Re: OpenSC doesn't support symmetric decrypt/encrypt operations

Isn’t asymmetrical encrypt & decrypt enough?



From: "carblue" <[email protected]<mailto:[email protected]>>
Date: Monday, 16 November 2020 at 13:48:48
To: "[email protected]" <[email protected]<mailto:[email protected]>>
Subject: [Opensc-devel] OpenSC doesn't support symmetric decrypt/encrypt operations

Hi all,

I would like to know from OpenSC maintainers/users, whether there is
interest in implementing

"OpenSC support of symmetric decrypt/encrypt operations done by cards
capable to do that".

As Hannu Honkanen pointed out in
https://github.com/OpenSC/OpenSC/issues/1796/#issuecomment-536728933

"(Symmetric) keys can be loaded using pkcs15-init and symmetric keys can
be used to wrap/unwrap keys but not for just doing encryption. It could
be implemented in quite similar way as the wrap/unwrap ...".

With such support available I think of this use case: I could
implement/fix #1796  testing 'key unwrap' in pkcs11.tool, that is most
meaningful with my ACOS5 card, i.e. test C_UnwrapKey + sym. key arrived
on-card and is cryptographically usable: E.g. create some random AES key
in memory, encrypt some test message with that key via OpenSSL, wrap the
AES key by means of a public RSA key from card, call C_UnwrapKey and -
supposed that stores the unwrapped AES key to card and cos is able to
sym. decrypt (true for acos5) - decrypt the encrypted test message with
the unwrapped AES key by an on-card operation, and finally compare that
to original/plain test message. There would probably also be other code
branches depending on how cards handle the unwrapped key (session object
/ in-memory object? / CKA_TOKEN / CKA_EXTRACTABLE).

Hence, if there is positive feedback, then I will start such an
implementation at
https://github.com/carblue/OpenSC-1/tree/sym_hw_encrypt  and possibly
others join in.

I haven't yet looked deeply into that area of OpenSC code, but this
question arises: I assume, the existing sc_card_operations:decipher is
reserved for asym. key operation, so there is a need for 2 new
sc_card_operations: Proposal:

encrypt / decrypt

Any ideas / comments / proposals ?


Cheers, Carsten Blüggel (carblue)







_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel