|
 |
397a93 |
From b8bc3e183b43e9aeee8a8f23c8e48fffb6eedc35 Mon Sep 17 00:00:00 2001
|
|
|
397a93 |
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
|
397a93 |
Date: Fri, 4 Nov 2022 10:51:08 +0100
|
|
|
397a93 |
Subject: [PATCH 08/34] EP11: Supply CKA_PUBLIC_KEY_INFO when importing private
|
|
|
397a93 |
keys
|
|
|
397a93 |
|
|
|
397a93 |
When importing private keys, the SPKI of the corresponding public key
|
|
|
397a93 |
is returned in parameters csum/cslen of the m_UnwrapKey() EP11 host
|
|
|
397a93 |
library call. Supply this SPKI as CKA_PUBLIC_KEY_INFO to the object.
|
|
|
397a93 |
|
|
|
397a93 |
For public key import, the common code already builds the SPKI from
|
|
|
397a93 |
the clear public key attributes of the imported public key.
|
|
|
397a93 |
|
|
|
397a93 |
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
|
397a93 |
---
|
|
|
397a93 |
usr/lib/common/obj_mgr.c | 5 ++
|
|
|
397a93 |
usr/lib/ep11_stdll/ep11_specific.c | 113 +++++++++++++++++++++++++------------
|
|
|
397a93 |
2 files changed, 83 insertions(+), 35 deletions(-)
|
|
|
397a93 |
|
|
|
397a93 |
diff --git a/usr/lib/common/obj_mgr.c b/usr/lib/common/obj_mgr.c
|
|
|
397a93 |
index 8e61cbd4..347ec3f3 100644
|
|
|
397a93 |
--- a/usr/lib/common/obj_mgr.c
|
|
|
397a93 |
+++ b/usr/lib/common/obj_mgr.c
|
|
|
397a93 |
@@ -123,6 +123,11 @@ CK_RV object_mgr_add(STDLL_TokData_t *tokdata,
|
|
|
397a93 |
switch(class) {
|
|
|
397a93 |
case CKO_PUBLIC_KEY:
|
|
|
397a93 |
case CKO_PRIVATE_KEY:
|
|
|
397a93 |
+ /* Skip if there is already a non-empty CKA_PUBLIC_KEY_INFO */
|
|
|
397a93 |
+ if (template_attribute_get_non_empty(o->template, CKA_PUBLIC_KEY_INFO,
|
|
|
397a93 |
+ &spki_attr) == CKR_OK)
|
|
|
397a93 |
+ break;
|
|
|
397a93 |
+
|
|
|
397a93 |
rc = template_attribute_get_ulong(o->template, CKA_KEY_TYPE, &keytype);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("Could not find CKA_KEY_TYPE for the key object.\n");
|
|
|
397a93 |
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
397a93 |
index 886692c4..3b14a557 100644
|
|
|
397a93 |
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
397a93 |
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
397a93 |
@@ -2745,9 +2745,10 @@ static int get_curve_type_from_template(TEMPLATE *tmpl)
|
|
|
397a93 |
* SPKIs for public imported RSA keys.
|
|
|
397a93 |
* Similar to rawkey_2_blob, but keys must follow a standard BER encoding.
|
|
|
397a93 |
*/
|
|
|
397a93 |
-static CK_RV import_RSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
- OBJECT * rsa_key_obj,
|
|
|
397a93 |
- CK_BYTE * blob, size_t * blob_size)
|
|
|
397a93 |
+static CK_RV import_RSA_key(STDLL_TokData_t *tokdata, SESSION *sess,
|
|
|
397a93 |
+ OBJECT *rsa_key_obj,
|
|
|
397a93 |
+ CK_BYTE *blob, size_t *blob_size,
|
|
|
397a93 |
+ CK_BYTE *spki, size_t *spki_size)
|
|
|
397a93 |
{
|
|
|
397a93 |
ep11_private_data_t *ep11_data = tokdata->private_data;
|
|
|
397a93 |
CK_RV rc;
|
|
|
397a93 |
@@ -2759,8 +2760,6 @@ static CK_RV import_RSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
CK_ULONG attrs_len = 0;
|
|
|
397a93 |
CK_ATTRIBUTE_PTR new_p_attrs = NULL;
|
|
|
397a93 |
CK_ULONG new_attrs_len = 0;
|
|
|
397a93 |
- CK_BYTE csum[MAX_BLOBSIZE];
|
|
|
397a93 |
- CK_ULONG cslen = sizeof(csum);
|
|
|
397a93 |
CK_OBJECT_CLASS class;
|
|
|
397a93 |
CK_BYTE *data = NULL;
|
|
|
397a93 |
CK_ULONG data_len;
|
|
|
397a93 |
@@ -2831,6 +2830,8 @@ static CK_RV import_RSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
goto import_RSA_key_end;
|
|
|
397a93 |
}
|
|
|
397a93 |
|
|
|
397a93 |
+ *spki_size = 0; /* common code will extract SPKI from object */
|
|
|
397a93 |
+
|
|
|
397a93 |
} else {
|
|
|
397a93 |
|
|
|
397a93 |
/* imported private RSA key goes here */
|
|
|
397a93 |
@@ -2884,7 +2885,7 @@ static CK_RV import_RSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
ep11_data->raw2key_wrap_blob_l, NULL, ~0,
|
|
|
397a93 |
ep11_pin_blob, ep11_pin_blob_len, &mech_w,
|
|
|
397a93 |
new_p_attrs, new_attrs_len, blob, blob_size,
|
|
|
397a93 |
- csum, &cslen, target_info->target);
|
|
|
397a93 |
+ spki, spki_size, target_info->target);
|
|
|
397a93 |
RETRY_END(rc, tokdata, sess)
|
|
|
397a93 |
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
@@ -2921,9 +2922,10 @@ import_RSA_key_end:
|
|
|
397a93 |
* SPKIs for public imported EC keys.
