@ -180,6 +180,7 @@
flags = SC_ALGORITHM_RSA_PAD_PKCS1;
flags |= SC_ALGORITHM_RSA_PAD_ISO9796;
flags |= SC_ALGORITHM_ONBOARD_KEY_GEN;
+ flags |= SC_ALGORITHM_RSA_HASH_NONE;
_sc_card_add_rsa_alg(card, 512, flags, 0);
_sc_card_add_rsa_alg(card, 768, flags, 0);
@@ -352,7 +353,7 @@
ret = 0x11;
} else if (env->operation == SC_SEC_OPERATION_DECIPHER) {
if (env->algorithm_flags & SC_ALGORITHM_RSA_PAD_PKCS1)
- ret = 0x13;
+ ret = 0x12;
}
return ret;
Index: pkcs15-gemsafeV1.c
===================================================================
--- pkcs15-gemsafeV1.c (revision 3300)
+++ pkcs15-gemsafeV1.c (working copy)
@@ -110,7 +110,7 @@
const prdata gemsafe_prkeys[] = {
{ "45", "DS key", 1024, USAGE_AUT, NULL,
- 0x03, "01", SC_PKCS15_CO_FLAG_PRIVATE},
+ 0x04, "01", SC_PKCS15_CO_FLAG_PRIVATE},
{ NULL, NULL, 0, 0, NULL, 0, NULL, 0}
};
_______________________________________________
opensc-devel mailing list
[email protected]
http://www.opensc-project.org/mailman/listinfo/opensc-devel
