import opencryptoki-3.17.0-4.el8_6
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
0bfc62d56e
commit
a7c2acab30
@ -0,0 +1,56 @@
|
|||||||
|
From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
Date: Tue, 1 Feb 2022 13:50:18 +0100
|
||||||
|
Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key
|
||||||
|
generation
|
||||||
|
|
||||||
|
Newer EP11 firmware versions require that the OID of the desired
|
||||||
|
Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS
|
||||||
|
at key generation. Older firmware versions ignore this attribute.
|
||||||
|
|
||||||
|
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
---
|
||||||
|
usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++
|
||||||
|
1 file changed, 20 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
||||||
|
index 75fd46a5..4ca9678a 100644
|
||||||
|
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
||||||
|
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
||||||
|
@@ -6347,6 +6347,8 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
|
||||||
|
CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0;
|
||||||
|
CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL;
|
||||||
|
CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0;
|
||||||
|
+ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01,
|
||||||
|
+ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 };
|
||||||
|
|
||||||
|
UNUSED(h);
|
||||||
|
|
||||||
|
@@ -6371,6 +6373,24 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len,
|
||||||
|
+ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid,
|
||||||
|
+ sizeof(dilithium_oid));
|
||||||
|
+ if (rc != CKR_OK) {
|
||||||
|
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
|
||||||
|
+ __func__, rc);
|
||||||
|
+ goto error;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len,
|
||||||
|
+ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid,
|
||||||
|
+ sizeof(dilithium_oid));
|
||||||
|
+ if (rc != CKR_OK) {
|
||||||
|
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
|
||||||
|
+ __func__, rc);
|
||||||
|
+ goto error;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY,
|
||||||
|
new_publ_attrs, new_publ_attrs_len,
|
||||||
|
&new_publ_attrs2, &new_publ_attrs2_len, -1);
|
||||||
|
--
|
||||||
|
2.16.2.windows.1
|
||||||
|
|
||||||
66
SOURCES/0002-EP11-Fix-host-library-version-query.patch
Normal file
66
SOURCES/0002-EP11-Fix-host-library-version-query.patch
Normal file
@ -0,0 +1,66 @@
|
|||||||
|
From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
Date: Tue, 8 Mar 2022 15:01:24 +0100
|
||||||
|
Subject: [PATCH 2/2] EP11: Fix host library version query
|
||||||
|
|
||||||
|
Look at release and modification level, not just the modification level.
|
||||||
|
Release and modification level are encoded into the one byte minor
|
||||||
|
field of a CK_VERSION. The high order 4 bits are the release number, the
|
||||||
|
low order 4 bits the modification level.
|
||||||
|
|
||||||
|
This allows host library version checks for release and modification levels.
|
||||||
|
|
||||||
|
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
---
|
||||||
|
usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++---
|
||||||
|
1 file changed, 16 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
||||||
|
index 4ca9678a..2d7581fa 100644
|
||||||
|
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
||||||
|
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
||||||
|
@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber,
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
|
||||||
|
- TRACE_INFO("%s Host library version: %d.%d\n", __func__,
|
||||||
|
+ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__,
|
||||||
|
ep11_data->ep11_lib_version.major,
|
||||||
|
- ep11_data->ep11_lib_version.minor);
|
||||||
|
+ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4,
|
||||||
|
+ (ep11_data->ep11_lib_version.minor & 0x0F));
|
||||||
|
|
||||||
|
rc = refresh_target_info(tokdata);
|
||||||
|
if (rc != CKR_OK) {
|
||||||
|
@@ -11289,8 +11290,19 @@ static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version)
|
||||||
|
rc);
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
+ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version);
|
||||||
|
lib_version->major = (host_version & 0x00FF0000) >> 16;
|
||||||
|
- lib_version->minor = host_version & 0x000000FF;
|
||||||
|
+ /* Minor is 4 bits release number and 4 bits modification level */
|
||||||
|
+ lib_version->minor = (host_version & 0x00000F00) >> 4 |
|
||||||
|
+ (host_version & 0x0000000F);
|
||||||
|
+ if ((host_version & 0x0000F000) != 0) {
|
||||||
|
+ lib_version->minor |= 0xF0;
|
||||||
|
+ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__);
|
||||||
|
+ }
|
||||||
|
+ if ((host_version & 0x000000F0) != 0) {
|
||||||
|
+ lib_version->minor |= 0x0F;
|
||||||
|
+ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__);
|
||||||
|
+ }
|
||||||
|
/*
|
||||||
|
* EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This
|
||||||
|
* can safely be treated as version 1.0
|
||||||
|
@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t *tokdata,
|
||||||
|
if (target_info->card_versions != NULL)
|
||||||
|
pInfo->hardwareVersion = target_info->card_versions->firmware_version;
|
||||||
|
pInfo->firmwareVersion = ep11_data->ep11_lib_version;
|
||||||
|
+ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */
|
||||||
|
memcpy(pInfo->serialNumber, target_info->serialNumber,
|
||||||
|
sizeof(pInfo->serialNumber));
|
||||||
|
|
||||||
|
--
|
||||||
|
2.16.2.windows.1
|
||||||
|
|
||||||
@ -1,7 +1,7 @@
|
|||||||
Name: opencryptoki
|
Name: opencryptoki
|
||||||
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
|
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
|
||||||
Version: 3.17.0
|
Version: 3.17.0
|
||||||
Release: 3%{?dist}
|
Release: 4%{?dist}
|
||||||
License: CPL
|
License: CPL
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
URL: https://github.com/opencryptoki/opencryptoki
|
URL: https://github.com/opencryptoki/opencryptoki
|
||||||
@ -14,6 +14,8 @@ Patch1: opencryptoki-3.11.0-lockdir.patch
|
|||||||
Patch2: opencryptoki-1.17.0-p11sak.patch
|
Patch2: opencryptoki-1.17.0-p11sak.patch
|
||||||
# upstream patches
|
# upstream patches
|
||||||
Patch100: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
|
Patch100: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
|
||||||
|
Patch101: 0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
|
||||||
|
Patch102: 0002-EP11-Fix-host-library-version-query.patch
|
||||||
|
|
||||||
Requires(pre): coreutils
|
Requires(pre): coreutils
|
||||||
Requires: (selinux-policy >= 3.14.3-70 if selinux-policy-targeted)
|
Requires: (selinux-policy >= 3.14.3-70 if selinux-policy-targeted)
|
||||||
@ -341,6 +343,9 @@ fi
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Apr 15 2022 Than Ngo <than@redhat.com> - 3.17.0-4
|
||||||
|
- Resolves: #2069592, Dilithium support not available
|
||||||
|
|
||||||
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-3
|
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-3
|
||||||
- Resolves: #2040677, API: Unlock GlobMutex if user and group check fails
|
- Resolves: #2040677, API: Unlock GlobMutex if user and group check fails
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user