Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Save the whales. Collect the whole set.


devel / comp.protocols.kerberos / Re: Using PKINIT with ECC

SubjectAuthor
o Re: Using PKINIT with ECCKen Hornstein

1
Re: Using PKINIT with ECC

<mailman.60.1700415730.2263420.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=438&group=comp.protocols.kerberos#438

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ken...@cmf.nrl.navy.mil (Ken Hornstein)
Newsgroups: comp.protocols.kerberos
Subject: Re: Using PKINIT with ECC
Date: Sun, 19 Nov 2023 12:41:57 -0500
Organization: TNet Consulting
Lines: 21
Message-ID: <mailman.60.1700415730.2263420.kerberos@mit.edu>
References: <8984fe41-f9a0-434b-a09c-df2bc88125dc@sec4mail.de>
<ae76ed5c-1399-401e-988c-ed2dbdfff6e7@mit.edu>
<81bc4460-b88a-4dfe-b538-e22805a086ea@sec4mail.de>
<202311191741.3AJHfvZV019105@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="18344"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: kerberos@mit.edu
To: Goetz Golla <mit@sec4mail.de>
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu;
dkim=pass (1024-bit key, unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=LSUdgYba;
dkim=pass (2048-bit key,
unprotected) header.d=nrl.navy.mil header.i=@nrl.navy.mil header.a=rsa-sha256
header.s=s2.dkim header.b=WrRyaI/7
Authentication-Results: mit.edu; dmarc=pass (p=reject dis=none)
header.from=cmf.nrl.navy.mil
Authentication-Results: mit.edu; arc=pass smtp.remote-ip=18.9.3.17
ARC-Seal: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1700415726; cv=pass;
b=SiZCRZzyMCefm2rie+42nxDY6sG+GuuLw3zf2le1uRGrQ7sgB0j+r6otkwYXeT9w75AGwbSr3qsK2b1dDxN5UqYoJZntzsOLSfKKHZa6XuwX/qt16oXfqYiqOA/OIoAt8SUjSwLpiAwVflKdQGCwzVGW0y8kGCjgpuoZ9RAKWyD+IW47vC9GLsMnepszJ/Oqs9wKmW/7Lj4PoJEI2l9Qy95q9WQMewwnpPnOJ+71nKwk6EapAQoaM0gfWTr+AVd5mniBWyPB3/HAA6pdRq2wjOeA0qT5EujGI5u3I/CrbcfF+ciN+it8bmgJPE8N3sVreoVyOzjOAVEZ00B7Gb5N9A==
ARC-Message-Signature: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1700415726;
c=relaxed/relaxed; bh=0RwDPEirEi/XDoD78Tzo/k+Z+Fo1R6trcop1JWnfADs=;
h=Message-ID:From:Subject:MIME-Version:Content-Type:Date;
b=h0Y8x6FXyX10aBkGLi9Uwn4M9/Lbo4g556l4gOIG4A36TjFpyz/WJaEXUtoNE6Ip4HudWJslb5QUjHTFzGJHcxDYw35caOjzfVpCNt+4sRbGIytsJxZNyOKKPcOiOHzMCAU+LfElCau7WulQe2PdvSKFLzyHUz3vOt+VGsA+ri8C5IJkKymsuBnRImx0r7m9DMW1Nc+gBFlkXSgyHG8SUF1gRdv+PNL4aNnezSzesvBuxB4ZNDBE5t6O/JrO154qYbl+Oq0R7PQO22xUV4Z3OO8Ge/G0TvMK0CWvWBFA2y9c6YhcVl3INi4PFj7QrrFvfNnWexNQ7x7lRee1xgihHw==
ARC-Authentication-Results: i=2; mit.edu; dkim=pass (1024-bit key;
unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=LSUdgYba;
dkim=pass (2048-bit key;
unprotected) header.d=nrl.navy.mil header.i=@nrl.navy.mil header.a=rsa-sha256
header.s=s2.dkim header.b=WrRyaI/7
Authentication-Results: mit.edu; dkim=pass (1024-bit key;
unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=LSUdgYba;
