[gnutls-devel] GnuTLS | PKCS#11: RSA-PSS should be enabled only when the private key can be used for signing (#667)

[Development of GNU's TLS library]

New Issue was created.

Issue 667: https://gitlab.com/gnutls/gnutls/issues/667
Author:    Nikos Mavrogiannopoulos
Assignee:  

In `gnutls_pkcs11_privkey_import_url()` we only enable RSA-PSS functionality to the key if the `CKM_RSA_PKCS_PSS` mechanism is available to the token. However, if the specific key is not marked for use with digital signatures (`CKA_SIGN` set), then we may still end-up using it which will later fail. We should test whether `CKA_SIGN` is set prior to enabling such keys for PSS.

Furthermore we should make `CKA_SIGN/VERIFY` and `CKA_ENCRYPT/DECRYPT` visible via p11tool by amending `gnutls_pkcs11_obj_flags_get_str()`.

[reported originally at: https://bugzilla.redhat.com/show_bug.cgi?id=1663058]

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/issues/667
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20190104/847271c5/attachment.html>