Skip to content

Commit 29450e5

Browse files
metsmakristelmerilain
metsma
authored and
kristelmerilain
committed
Throw exception when PIN should changed
IB-8666 Signed-off-by: Raul Metsma <[email protected]>
1 parent 96dc74b commit 29450e5

File tree

3 files changed

+32
-41
lines changed

3 files changed

+32
-41
lines changed

‎src/crypto/Digest.cpp‎

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -47,29 +47,10 @@ Digest::Digest(string_view uri)
4747
THROW_OPENSSLEXCEPTION("Failed to initialize %.*s digest calculator", int(uri.size()), uri.data());
4848
}
4949

50-
vector<unsigned char> Digest::addDigestInfo(vector<unsigned char> digest, string_view uri)
51-
{
52-
switch(toMethod(uri))
53-
{
54-
case NID_sha1: digest.insert(digest.cbegin(),
55-
{0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14}); break;
56-
case NID_sha224: digest.insert(digest.cbegin(),
57-
{0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1c}); break;
58-
case NID_sha256: digest.insert(digest.cbegin(),
59-
{0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20}); break;
60-
case NID_sha384: digest.insert(digest.begin(),
61-
{0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30}); break;
62-
case NID_sha512: digest.insert(digest.cbegin(),
63-
{0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40}); break;
64-
default: break;
65-
}
66-
return digest;
67-
}
68-
6950
vector<unsigned char> Digest::digestInfoDigest(const std::vector<unsigned char> &digest)
7051
{
7152
const unsigned char *p = digest.data();
72-
SCOPE(X509_SIG, sig, d2i_X509_SIG(nullptr, &p, long(digest.size())));
53+
auto sig = make_unique_ptr<X509_SIG_free>(d2i_X509_SIG(nullptr, &p, long(digest.size())));
7354
if(!sig)
7455
return {};
7556
const ASN1_OCTET_STRING *value {};
@@ -80,7 +61,7 @@ vector<unsigned char> Digest::digestInfoDigest(const std::vector<unsigned char>
8061
string Digest::digestInfoUri(const std::vector<unsigned char> &digest)
8162
{
8263
const unsigned char *p = digest.data();
83-
SCOPE(X509_SIG, sig, d2i_X509_SIG(nullptr, &p, long(digest.size())));
64+
auto sig = make_unique_ptr<X509_SIG_free>(d2i_X509_SIG(nullptr, &p, long(digest.size())));
8465
if(!sig)
8566
return {};
8667
const X509_ALGOR *algor {};

‎src/crypto/Digest.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,6 @@ namespace digidoc
8585
static std::string toEcUri(const std::string &uri);
8686
static int toMethod(std::string_view uri);
8787
static std::string toUri(int nid);
88-
static std::vector<unsigned char> addDigestInfo(std::vector<unsigned char> digest, std::string_view uri);
8988
static std::vector<unsigned char> digestInfoDigest(const std::vector<unsigned char> &digest);
9089
static std::string digestInfoUri(const std::vector<unsigned char> &digest);
9190

‎src/crypto/PKCS11Signer.cpp‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -254,8 +254,7 @@ X509Cert PKCS11Signer::cert() const
254254
CK_OBJECT_HANDLE obj: session.findObject(CKO_CERTIFICATE))
255255
{
256256
X509Cert x509(session.attribute(obj, CKA_VALUE));
257-
vector<X509Cert::KeyUsage> usage = x509.keyUsage();
258-
if(!x509.isValid() || !contains(usage, X509Cert::NonRepudiation) || x509.isCA())
257+
if(x509.isCA() || !x509.isValid() || !contains(x509.keyUsage(), X509Cert::NonRepudiation))
259258
continue;
260259
vector<CK_BYTE> id = session.attribute(obj, CKA_ID);
261260
if(session.findObject(CKO_PUBLIC_KEY, id).empty())
@@ -292,8 +291,7 @@ string PKCS11Signer::method() const
292291
if(!d->sign.certificate || !X509Crypto(d->sign.certificate).isRSAKey() ||
293292
parent != CONF(signatureDigestUri))
294293
return parent;
295-
if(auto mech = PKCS11List<&CK_FUNCTION_LIST::C_GetMechanismList>(d->f, d->sign.slot);
296-
contains(mech, CKM_RSA_PKCS_PSS))
294+
if(contains(PKCS11List<&CK_FUNCTION_LIST::C_GetMechanismList>(d->f, d->sign.slot), CKM_RSA_PKCS_PSS))
297295
return Digest::toRsaPssUri(std::move(parent));
298296
return parent;
299297
}
@@ -362,6 +360,8 @@ vector<unsigned char> PKCS11Signer::sign(const string &method, const vector<unsi
362360
if(d->f->C_GetTokenInfo(d->sign.slot, &token) != CKR_OK)
363361
THROW("Failed to get token info.");
364362