dkim=pass (2048-bit key;
unprotected) header.d=nrl.navy.mil header.i=@nrl.navy.mil header.a=rsa-sha256
header.s=s2.dkim header.b=WrRyaI/7
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=GzGTWojXXgwSypzeLTRv71GKWP6xsPkjhqWZ2Q55ASXFHOxR8X4RmmO3POqTs+Q5BoCEcqfrXrWgET4/y5iziXGLrXV1f7dxjrf0u2Y9XSVe4MSnH6ijSHtozaxNvN0qTEBjhKHxI7u8IQZLXPqgmn0s3Aeh0uLVyIY49EyzExDqjcVJFsmdtx/2bdJ5aV6QMO6Ar7M4fyul409EDQooy0AgB8/NtEPj1n4DAYtdFYOsX+UB57X7HlKwasTKf3oMGhOe6q+CpaRd7U28c5Gnsd5N806CZ8gUP4aY7xB0vn+9xlrIC6WXbgY1PMXUiZ7U/igJ0GrZTj/R+4nkUz5g6g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=0RwDPEirEi/XDoD78Tzo/k+Z+Fo1R6trcop1JWnfADs=;
b=ixW1UWC9qFLwfVVHLvNVFEtBOo8tMoKPnTUBxyrVi9R24GwNj0BTNxIiHfO1nYe9Lh2SJesZOlXqfy2nj1+G4BsGwEWISZXAp8jsI6/7X11wOfB8JFDzpHkO/3u8W/YtFSeq3y9fquqI4EvsQuT2sssIdbZyctGPGDskWTJu+QfF5Z9J0Ebt/Yas94kDEanUCvl9SxqBAQXpTcEt2vC6himAZtuytytgveOAf3Wk42vz4DniMDh9K6E5CUZhEAfaDn9/Dq5hB5QvrjQJxhQBgmOeP2LG1nr7XQ4kowfS1NxrAQL8XzSOGQbDnFwfX+0A9wwrRLCSTlbQr30SSvaLXw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=temperror (sender ip
is 140.32.59.234) smtp.rcpttodomain=mit.edu
smtp.mailfrom=cmf.nrl.navy.mil;
dmarc=pass (p=reject sp=reject pct=100) action=none
header.from=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=0RwDPEirEi/XDoD78Tzo/k+Z+Fo1R6trcop1JWnfADs=;
b=LSUdgYba3Csf8WBNFsXo37uKkXDWy+dMkhUdCOngxgO1rKr8ERID/ij71MG80Bp7/MpFA6CHf080TqhLMMUqtJSwq8mw+2FVERx9Vdks5VmqwF3tHXGMCyab59kku2ZGnktGKkSklETZMKqLtLdFy+IB63Gpu4xcArBPeEjdczg=
Authentication-Results: spf=temperror (sender IP is 140.32.59.234)
smtp.mailfrom=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil;dmarc=pass action=none header.from=cmf.nrl.navy.mil;
Received-SPF: TempError (protection.outlook.com: error in processing during
lookup of cmf.nrl.navy.mil: DNS Timeout)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nrl.navy.mil;
h=message-id : from :
to : cc : subject : in-reply-to : references : mime-version : content-type
: date; s=s2.dkim; bh=0RwDPEirEi/XDoD78Tzo/k+Z+Fo1R6trcop1JWnfADs=;
b=WrRyaI/7jpB8Yrm0HktN2rw5m4M7iIQvRcuilSXRxVCSAl5oMlKDVo/P0s0GwI6L1oon
yUyGvNDWGtthts7Ugza8vAI7b2XPtBgToPEv72VLhJRLOdk20tWoPBAAX30zGo4ECFfR
bbwMyxzYBAaTA0T4qmVG9PjX6AIXu4IhrMNbzS4VzKByyDOtfOK9j8hmqFSLKjjG/S11
yM4uWVicfBOQ0YhVNMZEJjII5a16Ud8230/8gAJwXFFelqyVmfJawMvUpB7KiTtXazFF
aJH7OPaDO1HgKjpsEa/6f/zD/aLq1zsXDL+i2ra/2WY14r4cZOgiNQ3Dkrlh9GkC2USa PA==
In-Reply-To: <81bc4460-b88a-4dfe-b538-e22805a086ea@sec4mail.de>
X-Face: "Evs"_GpJ]],xS)b$T2#V&{KfP_i2`TlPrY$Iv9+TQ!6+`~+l)#7I)0xr1>4hfd{#0B4
WIn3jU;bql;{2Uq%zw5bF4?%F&&j8@KaT?#vBGk}u07<+6/`.F-3_GA@6Bq5gN9\+s;_d
gD\SW #]iN_U0 KUmOR.P<|um5yP<ea#^"SJK;C*}fMI;Mv(aiO2z~9n.w?@\>kEpSD@*e`
X-NRLCMF-Spam-Score: () hits=0 User Authenticated
X-NRLCMF-Virus-Scanned:
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: CY4PEPF0000EDD4:EE_|CH0PR01MB6860:EE_
