{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1146","repository_url":"https://api.github.com/repos/OpenSC/OpenSC","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1146/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1146/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1146/events","html_url":"https://github.com/OpenSC/OpenSC/pull/1146","id":255634829,"number":1146,"title":"Enable RSA-PSS signatures in pkcs11-tool","user":{"login":"Jakuje","id":2694489,"avatar_url":"https://avatars3.githubusercontent.com/u/2694489?v=4","gravatar_id":"","url":"https://api.github.com/users/Jakuje","html_url":"https://github.com/Jakuje","followers_url":"https://api.github.com/users/Jakuje/followers","following_url":"https://api.github.com/users/Jakuje/following{/other_user}","gists_url":"https://api.github.com/users/Jakuje/gists{/gist_id}","starred_url":"https://api.github.com/users/Jakuje/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jakuje/subscriptions","organizations_url":"https://api.github.com/users/Jakuje/orgs","repos_url":"https://api.github.com/users/Jakuje/repos","events_url":"https://api.github.com/users/Jakuje/events{/privacy}","received_events_url":"https://api.github.com/users/Jakuje/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-09-06T14:57:02Z","updated_at":"2017-09-06T17:15:52Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/OpenSC/OpenSC/pulls/1146","html_url":"https://github.com/OpenSC/OpenSC/pull/1146","diff_url":"https://github.com/OpenSC/OpenSC/pull/1146.diff","patch_url":"https://github.com/OpenSC/OpenSC/pull/1146.patch"},"body":"The PSS signatures in PKCS#11 require parameters to mechanism info passed to `SignInit()`. They need to be adjustable for different hash algorithms (in generic RSA-PSS) and different MGFs. The definitions in `pkcs11.h` header file come from current PKCS#11 specification. The change also affects `pkcs11-spy` module, which now lists these parameters, if they are present.\r\n\r\nComments and naming improvements welcomed. This adds support for RSA-PSS into pkcs11-tool to use with other PKCS#11 modules. It does not add a support in the drivers in OpenSC, but it is also something I would like to investigate too.\r\n\r\nThere are also few more unrelated commits including typos (manual page), adding a few more mechanisms from PKCS#11 specification (`SHA224`) and helping compilers and static analyzers to avoid false warnings (`noreturn`)\r\n\r\n##### Checklist\r\n<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->\r\n- [X] Documentation is added or updated\r\n- [X] Tested with the following card: PKCS#11 module from yubihsm\r\n\t- [X] tested PKCS#11\r\n\t- [ ] tested Windows Minidriver\r\n\t- [ ] tested macOS Tokend"},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/327552552","html_url":"https://github.com/OpenSC/OpenSC/pull/1146#issuecomment-327552552","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/1146","id":327552552,"user":{"login":"dengert","id":865329,"avatar_url":"https://avatars2.githubusercontent.com/u/865329?v=4","gravatar_id":"","url":"https://api.github.com/users/dengert","html_url":"https://github.com/dengert","followers_url":"https://api.github.com/users/dengert/followers","following_url":"https://api.github.com/users/dengert/following{/other_user}","gists_url":"https://api.github.com/users/dengert/gists{/gist_id}","starred_url":"https://api.github.com/users/dengert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dengert/subscriptions","organizations_url":"https://api.github.com/users/dengert/orgs","repos_url":"https://api.github.com/users/dengert/repos","events_url":"https://api.github.com/users/dengert/events{/privacy}","received_events_url":"https://api.github.com/users/dengert/received_events","type":"User","site_admin":false},"created_at":"2017-09-06T17:15:52Z","updated_at":"2017-09-06T17:15:52Z","author_association":"MEMBER","body":"Cool. That addresses one of the problems. (I have only looked at you description and have no way to test it.)\r\n\r\nThe other part of @mouse07410\\'s problem is using OpenSSL utilities with libp11/engine for devices that do not support CKM_X_509. Unlike other padding methods where the padding can be striped off and the data sent to the card  via CKM_RSA_PKCS1, OpenSSL PSS padding can not be stripped as there is not enough information passed to determine the PSS parameters. Libp11 would need to call PKCS\\#11. "}}
{"actor":{"display_login":"dengert"}}