If the system runs in fips mode, RSA-1024 is blocked. Just use
an RSA-2048 key so that the key length is ok in any case.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Older EP11 card generations don't seem to like RSA CRT keys with p < q.
Check for such keys during clear key import, and swap their CRT components
and recalculate qInv (CKA_COEFFICIENT).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
warning: ‘%08lx’ directive writing between 8 and 16 bytes into a region of
size 15 [-Wformat-overflow=]
Make the buffer for p11_get_cka large enough for the text plus the largest
possible hex value.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When object_mgr_restore_obj_withSize() is called with an existing object,
don't free the object in case of an error. This would cause the caller
to either access or also free the already freed object.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
For single operations, do not increment the statistics counters after
the single operation has successfully been performed, but during operation
initialization (i.e. during key check) already. That way the statistic counting
is not dependent on the return code of the operation, and thus does not leak
timing information about failure or success of the operation.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Do not trace any decrypt error cases for RSA mechanisms, since this is
not constant time. Either do not trace at all, or trace in any case,
regardless if an error occurred or not.
Also, remove obsolete output length checks, because rsa_parse_block() has
already checked that. Checking this again is not constant time.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use OpenSSL's constant time implementation of the RSA-OAEP padding check for
the RSA-OAEP padding mode when decrypting with the private key.
The decode_eme_oaep() function is now constant time, but it still returns
an error (although in a constant time manner) in case the padding check
failed. It is the PKCS#11 application's responsibility to further handle
such an error situation in a constant-time manner to not be vulnerable
to timing attacks.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use OpenSSL's constant time implementation of the PKCS#1 v1.5 padding check
for the PKCS#1 v1.5 padding mode when decrypting with the private key.
The rsa_parse_block() function is now constant time for format 2, but still
returns an error (although in a constant time manner) in case the padding
check failed. It is the PKCS#11 application's responsibility to further
handle such an error situation in a constant-time manner to not be vulnerable
to timing attacks.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
For RSA operations using the private key, apply RSA blinding before invoking the
libica modular exponentiation function, and unblind afterwards. For each operation,
a new blinding factor is used. The affected RSA private key operations are signature
creation and decryption operations.
The code uses the RSA blinding support of OpenSSL and attaches the blinding info to
the RSA key object. For BN_BLINDING_invert_ex() to be fully constant-time, the
following OpenSSL commit is required: "Alternative fix for CVE-2022-4304"
f06ef1657a
Related commits for OpenSSL releases:
- OpenSSL 1.1.1u:
3f499b24f3
- OpenSSL 3.0.9:
a00d757d9c
- OpenSSl 3.1.1:
550a16247e
If the alternate fix for CVE-2022-4304 is not included in OpenSSL, then an
alternate constant-time blinding invert function is used instead.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Cache the RSA or EC libica key object by attaching it to the key object.
Subsequent crypto operations using the same key object will reuse the
libica key object and save some time, because it is not needed to recreate
the libica key object for every request.
Care must be taken that the software fallback uses OpenSSL, and the code
in mech_openssl.c may also cache the OpenSSL PKEY object by attaching it
to the key object. Thus, struct openssl_ex_data must be the first field
of the ex_data structure used by the ICA token, and ica_free_ex_data()
must call openssl_free_ex_data() as very last.
Because attached key objects live longer, and may be concurrently used by
multiple threads, check for RSA keys with p < q and let libica correct it
if needed at time the libica key object is attached. This avoids that a
call to ica_rsa_crt() later on may correct it in a non-thread-save way.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When an RSA or EC crypto operation is performed via OpenSSL (soft token:
always, ICA token: as software fallback only), then cache the OpenSSL PKEY
object by attaching it to the key object. Subsequent crypto operations using
the same key object will reuse the PKEY object and save some time, because it
is not needed to recreate the PKEY object for every request.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Some tokens may have a need to attach arbitrary data to an object in memory.
This could for example be an OpenSSL PKEY that was created from the object's
attributes, or any other processing or state data that a token needs to keep
with the object.
This data only lives in memory, and is not saved to the disk when the object
is stored (i.e. for token objects).
Each object contains a R/W lock that must be used to protect the attached
data from being accessed concurrently by several threads. Any attempt to set
or update the attached data must be protected by a WRITE lock, while any
attempt to use or read the attached data must be protected by a READ lock.
This lock is independent from the object's template R/W lock. Thus, a token
can update the attached data, although it only has a READ lock on the object
itself (as long as the objects attributes are not updated).
A token may supply a free and a reload routine when attaching such data to an
object. Whenever the object is freed, the free routine is called to allow the
token to also free the attached data. Similarly, when the object is being
reloaded from disk, e.g. because another process has changed the object, the
reload routine is called to allow the token to re-create or update the attached
data. When the reload routine is called, the WRITE lock is being held.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The use of transactional memory has never really worked for openCryptoki.
Also, many code places use locks, even with '--disable-locks'.
Option '--enable-locks' has been the default so far.
To retain backward compatibility, continue to accept the '--disable-locks'
option during configuration, but ignore it if it is specified. A warning
message is issued if --disable-locks' is still used.