X-MS-Office365-Filtering-Correlation-Id: 3228c6ac-c4ab-4e8c-7c9d-08dbe926d514
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: QWO1Ho1nlw9iQAaU6ubPeLPNxWvtsjJfNApMyuJacgIvzuu6ry390lzDSW5YpvyOO7Mh/PdIehWHzhTrBXRlxt4TOUcdsiskrrJvMLlygKllgTO8PrlrkJFaDAUKhBBtmXD8/BKxdI+tsPtoCgHFm9M7cJrtJtJ2/Axu9wUE/t3l6bkAWu41MVJPCtaxxR2NmegbAUqTocEyqR1TKJfhBIwRs523Nk2ruUNw6/PzkePgGxBxYEU+Fe/IqCbQgM/BMeGQPLT/wliOOcQ8QYbNqoLin+oVjWC6ZeHbtmheINXYQnlCurCISP4ZktvAHKsXrR6tTZxjqvP2biHVwAgVrxGWRw/bdPmL8+2kgtBvNUaUAwezyYxZPX6Xw8vELk5PfJsrOEylpQuvAH14zuglTynaK/93jBwOVcJlu/Lao3pMrauBX5Vs0pCX6pXdDZiJzLHtDqu/qayILweR64Ue7kzdT3GXZY5AMxrOdOcsJAC800xYuk0jD3BKlImSjWKY5FDNVHu0EiuVThb32qNOe+2EyqYLkn/lATQ+M9RJuZITkyN7iP8XYTTi/OnpF18Uyhreoa1kUZptiVf4xSRdIH8s/8MmkislLeA0rLbJSkUKt2hRYUDUB1knB2dDplQTvVd52lciI9S5TplqbaTv1Q==
X-Forefront-Antispam-Report: CIP:140.32.59.234; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mf.dren.mil; PTR:mfe.dren.mil; CAT:NONE;
SFS:(13230031)(4636009)(396003)(346002)(136003)(376002)(39860400002)(64100799003)(451199024)(48200799006)(61400799012)(83380400001)(336012)(426003)(86362001)(63350400001)(3480700007)(7636003)(356005)(68406010)(70586007)(8676002)(6862004)(4326008)(786003)(316002)(5660300002)(4744005)(2906002)(1076003)(956004)(26005)(498600001);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Nov 2023 17:41:59.3788 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 3228c6ac-c4ab-4e8c-7c9d-08dbe926d514
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000EDD4.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR01MB6860
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <202311191741.3AJHfvZV019105@hedwig.cmf.nrl.navy.mil>
X-Mailman-Original-References: <8984fe41-f9a0-434b-a09c-df2bc88125dc@sec4mail.de>
<ae76ed5c-1399-401e-988c-ed2dbdfff6e7@mit.edu>
<81bc4460-b88a-4dfe-b538-e22805a086ea@sec4mail.de>
 by: Ken Hornstein - Sun, 19 Nov 2023 17:41 UTC

>P:296321; T:0x140609979246400 17:33:26.054 [opensc-pkcs11]
>pkcs11-object.c:697:C_SignInit: C_SignInit() = CKR_KEY_HANDLE_INVALID

As a follow-up to my previous message, I believe the problem is that for
_smartcards_ the PKCS#11 mechanism is hardcoded to CKM_RSA_PKCS:

/*
* We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
* historically many cards seem to be confused about whether they are
* capable of mechanisms or not. The safe thing seems to be to ignore the
* mechanism list, always use CKM_RSA_PKCS and calculate the sha256 digest
* ourselves.
*/
id_cryptoctx->mech = CKM_RSA_PKCS;

There's a CKM_ECDSA_SHA1 mechanism which does the hashing for you, and
there's also a CKM_ECDSA mechanism where you have to calculate the hash
value which is kind of close (but not exactly the same as) to CKM_RSA_PKCS.
So, dang, code is going to have to be written.

--Ken

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor