RE: Integrated v1.1 SFL & Fortezza CTIL

THANKS!!

FYI: Issues 1-4 have been addressed.  

We'll address the other issues ASAP.

Thanks again,
Pierce Leonberger
--
J.G. Van Dyke & Associates, Inc.


-----Original Message-----
From: Thomas Fronckowiak Jr. [mailto:[email protected]]
Sent: Wednesday, August 18, 1999 3:23 PM
To: [email protected]
Subject: Integrated v1.1 SFL & Fortezza CTIL


We (LJL) have integrated v1.1 SFL using the Fortezza CTIL and have 
successfully signed, verified, encrypted and decrypted.

Following is a list of issues/concerns we've come across so far, 
mostly with the Fortezza CTIL:

1. Failure setting personality during encrypt/decrypt.
Module: 	sm_fortdll.dll
File:		sm_fort.cpp
Function:	CSM_Fortezza::SMTI_GenerateKeyAgreement &
		CSM_Fortezza::SMTI_ExtractKeyAgreement
Line:		[947]	error = CI_SetPersonality(mp_cardInfo->GetSlot());
		[1020]	error = CI_SetPersonality( mp_cardInfo->GetSlot());

GetSlot returns the current slot which happens to be changed during a call
to GetUserPath().  Suggest:

   error = CI_SetPersonality(m_nEncryptorIndex);

to be consistant with other CI_SetPesonality calls.

2. If/else logic causes the root certificate to be retrieved, even
when bRootFlag == FALSE.
Module: 	sm_fortdll.dll
File:		sm_fortci.cpp
Function: 	CSM_Fortezza::GetUserPath()
Line: 		[327] if (nParentSlot == 0 && bRootFlag == true )

	if (nParentSlot == 0 && bRootFlag == true )
	else

should be changed to:

	if (nParentSlot == 0 && bRootFlag == true )
	else if (nParentSlot>0)

3. Encrypt failed because the data length was not a multiple of 8 bytes.
Module: 	sm_fortdll.dll
File:		sm_fort.cpp
Function: 	CSM_Fortezza::GeneratePad()
Line: 		[820] data.Open(SM_FOPEN_APPEND);

Padding is calculated correctly, but it is not appended to the data.
Rather it overwrites the first (x) bytes of the data.  The problem
is in CSM_Buffer::Open - the option SM_FOPEN_APPEND only has
an affect when CSM_Buffer refers to a file.  The work around
was to copy the data, add the padding, and then reset the
CSM_Buffer.

4. Decryption sometimes gives a "Bad Pad" error.
Module: 	sm_fortdll.dll
File:		sm_fort.cpp
Function: 	CSM_Fortezza::ExtractPad()
Line: 		[852] data.Seek(-1, SEEK_END);

Attempting to extract the padding after decryption.  This function
works for padding between 2-8.  A padding of 1 returns an
error because SEEK_END with a -1 puts the pointer to the
*2nd* last byte, not the last byte.  Should be:

   data.Seek(0, SEEK_END);

5. SM_ASSIGN_ANYBUF failed.
Module: 	libsm.lib
File:		sm_MsgCertCrls.cpp
Function: 	CSM_Fortezza::UpdateParams()
Line: 		[515] data.Seek(-1, SEEK_END);

alg.parameters is NULL. Suggest:

	if (alg.parameters)
		delete (CSM_Buffer*)alg.parameters->value;
	SM_ASSIGN_ANYBUF(pCBuf, alg.parameters);

be changed to:

	if (alg.parameters)
		delete (CSM_Buffer*)alg.parameters->value;
	else
		alg.parameters = new AsnAny;

	SM_ASSIGN_ANYBUF(pCBuf, alg.parameters);

6. CSM_Fortezza::SMTI_XXXXX functions that perform a CI_Lock() call 
CI_Unlock() before the SME_FINISH_CATCH line instead of after it.  We 
haven't experienced any problem with this - just wondered if this might
cause a situation where the card was left locked after a thrown error.

7. May consider updating CSM_OID::GetOIDDescription() to include 
id-keyExchangeAlgorithm, id-fortezzaWrap80, and other fortezza
oids.

Thanks,
Tom