|
|
|
397a93 |
* Similar to rawkey_2_blob, but keys must follow a standard BER encoding.
|
|
|
397a93 |
*/
|
|
|
397a93 |
-static CK_RV import_EC_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
- OBJECT * ec_key_obj,
|
|
|
397a93 |
- CK_BYTE * blob, size_t * blob_size)
|
|
|
397a93 |
+static CK_RV import_EC_key(STDLL_TokData_t *tokdata, SESSION *sess,
|
|
|
397a93 |
+ OBJECT *ec_key_obj,
|
|
|
397a93 |
+ CK_BYTE *blob, size_t *blob_size,
|
|
|
397a93 |
+ CK_BYTE *spki, size_t *spki_size)
|
|
|
397a93 |
{
|
|
|
397a93 |
ep11_private_data_t *ep11_data = tokdata->private_data;
|
|
|
397a93 |
CK_RV rc;
|
|
|
397a93 |
@@ -2935,8 +2937,6 @@ static CK_RV import_EC_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
CK_ULONG attrs_len = 0;
|
|
|
397a93 |
CK_ATTRIBUTE_PTR new_p_attrs = NULL;
|
|
|
397a93 |
CK_ULONG new_attrs_len = 0;
|
|
|
397a93 |
- CK_BYTE csum[MAX_BLOBSIZE];
|
|
|
397a93 |
- CK_ULONG cslen = sizeof(csum);
|
|
|
397a93 |
CK_OBJECT_CLASS class;
|
|
|
397a93 |
CK_BYTE *data = NULL;
|
|
|
397a93 |
CK_ULONG data_len;
|
|
|
397a93 |
@@ -3059,6 +3059,8 @@ static CK_RV import_EC_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
goto import_EC_key_end;
|
|
|
397a93 |
}
|
|
|
397a93 |
|
|
|
397a93 |
+ *spki_size = 0; /* common code will extract SPKI from object */
|
|
|
397a93 |
+
|
|
|
397a93 |
} else {
|
|
|
397a93 |
|
|
|
397a93 |
/* imported private EC key goes here */
|
|
|
397a93 |
@@ -3115,7 +3117,8 @@ static CK_RV import_EC_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
ep11_pin_blob,
|
|
|
397a93 |
ep11_pin_blob_len, &mech_w,
|
|
|
397a93 |
new_p_attrs, new_attrs_len, blob,
|
|
|
397a93 |
- blob_size, csum, &cslen, target_info->target);
|
|
|
397a93 |
+ blob_size, spki, spki_size,
|
|
|
397a93 |
+ target_info->target);
|
|
|
397a93 |
RETRY_END(rc, tokdata, sess)
|
|
|
397a93 |
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
@@ -3149,9 +3152,10 @@ import_EC_key_end:
|
|
|
397a93 |
* SPKIs for public imported DSA keys.
|
|
|
397a93 |
* Similar to rawkey_2_blob, but keys must follow a standard BER encoding.
