chaosrebel/pico-openpgp
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-openpgp.git synced 2026-08-23 04:57:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Accept RSA family algorithm aliases

Browse Source 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
This commit is contained in:
Pol Henarejos
2026-08-14 22:17:37 +02:00
parent 144260a633
commit b48ae519cf
2 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openpgp/piv.c
+22 -4
View File
@@ -72,6 +72,22 @@
#define IS_ACTIVE(x) ((x) >= EF_PIV_KEY_AUTHENTICATION && (x) <= EF_PIV_KEY_CARDAUTH)
#define IS_KEY(x) ((IS_ACTIVE((x))) || (IS_RETIRED((x))))
static size_t piv_rsa_modulus_size(uint8_t algo) {
if (algo == PIV_ALGO_RSA1024) {
return 128;
}
if (algo == PIV_ALGO_RSA2048) {
return 256;
}
if (algo == PIV_ALGO_RSA3072) {
return 384;
}
if (algo == PIV_ALGO_RSA4096) {
return 512;
}
return 0;
}
uint8_t piv_aid[] = {
5,
0xA0, 0x00, 0x00, 0x03, 0x8,
@@ -848,8 +864,10 @@ static int cmd_authenticate(void) {
return SW_INCORRECT_PARAMS();
}
bool challenge_response = (operation_tag == 0x80 || operation_tag == 0x82) && operation.len > 0;
if (algo != meta[0] && !(pending_mgm_challenge && challenge_response)) {
return SW_INCORRECT_PARAMS();
size_t slot_rsa_modulus_size = piv_rsa_modulus_size(meta[0]);
bool rsa_family_match = slot_rsa_modulus_size > 0 && piv_rsa_modulus_size(algo) > 0 && operation_tag == 0x81 && operation.len == slot_rsa_modulus_size;
if (algo != meta[0] && !rsa_family_match && !(pending_mgm_challenge && challenge_response)) {
return SW_WRONG_DATA();
}
if (key_ref == EF_PIV_KEY_CARDMGM) {
tlv_ctx_t empty = { 0 };
@@ -886,7 +904,7 @@ static int cmd_authenticate(void) {
return SW_EXEC_ERROR();
}
size_t olen = mbedtls_rsa_get_len(&ctx);
if (algo == PIV_ALGO_RSA1024) {
if (olen < 256) {
memcpy(res_APDU, "\x7C\x81\x00\x82\x81\x00", 6);
res_APDU_size = 6;
}
@@ -896,7 +914,7 @@ static int cmd_authenticate(void) {
}
r = mbedtls_rsa_private(&ctx, random_fill_iterator, NULL, operation.data, res_APDU + res_APDU_size);
mbedtls_rsa_free(&ctx);
if (algo == PIV_ALGO_RSA1024) {
if (olen < 256) {
res_APDU[res_APDU_size - 1] = olen;
res_APDU[res_APDU_size - 4] = olen + 3;
}
tests/piv/test_060_regressions.py
+12
View File
@@ -100,3 +100,15 @@ def test_piv_general_authenticate_uses_the_first_operation_tag(managed_piv):
assert Tlv.unpack(0x82, Tlv.unpack(0x7C, response))
finally:
delete_key(managed_piv, slot)
def test_piv_rsa_general_authenticate_accepts_another_rsa_algorithm_id(managed_piv):
slot = SLOT.AUTHENTICATION
try:
managed_piv.generate_key(slot, KEY_TYPE.RSA1024, PIN_POLICY.ONCE, TOUCH_POLICY.NEVER)
managed_piv.verify_pin(DEFAULT_PIN)
body = Tlv(0x7C, Tlv(0x81, b"\x00" * 127 + b"\x01"))
response = managed_piv.protocol.send_apdu(0, 0x87, KEY_TYPE.RSA2048, slot, body)
assert response
finally:
delete_key(managed_piv, slot)