GPGSM detached signature without auth attributes

[Jernej Kos]

Hello!

Not sure about what you mean with the OpenPGP card not supporting
signing? I have set gpgsm to use the signing key on the OpenPGP card (in
key slot 1) for generating X509 certificates and CMS (S/MIME) signatures
by doing:

  gpgsm --learn-card
  gpgsm --gen-key

And selecting an existing key on the OpenPGP card in the key slot for
signing. This is using GnuPG 2.1.15.

I can successfully use gpgsm to sign an arbitrary file in detached mode
and can validate the signature using "openssl cms -verify". So the
signing part seems to work.

The only problem is that such a signature is rejected by the kernel due
to containing signedAttrs (the CMS structure can be inspected by running
"openssl cms -cmsout -inform DER -print -in signature.der").

I've tried removing the signed attributes from the CMS by hacking the
source of libksba and the resulting file doesn't have signedAttrs, but
for some reason the signature is then wrong. So I have to look into this
more.

Thanks!


Jernej

On 22. 11. 2016 01:58, Stephan Beck wrote:
> Hi Jerney,
> 
> Jernej Kos:
>> Hello!
>>
>> I would like to use GPGSM to sign a Linux kernel module with a private
>> key stored on an OpenPGP smartcard.
> 
> As to the OpenPGP card 2.1 [1] specification, you can store the private
> key of an X.509 certificate on card (Data Object Cardholder Certificate,
> TAG 7F21) ONLY for using it for authentication purposes in a
> client/server environment, not for signing.
> In version 3.0 of the OpenPGP card specification the decipher and sign
> capabilities for use with an PKIX/X.509 certificate have been
> introduced. Unfortunately I don't know of any existing OpenPGP smart
> card that implements version 3.0 [2].
> So, I guess, without even discussing the possibility (and further
> details) of using a "smartcard-based" X.509 certificate's private key
> with gpgsm for digitally signing a file skipping/overriding/ignoring
> CMS's auth attributes for signing a kernel module, it is not (yet)
> feasible (in practice).
> 
> My 2 cent
> 
> Stephan
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20161122/f464f186/attachment.sig>