|
|
|
397a93 |
*/
|
|
|
397a93 |
-static CK_RV import_DSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
- OBJECT * dsa_key_obj,
|
|
|
397a93 |
- CK_BYTE * blob, size_t * blob_size)
|
|
|
397a93 |
+static CK_RV import_DSA_key(STDLL_TokData_t *tokdata, SESSION *sess,
|
|
|
397a93 |
+ OBJECT *dsa_key_obj,
|
|
|
397a93 |
+ CK_BYTE *blob, size_t *blob_size,
|
|
|
397a93 |
+ CK_BYTE *spki, size_t *spki_size)
|
|
|
397a93 |
{
|
|
|
397a93 |
ep11_private_data_t *ep11_data = tokdata->private_data;
|
|
|
397a93 |
CK_RV rc;
|
|
|
397a93 |
@@ -3163,8 +3167,6 @@ static CK_RV import_DSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
CK_ULONG attrs_len = 0;
|
|
|
397a93 |
CK_ATTRIBUTE_PTR new_p_attrs = NULL;
|
|
|
397a93 |
CK_ULONG new_attrs_len = 0;
|
|
|
397a93 |
- CK_BYTE csum[MAX_BLOBSIZE];
|
|
|
397a93 |
- CK_ULONG cslen = sizeof(csum);
|
|
|
397a93 |
CK_OBJECT_CLASS class;
|
|
|
397a93 |
CK_BYTE *data = NULL;
|
|
|
397a93 |
CK_ULONG data_len;
|
|
|
397a93 |
@@ -3251,6 +3253,8 @@ static CK_RV import_DSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
goto import_DSA_key_end;
|
|
|
397a93 |
}
|
|
|
397a93 |
|
|
|
397a93 |
+ *spki_size = 0; /* common code will extract SPKI from object */
|
|
|
397a93 |
+
|
|
|
397a93 |
} else {
|
|
|
397a93 |
|
|
|
397a93 |
/* imported private DSA key goes here */
|
|
|
397a93 |
@@ -3307,7 +3311,8 @@ static CK_RV import_DSA_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
ep11_pin_blob,
|
|
|
397a93 |
ep11_pin_blob_len, &mech_w,
|
|
|
397a93 |
new_p_attrs, new_attrs_len, blob,
|
|
|
397a93 |
- blob_size, csum, &cslen, target_info->target);
|
|
|
397a93 |
+ blob_size, spki, spki_size,
|
|
|
397a93 |
+ target_info->target);
|
|
|
397a93 |
RETRY_END(rc, tokdata, sess)
|
|
|
397a93 |
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
@@ -3339,9 +3344,10 @@ import_DSA_key_end:
|
|
|
397a93 |
* SPKIs for public imported DH keys.
|
|
|
397a93 |
* Similar to rawkey_2_blob, but keys must follow a standard BER encoding.
|
|
|
397a93 |
*/
|
|
|
397a93 |
-static CK_RV import_DH_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
- OBJECT * dh_key_obj,
|
|
|
397a93 |
- CK_BYTE * blob, size_t * blob_size)
|
|
|
397a93 |
+static CK_RV import_DH_key(STDLL_TokData_t *tokdata, SESSION *sess,
|
|
|
397a93 |
+ OBJECT *dh_key_obj,
|
|
|
397a93 |
+ CK_BYTE *blob, size_t *blob_size,
|
|
|
397a93 |
+ CK_BYTE *spki, size_t *spki_size)
|
|
|
397a93 |
{
|
|
|
397a93 |
ep11_private_data_t *ep11_data = tokdata->private_data;
|
|
|
397a93 |
CK_RV rc;
|
|
|
397a93 |
@@ -3353,8 +3359,6 @@ static CK_RV import_DH_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
CK_ULONG attrs_len = 0;
|
|
|
397a93 |
CK_ATTRIBUTE_PTR new_p_attrs = NULL;
|
|
|
397a93 |
CK_ULONG new_attrs_len = 0;
|
|
|
397a93 |
- CK_BYTE csum[MAX_BLOBSIZE];
|
|
|
397a93 |
- CK_ULONG cslen = sizeof(csum);
|
|
|
397a93 |
CK_OBJECT_CLASS class;
|
|
|
397a93 |
CK_BYTE *data = NULL;
|
|
|
397a93 |
CK_ULONG data_len;
|
|
|
397a93 |
@@ -3433,6 +3437,8 @@ static CK_RV import_DH_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
goto import_DH_key_end;
|
|
|
397a93 |
}
|
|
|
397a93 |
|
|
|
397a93 |
+ *spki_size = 0; /* common code will extract SPKI from object */
|
|
|
397a93 |
+
|
|
|
397a93 |
} else {
|
|
|
397a93 |
CK_ATTRIBUTE *value;
|
|
|
397a93 |
CK_ATTRIBUTE *value_bits;
|
|
|
397a93 |
@@ -3500,7 +3506,8 @@ static CK_RV import_DH_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
ep11_pin_blob,
|
|
|
397a93 |
ep11_pin_blob_len, &mech_w,
|
|
|
397a93 |
new_p_attrs, new_attrs_len, blob,
|
|
|
397a93 |
- blob_size, csum, &cslen, target_info->target);
|
|
|
397a93 |
+ blob_size, spki, spki_size,
|
|
|
397a93 |
+ target_info->target);
|
|
|
397a93 |
RETRY_END(rc, tokdata, sess)
|
|
|
397a93 |
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
@@ -3547,9 +3554,10 @@ import_DH_key_end:
|
|
|
397a93 |
* SPKIs for public imported IBM Dilithium keys.
