Mattes, David wrote:
>>> I can read the cert off the card. I have tried pkcs15-crypt with an > md5 >>> hash in binary file (16 bytes): >>> pkcs15-crypt -s -k 45 -i foo.md5 >>> returns: >>> Input has to be exactly 128 bytes, when using no padding. >> Was it working with your own version of OpenSC? >> In other words, it is a regression? I can get the attached script to read the cert and use the key (04) to sign, then have openssl verify the signature. You asked about pragmatically finding the correct key. The GPK assumes the cert is at DF 3F0002000004, the V1 assumes 3F0016000004. The pkcs15-gemsafGPK.c does this by looking at all the key files from 3F000200007 to 3F0002000F and saving the modulus in kinfo[]. See lines 257-300. Then at line 413-418 it looks at the modulus from the cert, and compares to the kinfo and saves the id with the cert. Then around line 487 it saves the path to the key with the prkey object. So it could be done, if we knew what key files could be on the V1 cards. You also asked about multiple certs. Looking at the code in pkcs15-gemsafeGPK.c vs what is in card-gemsafeV1.c and pkcs15-gemsafeV1.c, both have to search through the "gemSAFE" file looking for the ASN.1 that defines the start of a certificate. So reading more then one certificate could be an issue. The GPK could read more certs and try to associate then with the keys. >> > Hmm, I thought it was, but I just tried it and I got the same error > message. Sorry! It's been a long time since I worked on this. > > _______________________________________________ > opensc-devel mailing list > [email protected] > http://www.opensc-project.org/mailman/listinfo/opensc-devel > > -- Douglas E. Engert <[EMAIL PROTECTED]> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ opensc-devel mailing list [email protected] http://www.opensc-project.org/mailman/listinfo/opensc-devel
