Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-21 Thread Ludovic Rousseau
2009/9/21 Andreas Jellinghaus : > Am Sonntag 20 September 2009 17:25:59 schrieb Martin Paljak: >> Hmm, that is an interesting idea. It would also have to include scconf >> which currently is distributed separately, but then again is also used >> by other software like pam_pkcs11 for example. > > ye

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-21 Thread Andreas Jellinghaus
Am Montag 21 September 2009 10:24:05 schrieb Alon Bar-Lev: > You *CAN* use the OpenSSH PKCS#11 patch *WITHOUT* OpenSSH X.509 patch. sorry, I had forgotten about that. Andreas ___ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://www

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-21 Thread Alon Bar-Lev
On Mon, Sep 21, 2009 at 11:08 AM, Andreas Jellinghaus wrote: > I wouldn't like to kill opensc support in openssh, unless we have a > lightwight patch to enable it with pkcs#11. (i.e. not a patch that > adds full x.509 stuff. I know you have one that does this, but for > me it's not simple enough,

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-21 Thread João Poupino
Hi everyone, On Sep 21, 2009, at 9:08, Andreas Jellinghaus wrote: > I wouldn't like to kill opensc support in openssh, unless we have a > lightwight patch to enable it with pkcs#11. (i.e. not a patch that > adds full x.509 stuff. I know you have one that does this, but for > me it's not simple en

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-21 Thread Andreas Jellinghaus
Am Montag 21 September 2009 08:43:16 schrieb Alon Bar-Lev: > On Sun, Sep 20, 2009 at 6:25 PM, Martin Paljak wrote: > > > not sure if the changes we have so far break ABI. but if we break ABI, > > > then I favor to merge libopensc, libpkcs15init and opensc-pcks11.so > > > into one library / shared

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-21 Thread Andreas Jellinghaus
Am Sonntag 20 September 2009 17:25:59 schrieb Martin Paljak: > Hmm, that is an interesting idea. It would also have to include scconf > which currently is distributed separately, but then again is also used > by other software like pam_pkcs11 for example. yes, but don't they use a copy of the code

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-20 Thread Alon Bar-Lev
On Sun, Sep 20, 2009 at 6:25 PM, Martin Paljak wrote: > > not sure if the changes we have so far break ABI. but if we break ABI, > > then I favor to merge libopensc, libpkcs15init and opensc-pcks11.so > > into one library / shared object. > > Hmm, that is an interesting idea. It would also have to

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-20 Thread Martin Paljak
On 18.09.2009, at 12:02, Andreas Jellinghaus wrote: > Am Donnerstag 17 September 2009 10:41:56 schrieb Martin Paljak: >> I'm not an expert on pkcs15init nor know the historical and >> philosophical reasons for the separation between libopensc and >> pkcs15init. > I guess noone is. lets considere it

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-18 Thread Ludovic Rousseau
2009/9/18 Andreas Jellinghaus : > other things we could clean up: > * keep license LGPL 2.1+ or change to LGPL 3.0+? Why changing? But I have no objection either. > * keep allowing drivers with no source or mandate changes >  to libopensc be LGPL'ed (or compatible)? I don't know of any proprieta

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-18 Thread Ludovic Rousseau
2009/9/10 Roman Himmes : > Hi, > > regarding to our problem with accessing multiple PIN protected > storages with pkcs11, we investigated the problem. > It seems that the keycache may get entries, with an invalid length > arguments. > > > Problem that has been solved with the attached patch: > > Pr

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-18 Thread Andreas Jellinghaus
Am Donnerstag 17 September 2009 10:41:56 schrieb Martin Paljak: > I'm not an expert on pkcs15init nor know the historical and > philosophical reasons for the separation between libopensc and > pkcs15init. I guess noone is. lets considere it historic development. > I'll push the change to my 0.12

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-17 Thread Martin Paljak
Hi. I have a generic question regarding this issue and a possible "fixup" for it as well. A security audit which included Estonian eID code paths in OpenSC (via PKCS#11 module) and OpenSC.tokend noticed that there are several places that cache (the) PIN code(s) (In case of Estonian eID it

Re: [opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-16 Thread Ludovic Rousseau
Hello Roman, I have no idea what your patch is doing. So I can't say if it works or not, or has side effects. Anyone else has a comment on it? Should we just (blindly) apply it? Bye 2009/9/10 Roman Himmes : > Hi, > > regarding to our problem with accessing multiple PIN protected > storages with

[opensc-devel] Patch to fix pkcs11 access with multiple PINs

2009-09-10 Thread Roman Himmes
Hi, regarding to our problem with accessing multiple PIN protected storages with pkcs11, we investigated the problem. It seems that the keycache may get entries, with an invalid length arguments. Problem that has been solved with the attached patch: Prerequisite: 2 PIN protected areas on Cr