|
|
|
397a93 |
* Similar to rawkey_2_blob, but keys must follow a standard BER encoding.
|
|
|
397a93 |
*/
|
|
|
397a93 |
-static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
- OBJECT * dilithium_key_obj,
|
|
|
397a93 |
- CK_BYTE * blob, size_t * blob_size)
|
|
|
397a93 |
+static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t *tokdata, SESSION *sess,
|
|
|
397a93 |
+ OBJECT *dilithium_key_obj,
|
|
|
397a93 |
+ CK_BYTE *blob, size_t *blob_size,
|
|
|
397a93 |
+ CK_BYTE *spki, size_t *spki_size)
|
|
|
397a93 |
{
|
|
|
397a93 |
ep11_private_data_t *ep11_data = tokdata->private_data;
|
|
|
397a93 |
CK_RV rc;
|
|
|
397a93 |
@@ -3561,8 +3569,6 @@ static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
CK_ULONG attrs_len = 0;
|
|
|
397a93 |
CK_ATTRIBUTE_PTR new_p_attrs = NULL;
|
|
|
397a93 |
CK_ULONG new_attrs_len = 0;
|
|
|
397a93 |
- CK_BYTE csum[MAX_BLOBSIZE];
|
|
|
397a93 |
- CK_ULONG cslen = sizeof(csum);
|
|
|
397a93 |
CK_OBJECT_CLASS class;
|
|
|
397a93 |
CK_BYTE *data = NULL;
|
|
|
397a93 |
CK_ULONG data_len;
|
|
|
397a93 |
@@ -3652,6 +3658,8 @@ static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
goto done;
|
|
|
397a93 |
}
|
|
|
397a93 |
|
|
|
397a93 |
+ *spki_size = 0; /* common code will extract SPKI from object */
|
|
|
397a93 |
+
|
|
|
397a93 |
} else {
|
|
|
397a93 |
|
|
|
397a93 |
/* imported private IBM Dilithium key goes here */
|
|
|
397a93 |
@@ -3709,7 +3717,8 @@ static CK_RV import_IBM_Dilithium_key(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
ep11_pin_blob,
|
|
|
397a93 |
ep11_pin_blob_len, &mech_w,
|
|
|
397a93 |
new_p_attrs, new_attrs_len, blob,
|
|
|
397a93 |
- blob_size, csum, &cslen, target_info->target);
|
|
|
397a93 |
+ blob_size, spki, spki_size,
|
|
|
397a93 |
+ target_info->target);
|
|
|
397a93 |
RETRY_END(rc, tokdata, sess)
|
|
|
397a93 |
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
@@ -3747,9 +3756,13 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
CK_ATTRIBUTE *attr = NULL;
|
|
|
397a93 |
CK_BYTE blob[MAX_BLOBSIZE];
|
|
|
397a93 |
size_t blobsize = sizeof(blob);
|
|
|
397a93 |
+ CK_BYTE spki[MAX_BLOBSIZE];
|
|
|
397a93 |
+ size_t spkisize = sizeof(spki);
|
|
|
397a93 |
CK_RV rc;
|
|
|
397a93 |
CK_ULONG class;
|
|
|
397a93 |
CK_BBOOL attrbound;
|
|
|
397a93 |
+ CK_BYTE *temp;
|
|
|
397a93 |
+ CK_ULONG temp_len;
|
|
|
397a93 |
|
|
|
397a93 |
/* get key type */
|
|
|
397a93 |
rc = template_attribute_get_ulong(obj->template, CKA_KEY_TYPE, &keytype);
|
|
|
397a93 |
@@ -3783,7 +3796,8 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
/* only these keys can be imported */
|
|
|
397a93 |
switch (keytype) {
|
|
|
397a93 |
case CKK_RSA:
|
|
|
397a93 |
- rc = import_RSA_key(tokdata, sess, obj, blob, &blobsize);
|
|
|
397a93 |
+ rc = import_RSA_key(tokdata, sess, obj, blob, &blobsize,
|
|
|
397a93 |
+ spki, &spkisize);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("%s import RSA key rc=0x%lx blobsize=0x%zx\n",
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
@@ -3793,7 +3807,8 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
break;
|
|
|
397a93 |
case CKK_EC:
|
|
|
397a93 |
- rc = import_EC_key(tokdata, sess, obj, blob, &blobsize);