With this change, there is no longer a need to maintain 2 copies of the
btree.c and sess_mgr.c source (btree.c and lock_btree.c, sess_mgr.c and
lock_sess_mgr.c), which contained the same code except the differences for
supporting transactional memory versus locks. Now only the version with
locks is retained, but it is renamed to not contain the 'lock_' prefix any
more.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The EP11 token claims to support the CKM_SHAnnn_KEY_DERIVATION mechanisms,
but it misses to perform some mechanism specific handling.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Library libcap is only needed by pkcsslotd, but not by all the other
executables.
AC_CHECK_LIB without a 'action-if-found' specified will add the library
to the global LIBS, and thus all executables will link against it. Avoid this
by specifying a 'action-if-found' action and build a LIBCAP_LIBS variable
(which however is unused).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Allow to specify the pkcsslotd user and the pkcs11 group during
configuration.
Use '--with-pkcsslotd-user=USER' and/or '--with-pkcs-group=GROUP'
to specify the user and group name. The defaults are 'pkcsslotd'
and 'pkcs11'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use various sandboxing options for running the pkcsslotd via systemd.
Many of these options are not really needed, because pkcsslotd run under
a non-privileged user (user pkcsslotd) so it can't perform any privileged
actions anyway.
With these settings, 'systemd-analyze security pkcsslotd.service' reports
an exposure level of 1.7 (score range 0.0 - 10.0).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Usually pkcsslotd should be started without any effective capabilities,
but capability CAP_NET_ADMIN may be set to allow pkcsslotd to increase
the receive buffer size of the UDEV monitor's netlink socket via
udev_monitor_set_receive_buffer_size(). The CAP_NET_ADMIN capability
may either be set via Systemd's service unit, or via file capabilities
of pkcsslotd's executable file.
Drop this and all other effective and permitted capabilities after
initialization has completed, but before becoming a daemon.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Create the unix sockets and the PID file in /run/opencryptoki, and make
sure the /run/opencryptoki directory as well as the lock and log directories
are created during 'make install' as well as during system startup via
tmpfiles.d. Since the /run directory usually is within a tmpfs file system,
it won't exist after a system restart otherwise.
Also make the /run/opencryptoki directory be owned by the 'pkcsslotd' user
and the 'pkcs11' group, and only writable by the 'pkcsslotd' user.
That way, pkcsslotd can only be started by the 'pkcsslotd' user (or root).
Nevertheless, members of the 'pkcs11' group can still connect to the sockets,
and thus can still communicate with pkcsslotd.
The 'pkcsslotd' user is created (if not already existent) during 'make install'
and RPM installation, together with the 'pkcs11' group.
When the pkcsslotd is started as 'root', change its uid to 'pkcsslotd' to drop
privileges and capabilities. Any capabilities set on the executable file
are retained, regardless if started as root or as pkcsslotd user.
If started as root, pkcsslotd can create any missing base directories, otherwise
an error is reported. It is expected that the base directories have been created
during package installation and/or tmpfiles.d prior to starting pkcsslotd.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add a define OCK_HSM_MK_CHANGE_PATH for the path to the HSM MK change data,
and adjust the code to use that define instead of hard-coding it.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Make '--with-systemd' the default using the default systemd system unit files
location. In case one wants to build a init-d script instead, '--without-systemd'
can be specified.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Let pkcs_get_keytype() return the desired key type for mechanisms
CKM_PBE_SHA1_DES3_EDE_CBC and CKM_PBE_SHA1_DES2_EDE_CBC.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Check errors for all RW-lock or mutex initialization calls, and perform
proper error handling and cleanup if it fails.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Handle the situation where a concurrent master key change op is
active and the key is already encrypted with the new MK.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
An imported secure key with CKA_IBM_PROTKEY_EXTRACTABLE = true
must be CPACF-exportable, i.e. must have the XPRTCPAC flag
on inside the token.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Creating secure keys with the XPRTCPAC rule array keyword requires
a CEX7C or later. Handle CCA min card version check also for APQN
online/offline events. For example, when an older card gets online,
the previously determined min card version would be incorrect.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
On older kernels (before 5.10), the PKEY_KBLOB2PROTK3 ioctl is
not yet available. Provide the missing #defines and variables
to allow building the code also on old kernels.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Protected key support for CCA is now enabled for aes-ecb/cbc
and EC sign/verify (p256, p384, p521).
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
This token specific function is called whenever a new object is
created. It currently sets attribute CKA_IBM_PROTKEY_EXTRACTABLE
according to the PKEY_MODE token option, but may also be used
for other token options and attrs in future.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Determine the current firmware wrapping key verification pattern
(wkvp) and save it in the CCA private data struct. It is needed
to check the validity of a given protected key.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Some user-specified attributes, e.g. CKA_IBM_PROTKEY_EXTRACTABLE,
are related to protected keys and have a corresponding CCA
rule-array keyword that must be passed to the CCA host library
when creating an object.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
The session parm is needed in some CCA token specific routines.
Their interface must be adapted for all tokens.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
