On Sun, Apr 1, 2012 at 11:09 PM, Git Master <webmas...@opensc-project.org> wrote:
> commit ef835cb8a93087b0551c9786be655adaa2242a08 > Author: Robbert Müller <spam...@grols.ch> > Date: Sun Jan 8 15:48:12 2012 +0100 > > Adding default accessflags to the do_store_private_key function in the > same way do_generate_key has those accessflags > This seems the right thing to do, when you look at the initial commit > which added the flags in do_generate_key and the ticket > http://www.opensc-project.org/opensc/ticket/198 > > Currently when storing a key, the accessflags are not set > > diff --git a/src/tools/pkcs15-init.c b/src/tools/pkcs15-init.c > index 2bf3cd1..978fd66 100644 > --- a/src/tools/pkcs15-init.c > +++ b/src/tools/pkcs15-init.c > @@ -886,6 +886,11 @@ do_store_private_key(struct sc_profile *profile) > args.x509_usage = opt_x509_usage? opt_x509_usage : usage; > } > > + args.access_flags |= > + SC_PKCS15_PRKEY_ACCESS_SENSITIVE > + | SC_PKCS15_PRKEY_ACCESS_ALWAYSSENSITIVE > + | SC_PKCS15_PRKEY_ACCESS_NEVEREXTRACTABLE; > + While all the flags in PKCS#15 and PKCS#11 are related and towards PKCS#11 (which defines its own model for things), I don't think that this is true, especially for an imported key (the thing has gone simpler with the extractable-magic gone) As OpenSC itself, nor most (all ?) cards it supports, don't allow reading the key out of the card (I hope), sensitive should hold true. As the key has been imported, alwaysSenstive does not hold, as the key is in plaintext when imported through pkcs15-init. In PKCS#11 terms, importing a key is like creating it through C_CreateObject, thus the same should hold for the flags: (from PKCS#11): If C_CreateObject is used to create a key object, the key object will have its CKA_LOCAL attribute set to CK_FALSE. If that key object is a secret or private key then the new key will have the CKA_ALWAYS_SENSITIVE attribute set to CK_FALSE, and the CKA_NEVER_EXTRACTABLE attribute set to CK_FALSE. Also rememember, that the flags are mostly cosmetic. In the end the card enforces things, no matter what kind of flags you set in descriptors: (from PKCS#15): The semantics of the accessFlags field’s sensitive, extractable, alwaysSensitive, neverExtractable and local identifiers is the same as in PKCS #11. This field is not required to be present in cases where its value can be deduced by other means. _______________________________________________ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://www.opensc-project.org/mailman/listinfo/opensc-devel