|
|
|
397a93 |
+ rc = import_EC_key(tokdata, sess, obj, blob, &blobsize,
|
|
|
397a93 |
+ spki, &spkisize);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("%s import EC key rc=0x%lx blobsize=0x%zx\n",
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
@@ -3803,7 +3818,8 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
break;
|
|
|
397a93 |
case CKK_DSA:
|
|
|
397a93 |
- rc = import_DSA_key(tokdata, sess, obj, blob, &blobsize);
|
|
|
397a93 |
+ rc = import_DSA_key(tokdata, sess, obj, blob, &blobsize,
|
|
|
397a93 |
+ spki, &spkisize);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("%s import DSA key rc=0x%lx blobsize=0x%zx\n",
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
@@ -3813,7 +3829,8 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
break;
|
|
|
397a93 |
case CKK_DH:
|
|
|
397a93 |
- rc = import_DH_key(tokdata, sess, obj, blob, &blobsize);
|
|
|
397a93 |
+ rc = import_DH_key(tokdata, sess, obj, blob, &blobsize,
|
|
|
397a93 |
+ spki, &spkisize);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("%s import DH key rc=0x%lx blobsize=0x%zx\n",
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
@@ -3823,7 +3840,8 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
break;
|
|
|
397a93 |
case CKK_IBM_PQC_DILITHIUM:
|
|
|
397a93 |
- rc = import_IBM_Dilithium_key(tokdata, sess, obj, blob, &blobsize);
|
|
|
397a93 |
+ rc = import_IBM_Dilithium_key(tokdata, sess, obj, blob, &blobsize,
|
|
|
397a93 |
+ spki, &spkisize);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("%s import IBM Dilithium key rc=0x%lx blobsize=0x%zx\n",
|
|
|
397a93 |
__func__, rc, blobsize);
|
|
|
397a93 |
@@ -3891,6 +3909,31 @@ CK_RV token_specific_object_add(STDLL_TokData_t * tokdata, SESSION * sess,
|
|
|
397a93 |
return rc;
|
|
|
397a93 |
}
|
|
|
397a93 |
|
|
|
397a93 |
+ if (spkisize > 0 && (class == CKO_PRIVATE_KEY || class == CKO_PUBLIC_KEY)) {
|
|
|
397a93 |
+ /* spki may be a MACed SPKI, get length of SPKI part only */
|
|
|
397a93 |
+ rc = ber_decode_SEQUENCE(spki, &temp, &temp_len, &spkisize);
|
|
|
397a93 |
+ if (rc != CKR_OK) {
|
|
|
397a93 |
+ TRACE_ERROR("%s ber_decode_SEQUENCE failed rc=0x%lx\n",
|
|
|
397a93 |
+ __func__, rc);
|
|
|
397a93 |
+ return rc;
|
|
|
397a93 |
+ }
|
|
|
397a93 |
+
|
|
|
397a93 |
+ rc = build_attribute(CKA_PUBLIC_KEY_INFO, spki, spkisize, &attr);
|
|
|
397a93 |
+ if (rc != CKR_OK) {
|
|
|
397a93 |
+ TRACE_ERROR("%s build_attribute failed with rc=0x%lx\n", __func__,
|
|
|
397a93 |
+ rc);
|
|
|
397a93 |
+ return rc;
|
|
|
397a93 |
+ }
|
|
|
397a93 |
+
|
|
|
397a93 |
+ rc = template_update_attribute(obj->template, attr);
|
|
|
397a93 |
+ if (rc != CKR_OK) {
|
|
|
397a93 |
+ TRACE_ERROR("%s template_update_attribute failed with rc=0x%lx\n",
|
|
|
397a93 |
+ __func__, rc);
|
|
|
397a93 |
+ free(attr);
|
|
|
397a93 |
+ return rc;
|
|
|
397a93 |
+ }
|
|
|
397a93 |
+ }
|
|
|
397a93 |
+
|
|
|
397a93 |
rc = update_ep11_attrs_from_blob(tokdata, sess, obj->template);
|
|
|
397a93 |
if (rc != CKR_OK) {
|
|
|
397a93 |
TRACE_ERROR("%s update_ep11_attrs_from_blob failed with rc=0x%lx\n",
|
|
|
397a93 |
--
|
|
|
397a93 |
2.16.2.windows.1
|
|
|
397a93 |
|