[gnutls-devel] GnuTLS | PKCS#11: RSA-PSS should be enabled only when the private key can be used for signing (#667)
Development of GNU's TLS library
gnutls-devel at lists.gnutls.org
Fri Jan 4 10:05:42 CET 2019
New Issue was created.
Issue 667: https://gitlab.com/gnutls/gnutls/issues/667
Author: Nikos Mavrogiannopoulos
In `gnutls_pkcs11_privkey_import_url()` we only enable RSA-PSS functionality to the key if the `CKM_RSA_PKCS_PSS` mechanism is available to the token. However, if the specific key is not marked for use with digital signatures (`CKA_SIGN` set), then we may still end-up using it which will later fail. We should test whether `CKA_SIGN` is set prior to enabling such keys for PSS.
Furthermore we should make `CKA_SIGN/VERIFY` and `CKA_ENCRYPT/DECRYPT` visible via p11tool by amending `gnutls_pkcs11_obj_flags_get_str()`.
[reported originally at: https://bugzilla.redhat.com/show_bug.cgi?id=1663058]
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/issues/667
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Gnutls-devel