Comments (7)
Please see #29 for more details on why we added this check. There is nothing in the spec that disallow this behavior. The text "for some reason" makes it valid to make a policy decision. But the check could be removed if we find it unusable.
from softhsmv2.
What about white listing the trusted hash schemes like SHA-X? The arguments in #26 do not apply here. When looking into the code I see that in C_DeriveKey
CKM_SHA1_KEY_DERIVATION
is not supported. So this does not seem to be an option as alternative.
Is there any other way how you are supporting key derivation schemes based on a given key?
Is there a chance in the future to support key derivation schemes using a nonce, e.g. just nonce+key or more elaborate schemes like HKDF?
from softhsmv2.
A good option would be to implement CKM_SHA1_KEY_DERIVATION in SoftHSM. Currently we only support CKM_DH_PKCS_DERIVE, CKM_ECDH1_DERIVE, CKM_DES_ECB_ENCRYPT_DATA, CKM_DES_CBC_ENCRYPT_DATA, CKM_DES3_ECB_ENCRYPT_DATA, CKM_DES3_CBC_ENCRYPT_DATA, CKM_AES_ECB_ENCRYPT_DATA, CKM_AES_CBC_ENCRYPT_DATA.
Or as you say to whitelist algorithms like SHA-X.
What would you prefer? With the derive option there is still a possibility to keep the derived key "on-board".
from softhsmv2.
I'm fine with both options, the white listing is good enough for me right now, because it opens the complete SHA has family and I do not need the key after the derivation.
from softhsmv2.
We will do whitelisting of algorithms for C_DigestKey().
from softhsmv2.
Fixed in #300
from softhsmv2.
Thanks. I have now finally updated the SoftHSMv2 library and not using my patched version anymore.
from softhsmv2.
Related Issues (20)
- Getting SIGSEGV in EVP_MD_CTX_free HOT 1
- Implements RFC5649 as CKM_AES_KEY_WRAP_PAD but should actually be CKM_AES_KEY_WRAP_KWP
- Per-slot configuration
- openssl operations involving pcks11 and softHSM result in segfault on exit HOT 9
- AES/GCM multi-part decryption fails with CKR_BUFFER_TOO_SMALL HOT 1
- Unit Tests fails HOT 4
- Make check test fails on OS X HOT 2
- AES key file format for import HOT 1
- Possible problem with v2.6.1 with RHEL8 in FIPS mode and using Java 17 HOT 4
- Documentation for SoftHSM is inaccessible HOT 4
- Coredump / Alma/rhel 9 HOT 2
- decrypting scrambled ciphered text with RSA succeeded on RHEL9 unexpectedly
- SoftHSM on AIX
- Issues with configure option `--with-openssl=PATH`
- Any chance for SignRecover and VerifyRecover implementation? HOT 2
- softhsm2-util AES key import fails whenever a newline character is present in file HOT 2
- Using SoftHSMv2 Token for StrongSwan
- Security: release signing public key: missing and expires 1 August 2024
- Facing problem in Digital Certificate Generation (x.509) using keys stored in softHSM.
- wiki.opendnnsec.org certificate expired?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from softhsmv2.