Mattes, David wrote:

>>> I can read the cert off the card.  I have tried pkcs15-crypt with an
> md5
>>> hash in binary file (16 bytes):
>>> pkcs15-crypt -s -k 45 -i foo.md5
>>> returns:
>>> Input has to be exactly 128 bytes, when using no padding.
>> Was it working with your own version of OpenSC?
>> In other words, it is a regression?

I can get the attached script to read the cert
and use the key (04) to sign, then have openssl verify the signature.

You asked about pragmatically finding the correct key.

The GPK assumes the cert is at DF 3F0002000004, the V1 assumes 3F0016000004.
The pkcs15-gemsafGPK.c does this by looking at  all the key files from 
3F000200007
to 3F0002000F and saving the modulus in kinfo[]. See lines 257-300.
Then at line 413-418 it looks at the modulus from the cert, and compares
to the kinfo and saves the id with the cert.
Then around line 487 it saves the path to the key with the prkey object.

So it could be done, if we knew what key files could be on the V1 cards.

You also asked about multiple certs.

Looking at the code in pkcs15-gemsafeGPK.c vs what is in card-gemsafeV1.c
and pkcs15-gemsafeV1.c, both have to search through the "gemSAFE" file
looking for the ASN.1 that defines the start of a certificate. So reading
more then one certificate could be an issue. The GPK could read more certs
and try to associate then with the keys.

>>
> Hmm, I thought it was, but I just tried it and I got the same error
> message.  Sorry!  It's been a long time since I worked on this.
> 
> _______________________________________________
> opensc-devel mailing list
> [email protected]
> http://www.opensc-project.org/mailman/listinfo/opensc-devel
> 
> 

-- 

  Douglas E. Engert  <[EMAIL PROTECTED]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444
_______________________________________________
opensc-devel mailing list
[email protected]
http://www.opensc-project.org/mailman/listinfo/opensc-devel

Reply via email to