RE: PKINIT for gsissh

Hi Love,

I noticed there is a two pointer comparison in hx509/crypto.c where the execution point goes and error occurs afterwards: 

    if (indata.data != data->data)
        der_free_octet_string(&indata);
        if (ret <= 0) {

        ret = HX509_CMS_FAILED_CREATE_SIGATURE;
        hx509_set_error_string(context, 0, ret,
                               "RSA private encrypt failed: %d", ret);
        return ret;
    }

The memory traces show there is always two different values for indata.data and data->data and ret is set to -2 before line " ret = HX509_CMS_FAILED_CREATE_SIGATURE".  Do you know the reason for this comparison in the if condition?

Best regards
Ali



-----Original Message-----
From: Love Hörnquist Åstrand 
Sent: den 30 september 2011 13:05
To: <[email protected]>; Ali Gholami
Cc: Douglas E. Engert; Ali Gholami
Subject: Re: PKINIT for gsissh

This error happens when the RSA signature creation failed.

Can you put a breakpoint in RSA_private_encrypt() and RSA_sign() to see why it failes (or hc_RSA_private_encrypt and hc_RSA_sign if you use hcrypto)

Love


30 sep 2011 kl. 12:21 skrev Ali Gholami:

> Hi Douglas,
> 
> Thanks a lot for your explanation. As the first step, I was trying the command: kinit -C FILE:$X509_USER_PROXY -D DIR:$X509_CERT_DIR user@REALM but I get the same error in http://comments.gmane.org/gmane.comp.encryption.kerberos.heimdal.general/6166.
> 
> I think this bug still is not fixed. I'm using Heimdal version 1.5. Does any one in list if this bug has been fixed? 
> kinit -C FILE:$X509_USER_PROXY -D DIR:$X509_CERT_DIR user@REALM
> kinit: krb5_get_init_creds: Create CMS signedData: RSA private encrypt failed: 569888
> 
> 
> Best regards,
> Ali
> 
> 
> ________________________________________
> From: Douglas E. Engert [[email protected]]
> Sent: Thursday, September 29, 2011 11:36 PM
> To: Ali Gholami
> Cc: [email protected]
> Subject: Re: PKINIT for gsissh
> 
> On 9/29/2011 3:17 PM, Ali Gholami wrote:
>> Hi Douglas,
>> 
>> Thank you for your reply.
>> 
>> Yes, I asked the globus security mailing list but apparently no one had experience with Heimdal, therefore, I brought up the issue here. I'm very interested in your solution but could you please explain a little more how did you implement it? for instance did you use some specific pam modules, ForceCommand, etc.
>> 
> 
> It was in 1998 when I was on the Globus project, before PKINIT.
> I had mods to the MIT KDC called and a client, sslk5. It would use gsi
> that is really SSL client authentication, to return a ticket. More of
> a proof of concept.  There was a gsiklog for AFS too.
> 
> Googling for: heimdal pkinit proxy
> shows these:
> http://comments.gmane.org/gmane.comp.encryption.kerberos.heimdal.general/6166
> http://osdir.com/ml/encryption.kerberos.heimdal.general/2007-01/msg00077.html
> 
> In your .ssh/rc (or after you login) you could do something like:
> 
> kinit -C FILE:$X509_USER_PROXY -D DIR:$X509_CERT_DIR user@REALM
> (You would need to determine where the current gsissh was saving
> the proxy.)
> 
> The KDC has to be setup to handle proxies see or newer docs:
> 
> http://www.h5l.org//manual/HEAD/info/heimdal.html#Setting-up-PK_002dINIT
> see the option:
>        pkinit_allow_proxy_certificate = no
> 
> 
>> Best regards
>> Ali
>> 
>> 
>> 
>> On Sep 29, 2011, at 9:18 PM, Douglas E. Engert wrote:
>> 
>>> Have you asked on the globus security list?
>>> http://lists.globus.org/mailman/listinfo
>>> 
>>> On 9/29/2011 11:47 AM, Ali Gholami wrote:
>>>> Dear All,
>>>> 
>>>> I'm trying to setup a gsissh server which is able to acquire kerberos tickets from a KDC using x509 certificate proxy stored in $X509_USER_PROXY using Heimdal 1.5 PKINIT. Does anyone have done a
>>>> similar experience or any ideas how to do this?
>>> 
>>> I did something like this many years ago for Globus before there was a PKINIT...
>>> 
>>> The proxy  has both a certificate and the unencrypted key, so you should
>>> be able to use the PKINIT.
>>> 
>>> The KDC would need accept proxy certificates, and I thing the Heimdal
>>> KDC can.
>>> 
>>>> 
>>>> Best regards,
>>>> Ali
>>> 
>>> --
>>> 
>>> Douglas E. Engert<[email protected]>
>>> Argonne National Laboratory
>>> 9700 South Cass Avenue
>>> Argonne, Illinois  60439
>>> (630) 252-5444
>> 
> 
> --
> 
>  Douglas E. Engert  <[email protected]>
>  Argonne National Laboratory
>  9700 South Cass Avenue
>  Argonne, Illinois  60439
>  (630) 252-5444