diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c.cfu 2011-10-18 09:16:08.362000000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c 2011-10-19 17:55:01.162000000 -0700
@@ -283,8 +283,9 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
status = PK11_WrapPrivKey(slot, wrapping, toBeWrapped, mech, param,
&wrapped, NULL /* wincx */ );
if(status != SECSuccess) {
- JSS_throwMsg(env, TOKEN_EXCEPTION,
- "Wrapping operation failed on token");
+ char err[256] = {0};
+ PR_snprintf(err, 256, "Wrapping operation failed on token:%d", PR_GetError());
+ JSS_throwMsg(env, TOKEN_EXCEPTION, err);
goto finish;
}
PR_ASSERT(wrapped.len>0 && wrapped.data!=NULL);
@@ -328,11 +329,15 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
int numAttribs = 0;
CK_TOKEN_INFO tokenInfo;
+ /* ideal defaults */
PRBool isSensitive = PR_TRUE;
PRBool isExtractable = PR_FALSE;
- /* special case nethsm*/
+
+ /* special case nethsm and lunasa*/
CK_UTF8CHAR nethsmLabel[4] = {'N','H','S','M'};
+ CK_UTF8CHAR lunasaLabel[4] = {'l','u','n','a'};
PRBool isNethsm = PR_TRUE;
+ PRBool isLunasa = PR_TRUE;
if( JSS_PK11_getTokenSlotPtr(env, tokenObj, &slot) != PR_SUCCESS) {
/* exception was thrown */
@@ -347,9 +352,17 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
break;
}
}
+ ix = 0;
+ for(ix=0; ix < 4; ix++) {
+ if (tokenInfo.label[ix] != lunasaLabel[ix]) {
+ isLunasa = PR_FALSE;
+ break;
+ }
+ }
} else {
isNethsm = PR_FALSE;
+ isLunasa = PR_FALSE;
}
/* get unwrapping key */
@@ -412,23 +425,25 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
}
keyType = PK11_GetKeyType(keyTypeMech, 0);
+ /* special case nethsm and lunasa*/
if( isNethsm ) {
isSensitive = PR_FALSE;
isExtractable = PR_FALSE;
+ } else if ( isLunasa) {
+ isSensitive = PR_FALSE;
+ isExtractable = PR_TRUE;
}
-setAttrs:
/* figure out which operations to enable for this key */
switch (keyType) {
case CKK_RSA:
+ numAttribs = 3;
attribs[0] = CKA_SIGN;
attribs[1] = CKA_SIGN_RECOVER;
attribs[2] = CKA_UNWRAP;
if (isExtractable) {
attribs[3] = CKA_EXTRACTABLE;
numAttribs = 4;
- } else {
- numAttribs = 3;
}
break;
case CKK_DSA:
@@ -459,7 +474,9 @@ setAttrs:
&label, pubValue, token, isSensitive /*sensitive*/, keyType,
attribs, numAttribs, NULL /*wincx*/);
if( privk == NULL ) {
- JSS_throwMsg(env, TOKEN_EXCEPTION, "Key Unwrap failed on token");
+ char err[256] = {0};
+ PR_snprintf(err, 256, "Key Unwrap failed on token:%d", PR_GetError());
+ JSS_throwMsg(env, TOKEN_EXCEPTION, err);
goto finish;
}
diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java.cfu 2011-10-18 15:29:50.597000000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java 2011-10-18 15:49:40.073000000 -0700
@@ -322,10 +322,13 @@ final class PK11KeyWrapper implements Ke
throw new InvalidKeyException("key to be wrapped is not a "+
"PKCS #11 key");
}
+/* NSS is capable of moving keys appropriately,
+ so this call is prematurely bailing
if( ! symKey.getOwningToken().equals(token) ) {
throw new InvalidKeyException("key to be wrapped does not live"+
" on the same token as the wrapping key");
}
+*/
}
/**
@@ -340,10 +343,13 @@ final class PK11KeyWrapper implements Ke
throw new InvalidKeyException("key to be wrapped is not a "+
"PKCS #11 key");
}
+/* NSS is capable of moving keys appropriately,
+ so this call is prematurely bailing
if( ! privKey.getOwningToken().equals(token) ) {
throw new InvalidKeyException("key to be wrapped does not live"+
" on the same token as the wrapping key");
}
+*/
}
/**
diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java.cfu 2011-10-18 14:34:32.148000000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java 2011-10-18 14:35:20.402000000 -0700
@@ -135,10 +135,13 @@ public final class PK11Token implements
getKeyWrapper(KeyWrapAlgorithm algorithm)
throws NoSuchAlgorithmException, TokenException
{
+/* NSS is capable of finding the right token to do algorithm,
+ so this call is prematurely bailing
if( ! doesAlgorithm(algorithm) ) {
throw new NoSuchAlgorithmException(
algorithm+" is not supported by this token");
}
+*/
return new PK11KeyWrapper(this, algorithm);
}
diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java.cfu 2011-10-18 09:24:13.796001000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java 2011-10-18 15:41:24.687000000 -0700
@@ -243,7 +243,7 @@ public class EncryptedPrivateKeyInfo imp
}
KeyWrapper wrapper = token.getKeyWrapper(
- KeyWrapAlgorithm.DES3_CBC);
+ KeyWrapAlgorithm.DES3_CBC_PAD);
wrapper.initWrap(key, params);
byte encrypted[] = wrapper.wrap(pri);
@@ -260,6 +260,7 @@ public class EncryptedPrivateKeyInfo imp
return epki;
} catch (Exception e) {
+ System.out.println("createPBE: exception:"+e.toString());
Assert.notReached("EncryptedPrivateKeyInfo exception:"
+".createPBE");
}