Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package openCryptoki for openSUSE:Factory
checked in at 2022-03-23 20:19:26
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/openCryptoki (Old)
and /work/SRC/openSUSE:Factory/.openCryptoki.new.25692 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openCryptoki"
Wed Mar 23 20:19:26 2022 rev:63 rq:964349 version:3.17.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/openCryptoki/openCryptoki.changes
2021-10-23 00:51:43.921141339 +0200
+++ /work/SRC/openSUSE:Factory/.openCryptoki.new.25692/openCryptoki.changes
2022-03-23 20:21:18.514562226 +0100
@@ -1,0 +2,9 @@
+Wed Mar 23 15:32:25 UTC 2022 - Mark Post <mp...@suse.com>
+
+- Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM
+ mechanism does not show up as supported by the EP11 token when an
+ upgraded EP11 host library is used.
+ *
openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
+ * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch
+
+-------------------------------------------------------------------
New:
----
openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ openCryptoki.spec ++++++
--- /var/tmp/diff_new_pack.mrYlb6/_old 2022-03-23 20:21:19.022562513 +0100
+++ /var/tmp/diff_new_pack.mrYlb6/_new 2022-03-23 20:21:19.022562513 +0100
@@ -1,7 +1,7 @@
#
# spec file for package openCryptoki
#
-# Copyright (c) 2018-2021 SUSE LLC
+# Copyright (c) 2018-2022 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -39,6 +39,8 @@
# Patch 1 is needed because group pkcs11 doesn't exist in the build environment
# and because we don't want(?) various file and directory permissions to be
0700.
Patch1: ocki-3.11-remove-make-install-chgrp.patch
+Patch2:
openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
+Patch3:
openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch
BuildRequires: bison
BuildRequires: dos2unix
BuildRequires: flex
@@ -128,6 +130,8 @@
%prep
%setup -q -n %{oc_cvs_tag}-%{version}
%patch1 -p1
+%patch2 -p1
+%patch3 -p1
cp %{SOURCE2} .
++++++
openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
++++++
>From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifran...@linux.ibm.com>
Date: Tue, 1 Feb 2022 13:50:18 +0100
Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key
generation
Newer EP11 firmware versions require that the OID of the desired
Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS
at key generation. Older firmware versions ignore this attribute.
Signed-off-by: Ingo Franzki <ifran...@linux.ibm.com>
---
usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/usr/lib/ep11_stdll/ep11_specific.c
b/usr/lib/ep11_stdll/ep11_specific.c
index 75fd46a5..4ca9678a 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -6347,6 +6347,8 @@ static CK_RV
ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0;
CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL;
CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0;
+ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01,
+ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 };
UNUSED(h);
@@ -6371,6 +6373,24 @@ static CK_RV
ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
goto error;
}
+ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len,
+ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid,
+ sizeof(dilithium_oid));
+ if (rc != CKR_OK) {
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
+ __func__, rc);
+ goto error;
+ }
+
+ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len,
+ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid,
+ sizeof(dilithium_oid));
+ if (rc != CKR_OK) {
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
+ __func__, rc);
+ goto error;
+ }
+
rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY,
new_publ_attrs, new_publ_attrs_len,
&new_publ_attrs2, &new_publ_attrs2_len, -1);
--
2.16.2.windows.1
++++++ openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ++++++
>From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifran...@linux.ibm.com>
Date: Tue, 8 Mar 2022 15:01:24 +0100
Subject: [PATCH 2/2] EP11: Fix host library version query
Look at release and modification level, not just the modification level.
Release and modification level are encoded into the one byte minor
field of a CK_VERSION. The high order 4 bits are the release number, the
low order 4 bits the modification level.
This allows host library version checks for release and modification levels.
Signed-off-by: Ingo Franzki <ifran...@linux.ibm.com>
---
usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/usr/lib/ep11_stdll/ep11_specific.c
b/usr/lib/ep11_stdll/ep11_specific.c
index 4ca9678a..2d7581fa 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID
SlotNumber,
goto error;
}
- TRACE_INFO("%s Host library version: %d.%d\n", __func__,
+ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__,
ep11_data->ep11_lib_version.major,
- ep11_data->ep11_lib_version.minor);
+ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4,
+ (ep11_data->ep11_lib_version.minor & 0x0F));
rc = refresh_target_info(tokdata);
if (rc != CKR_OK) {
@@ -11289,8 +11290,19 @@ static CK_RV
ep11tok_get_ep11_library_version(CK_VERSION *lib_version)
rc);
return rc;
}
+ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version);
lib_version->major = (host_version & 0x00FF0000) >> 16;
- lib_version->minor = host_version & 0x000000FF;
+ /* Minor is 4 bits release number and 4 bits modification level */
+ lib_version->minor = (host_version & 0x00000F00) >> 4 |
+ (host_version & 0x0000000F);
+ if ((host_version & 0x0000F000) != 0) {
+ lib_version->minor |= 0xF0;
+ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__);
+ }
+ if ((host_version & 0x000000F0) != 0) {
+ lib_version->minor |= 0x0F;
+ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__);
+ }
/*
* EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This
* can safely be treated as version 1.0
@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t
*tokdata,
if (target_info->card_versions != NULL)
pInfo->hardwareVersion = target_info->card_versions->firmware_version;
pInfo->firmwareVersion = ep11_data->ep11_lib_version;
+ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */
memcpy(pInfo->serialNumber, target_info->serialNumber,
sizeof(pInfo->serialNumber));
--
2.16.2.windows.1