363+
if(token.flags & CKF_USER_PIN_TO_BE_CHANGED)
364+
THROW("PIN must be changed");
365365
if(token.flags & CKF_USER_PIN_LOCKED)
366366
{
367367
Exception e(EXCEPTION_PARAMS("PIN Locked"));
@@ -373,9 +373,9 @@ vector<unsigned char> PKCS11Signer::sign(const string &method, const vector<unsi
373373
if(!session)
374374
THROW("Failed to open session.");
375375

376-
CK_RV rv = CKR_OK;
377376
if(token.flags & CKF_LOGIN_REQUIRED)
378377
{
378+
CK_RV rv = CKR_OK;
379379
if(token.flags & CKF_PROTECTED_AUTHENTICATION_PATH)
380380
rv = d->f->C_Login(session.handle, CKU_USER, nullptr, 0);
381381
else
@@ -422,32 +422,43 @@ vector<unsigned char> PKCS11Signer::sign(const string &method, const vector<unsi
422422
CK_ATTRIBUTE attribute { CKA_KEY_TYPE, &keyType, sizeof(keyType) };
423423
d->f->C_GetAttributeValue(session.handle, key.front(), &attribute, 1);
424424

425-
CK_RSA_PKCS_PSS_PARAMS pssParams { CKM_SHA_1, CKG_MGF1_SHA1, 0 };
425+
CK_RSA_PKCS_PSS_PARAMS pssParams { CKM_SHA256, CKG_MGF1_SHA256, 0 };
426426
CK_MECHANISM mech { keyType == CKK_ECDSA ? CKM_ECDSA : CKM_RSA_PKCS, nullptr, 0 };
427427
vector<CK_BYTE> data = digest;
428428
if(Digest::isRsaPssUri(method)) {
429429
int nid = Digest::toMethod(method);
430430
switch(nid)
431431
{
432-
case NID_sha224:
433-
pssParams = { CKM_SHA224, CKG_MGF1_SHA224, 0 };
434-
break;
435-
case NID_sha256:
436-
pssParams = { CKM_SHA256, CKG_MGF1_SHA256, 0 };
437-
break;
438-
case NID_sha384:
439-
pssParams = { CKM_SHA384, CKG_MGF1_SHA384, 0 };
440-
break;
441-
case NID_sha512:
442-
pssParams = { CKM_SHA512, CKG_MGF1_SHA512, 0 };
443-
break;
432+
case NID_sha224: pssParams = { CKM_SHA224, CKG_MGF1_SHA224, 0 }; break;
433+
case NID_sha256: pssParams = { CKM_SHA256, CKG_MGF1_SHA256, 0 }; break;
434+
case NID_sha384: pssParams = { CKM_SHA384, CKG_MGF1_SHA384, 0 }; break;
435+
case NID_sha512: pssParams = { CKM_SHA512, CKG_MGF1_SHA512, 0 }; break;
436+
case NID_sha3_224: pssParams = { CKM_SHA3_224, CKG_MGF1_SHA3_224, 0 }; break;
437+
case NID_sha3_256: pssParams = { CKM_SHA3_256, CKG_MGF1_SHA3_256, 0 }; break;
438+
case NID_sha3_384: pssParams = { CKM_SHA3_384, CKG_MGF1_SHA3_384, 0 }; break;
439+
case NID_sha3_512: pssParams = { CKM_SHA3_512, CKG_MGF1_SHA3_512, 0 }; break;
444440
default: break;
445441
}
446442
pssParams.sLen = CK_ULONG(EVP_MD_size(EVP_get_digestbynid(nid)));
447443
mech = { CKM_RSA_PKCS_PSS, &pssParams, sizeof(CK_RSA_PKCS_PSS_PARAMS) };
448444
}
449445
else if(keyType == CKK_RSA)
450-
data = Digest::addDigestInfo(std::move(data), method);
446+
{
447+
switch(Digest::toMethod(method))
448+
{
449+
case NID_sha1: data.insert(data.cbegin(),
450+
{0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14}); break;
451+
case NID_sha224: data.insert(data.cbegin(),
452+
{0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04, 0x1c}); break;
453+
case NID_sha256: data.insert(data.cbegin(),
454+
{0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20}); break;
455+
case NID_sha384: data.insert(data.begin(),
456+
{0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30}); break;
457+
case NID_sha512: data.insert(data.cbegin(),
458+
{0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40}); break;
459+
default: break;
460+
}
461+
}
451462
if(d->f->C_SignInit(session.handle, &mech, key.front()) != CKR_OK)
452463
THROW("Failed to sign digest");
453464

0 commit comments

Comments
 (0)