From 30e85a8c82ee0b1706074f53b620a202d0485c1b690aea188e9e953e00c5fe3d Mon Sep 17 00:00:00 2001 From: Mark Post Date: Wed, 23 Mar 2022 17:53:12 +0000 Subject: [PATCH] Accepting request 964348 from home:markkp:branches:security - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch OBS-URL: https://build.opensuse.org/request/show/964348 OBS-URL: https://build.opensuse.org/package/show/security/openCryptoki?expand=0&rev=122 --- ...pecify-OID-of-key-strength-at-key-ge.patch | 56 ++++++++++++++++ ...-EP11-Fix-host-library-version-query.patch | 66 +++++++++++++++++++ openCryptoki.changes | 9 +++ openCryptoki.spec | 6 +- 4 files changed, 136 insertions(+), 1 deletion(-) create mode 100644 openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch create mode 100644 openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch diff --git a/openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch b/openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch new file mode 100644 index 0000000..324366a --- /dev/null +++ b/openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch @@ -0,0 +1,56 @@ +From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001 +From: Ingo Franzki +Date: Tue, 1 Feb 2022 13:50:18 +0100 +Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key + generation + +Newer EP11 firmware versions require that the OID of the desired +Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS +at key generation. Older firmware versions ignore this attribute. + +Signed-off-by: Ingo Franzki +--- + usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c +index 75fd46a5..4ca9678a 100644 +--- a/usr/lib/ep11_stdll/ep11_specific.c ++++ b/usr/lib/ep11_stdll/ep11_specific.c +@@ -6347,6 +6347,8 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata, + CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0; + CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL; + CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0; ++ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01, ++ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 }; + + UNUSED(h); + +@@ -6371,6 +6373,24 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata, + goto error; + } + ++ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len, ++ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid, ++ sizeof(dilithium_oid)); ++ if (rc != CKR_OK) { ++ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n", ++ __func__, rc); ++ goto error; ++ } ++ ++ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len, ++ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid, ++ sizeof(dilithium_oid)); ++ if (rc != CKR_OK) { ++ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n", ++ __func__, rc); ++ goto error; ++ } ++ + rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY, + new_publ_attrs, new_publ_attrs_len, + &new_publ_attrs2, &new_publ_attrs2_len, -1); +-- +2.16.2.windows.1 + diff --git a/openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch b/openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch new file mode 100644 index 0000000..c64cfda --- /dev/null +++ b/openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch @@ -0,0 +1,66 @@ +From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001 +From: Ingo Franzki +Date: Tue, 8 Mar 2022 15:01:24 +0100 +Subject: [PATCH 2/2] EP11: Fix host library version query + +Look at release and modification level, not just the modification level. +Release and modification level are encoded into the one byte minor +field of a CK_VERSION. The high order 4 bits are the release number, the +low order 4 bits the modification level. + +This allows host library version checks for release and modification levels. + +Signed-off-by: Ingo Franzki +--- + usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c +index 4ca9678a..2d7581fa 100644 +--- a/usr/lib/ep11_stdll/ep11_specific.c ++++ b/usr/lib/ep11_stdll/ep11_specific.c +@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber, + goto error; + } + +- TRACE_INFO("%s Host library version: %d.%d\n", __func__, ++ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__, + ep11_data->ep11_lib_version.major, +- ep11_data->ep11_lib_version.minor); ++ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4, ++ (ep11_data->ep11_lib_version.minor & 0x0F)); + + rc = refresh_target_info(tokdata); + if (rc != CKR_OK) { +@@ -11289,8 +11290,19 @@ static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version) + rc); + return rc; + } ++ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version); + lib_version->major = (host_version & 0x00FF0000) >> 16; +- lib_version->minor = host_version & 0x000000FF; ++ /* Minor is 4 bits release number and 4 bits modification level */ ++ lib_version->minor = (host_version & 0x00000F00) >> 4 | ++ (host_version & 0x0000000F); ++ if ((host_version & 0x0000F000) != 0) { ++ lib_version->minor |= 0xF0; ++ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__); ++ } ++ if ((host_version & 0x000000F0) != 0) { ++ lib_version->minor |= 0x0F; ++ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__); ++ } + /* + * EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This + * can safely be treated as version 1.0 +@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t *tokdata, + if (target_info->card_versions != NULL) + pInfo->hardwareVersion = target_info->card_versions->firmware_version; + pInfo->firmwareVersion = ep11_data->ep11_lib_version; ++ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */ + memcpy(pInfo->serialNumber, target_info->serialNumber, + sizeof(pInfo->serialNumber)); + +-- +2.16.2.windows.1 + diff --git a/openCryptoki.changes b/openCryptoki.changes index ddab622..b77388a 100644 --- a/openCryptoki.changes +++ b/openCryptoki.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Wed Mar 23 15:32:25 UTC 2022 - Mark Post + +- Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM + mechanism does not show up as supported by the EP11 token when an + upgraded EP11 host library is used. + * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch + * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch + ------------------------------------------------------------------- Thu Oct 21 19:31:51 UTC 2021 - Mark Post diff --git a/openCryptoki.spec b/openCryptoki.spec index c23d599..ac44808 100644 --- a/openCryptoki.spec +++ b/openCryptoki.spec @@ -1,7 +1,7 @@ # # spec file for package openCryptoki # -# Copyright (c) 2018-2021 SUSE LLC +# Copyright (c) 2018-2022 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -39,6 +39,8 @@ Source3: openCryptoki-rpmlintrc # Patch 1 is needed because group pkcs11 doesn't exist in the build environment # and because we don't want(?) various file and directory permissions to be 0700. Patch1: ocki-3.11-remove-make-install-chgrp.patch +Patch2: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch +Patch3: openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch BuildRequires: bison BuildRequires: dos2unix BuildRequires: flex @@ -128,6 +130,8 @@ Cryptographic Accelerator (FC 4960 on pSeries). %prep %setup -q -n %{oc_cvs_tag}-%{version} %patch1 -p1 +%patch2 -p1 +%patch3 -p1 cp %{SOURCE2} .