Call the token specific AES key wrap function if the token provides one.
Otherwise use a common code implementation of AESKW that uses the token's
AES ECB function.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
A few new files were added that require specific copyright notices to be
displayed (err.c and getopt_long.c). These files are specific to AIX and are
not used on any other platforms.
The readme has been updated as well, mentioning AIX-specific build instructions
and pitfalls where necessary. The CCA library dependencies have been updated
to reflect what the code now demands for AIX. The base version has been updated
from 5.x to 7.1, which effectively only leaves the 4769 card as the supported
card on AIX. The requirements for Linux are unchanged.
The coding guideline document has been updated as well to outline the required
formatting for preprocessor macros.
Signed-off-by: Akash Kulhalli <akash.kulhalli@ibm.com>
Implicit rejection returns a pseudo random message in case the RSA PKCS#1 v1.5
padding is incorrect, but returns no error. The pseudo random message is based
on static secret data (the private exponent) and the provided ciphertext, so
that the attacker cannot determine that the returned value is randomly generated
instead of the result of decryption and de-padding.
The implicit rejection algorithm is the same as used by OpenSSL.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use OpenSSL's constant time implementation of the RSA-OAEP padding check for
the RSA-OAEP padding mode when decrypting with the private key.
The decode_eme_oaep() function is now constant time, but it still returns
an error (although in a constant time manner) in case the padding check
failed. It is the PKCS#11 application's responsibility to further handle
such an error situation in a constant-time manner to not be vulnerable
to timing attacks.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use OpenSSL's constant time implementation of the PKCS#1 v1.5 padding check
for the PKCS#1 v1.5 padding mode when decrypting with the private key.
The rsa_parse_block() function is now constant time for format 2, but still
returns an error (although in a constant time manner) in case the padding
check failed. It is the PKCS#11 application's responsibility to further
handle such an error situation in a constant-time manner to not be vulnerable
to timing attacks.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
For RSA operations using the private key, apply RSA blinding before invoking the
libica modular exponentiation function, and unblind afterwards. For each operation,
a new blinding factor is used. The affected RSA private key operations are signature
creation and decryption operations.
The code uses the RSA blinding support of OpenSSL and attaches the blinding info to
the RSA key object. For BN_BLINDING_invert_ex() to be fully constant-time, the
following OpenSSL commit is required: "Alternative fix for CVE-2022-4304"
f06ef1657a
Related commits for OpenSSL releases:
- OpenSSL 1.1.1u:
3f499b24f3
- OpenSSL 3.0.9:
a00d757d9c
- OpenSSl 3.1.1:
550a16247e
If the alternate fix for CVE-2022-4304 is not included in OpenSSL, then an
alternate constant-time blinding invert function is used instead.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
