SunPKCS11 CKR_ARGUMENTS_BAD fixes #11 - #12
Merged
Merged
Conversation
CKM_SHA256_RSA_PKCS hands the token the message, not a digest, and the token hashes it. The module expected a bare 32-byte digest, so every conforming caller (jsign through Java SunPKCS11, pkcs11-tool) got CKR_ARGUMENTS_BAD. Always hash under that mechanism instead of guessing from the length: a 32-byte or DigestInfo-shaped message would otherwise be signed unhashed. CKM_RSA_PKCS (osslsigncode) is unchanged and still refuses anything but a SHA-256 DigestInfo or digest, rather than signing a re-hashed SHA-384 one. The debug print is dropped; unit tests cover both mechanisms. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ENsGGxgZ7pU5Z87YfBS2iY
A new pre-sign-checks job, after the build and behind the signing environment, drives the Certum cloud with the Linux binaries of the run: CKM_SHA256_RSA_PKCS (multi-part, 32- and 51-byte messages included) against CKM_RSA_PKCS with pkcs11-tool, jsign through SunPKCS11 on PE and MSI, osslsigncode on every format, and the CLI. Both signing jobs, and so the release, need it. It also runs on workflow_dispatch. The build job gains a credential-free smoke test of the module: it loads, shows the ssign token and the SHA-256 RSA mechanisms. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ENsGGxgZ7pU5Z87YfBS2iY
Contributor
Author
|
Nice to add tests, i should have done that. Thank you! |
Owner
|
Thanks for the report and the fix! One change on top: under CKM_SHA256_RSA_PKCS the module now always hashes instead of guessing from the length, since a 32-byte message would have been signed unhashed. jsign on EXE and MSI is now checked before every release. The fix ships in 0.1.6. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #11