{"push_id":979453518,"size":10,"distinct_size":1,"ref":"refs/heads/master","head":"13621db9710433e1dbbc86f554a2a439aa3f9ebc","before":"e75401fdd4397e08e04d0dc07719c1ef244980e8","commits":[{"sha":"47347211805578c638a0271e77e2734f23a66605","author":{"email":"65adda4326914576405c9e3a62f4904d96573863@wunner.de","name":"Lukas Wunner"},"message":"card-gemsafeV1: Support signing SHA256\n\nGemSAFE V1 cards support signing 36 bytes of free form data.\nWhen signing a hash, the hash must be prepended by the DigestInfo\nheader. The PKCS#1 padding is done on the card. The 36 bytes limit\nis sufficient for MD5 (16 + 18 bytes for the header), SHA1 and\nRIPEMD160 (both use 20 + 15 bytes for the header) and MD5_SHA1\n(16 + 20 bytes, no header). The algorithm reference (\"cryptographic\nmechanism reference\" in ISO 7816 parlance) for signing free form data\nis 0x12.\n\nGemSAFE V3 cards changed the algorithm reference for signing free\nform data to 0x02. In addition, they gained the ability to sign SHA256.\nSince SHA256 exceeds the 36 bytes limit (32 + 19 bytes for the header),\nit must be sent to the card *without* DigestInfo header. The header\nwill be prepended by the card and it is instructed to do so by sending\nalgorithm reference 0x42.\n\nThis scheme is also supported for SHA1, the algorithm reference is\n0x12 in this case. However using this is not necessary as SHA1 fits\nwithin the 36 bytes limit, including the header.\n\nSupporting SHA256 is straightforward, we just add it to the flags\nbefore adding the RSA algorithms. When sc_pkcs15_compute_signature()\ncalls sc_get_encoding_flags(), the input will be \"iFlags 0x202, card\ncapabilities 0x8000021A\" and the output will be \"pad flags 0x0, secure\nalgorithm flags 0x202\". I.e. the hash is neither prepended by the\nDigestInfo header nor PKCS#1 padded and the hash algorithm is passed\nto gemsafe_set_security_env() which can send the appropriate algorithm\nreference 0x42 to the card.\n\nHowever there's a catch: Once we add SHA256 to the flags, PKCS#11\napplications will be unable to use the other hashes like SHA1 or\nRIPEMD160. That's because register_mechanisms() checks if the card\nsupports no hashes, and if so, adds all of them:\n\n\t\tif (!(rsa_flags & SC_ALGORITHM_RSA_HASHES)) {\n\t\t\trsa_flags |= SC_ALGORITHM_RSA_HASHES;\n\t\t}\n\nWe cannot add these missing hashes to the flags like we did with SHA256\nbecause like SHA256, they would be sent to the card *without* DigestInfo\nheader. What we want is to send all hashes *with* DigestInfo header,\n*except* for SHA256.\n\nWe can achieve that by registering a fake RSA algorithm which includes\nthe missing hashes in its flags. This fake algorithm is never used\nbecause sc_card_find_rsa_alg() searches the algorithm list in-order\nand we register the fake algorithm *after* the real algorithms.\n\nThe fake algorithm persuades register_mechanisms() to register the\nmissing hashes because it ORs the flags of all RSA algorithms together:\n\n\tnum = card->algorithm_count;\n\twhile (num--) {\n\t\tswitch (alg_info->algorithm) {\n\t\t\tcase SC_ALGORITHM_RSA:\n\t\t\t\trsa_flags |= alg_info->flags;\n\t\t\t\tbreak;\n\t\t}\n\t}\n\nSo when signing e.g. a RIPEMD160 hash and sc_pkcs15_compute_signature()\ncalls sc_get_encoding_flags(), the input will be \"iFlags 0x102, card\ncapabilities 0x8000021A\" and the output will be \"pad flags 0x100, secure\nalgorithm flags 0x2\". This will result in the hash being prepended by\nthe DigestInfo header, which is what we want.","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/47347211805578c638a0271e77e2734f23a66605"},{"sha":"14953f20759b9eec04f65d05d24c2791f76e8918","author":{"email":"d1644f04cb38db95a8858d4e6a2d12b167990bf4@gmail.com","name":"Frank Morgner"},"message":"Merge remote-tracking branch 'origin/master'","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/14953f20759b9eec04f65d05d24c2791f76e8918"},{"sha":"e1a3bf8805f712a0c99a8fa8fa1b2d8f3aa9428b","author":{"email":"53a11d345029ff1fa8d980e4bcc2abb968ab407b@gmail.com","name":"Aleksey Samsonov"},"message":"Rutoken ECP: set more universally 'Attempts' for RFS-files","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/e1a3bf8805f712a0c99a8fa8fa1b2d8f3aa9428b"},{"sha":"6b2fcf825f6e6203c51791f4a45f351b7c3a312f","author":{"email":"53a11d345029ff1fa8d980e4bcc2abb968ab407b@gmail.com","name":"Aleksey Samsonov"},"message":"Rutoken ECP: additional Miller-Rabin tests aren't needed\n\nMake universal properties at RSF-files. Additional Miller-Rabin tests\naren't needed for 'Rutoken ECP' and for 'Rutoken ECP 2.0'\n\nfixes https://github.com/OpenSC/OpenSC/issues/648 :\n'Incorrect parameters in APDU' at 'Rutoken ECP 2.0' when 'pkcs15-init -G\nrsa/1024 ...'","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/6b2fcf825f6e6203c51791f4a45f351b7c3a312f"},{"sha":"7cce5d432e1b6e3261958cd75fa6aa2e84809c98","author":{"email":"d1644f04cb38db95a8858d4e6a2d12b167990bf4@gmail.com","name":"Frank Morgner"},"message":"Merge branch 'master' of https://github.com/OpenSC/OpenSC","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/7cce5d432e1b6e3261958cd75fa6aa2e84809c98"},{"sha":"5c018dcd8c423b3b5346831148f464e46434a868","author":{"email":"d1644f04cb38db95a8858d4e6a2d12b167990bf4@gmail.com","name":"Frank Morgner"},"message":"Merge pull request #664 from sfff/fix-648\n\nFix #648","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/5c018dcd8c423b3b5346831148f464e46434a868"},{"sha":"e2c21d7c25f07af9d249bfe9018b9ce2a7d4a8e0","author":{"email":"0cf23d5533200b8ce5643b2954fbdcc3a0fc8e21@ftsafe.com","name":"Feitian Technologies"},"message":"Add new Feitian PKI Card ATR into OpenSC\n\nAdd new PKI Card ATR into OpenSC support, all of these ATR using same\nPKI Applet. and the ATR/JAVA CARD is provided by Feitian.\n\nMore information, please check www.javacardos.com\n\nFixes a memory leak in `entersafe_select_fid`\n\nCloses https://github.com/OpenSC/OpenSC/pull/625","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/e2c21d7c25f07af9d249bfe9018b9ce2a7d4a8e0"},{"sha":"b2c78033739373008832f9a4fc49b84876283618","author":{"email":"2fd5ceb46d2b4f58b7a3f7a006576df40bd20a8e@tscons.de","name":"Frank Thater"},"message":"sc-hsm: Fix share calculation if prime number is less than secret","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/b2c78033739373008832f9a4fc49b84876283618"},{"sha":"5e75dfc529d975ed71175b976b956de5dbb4dc08","author":{"email":"d1644f04cb38db95a8858d4e6a2d12b167990bf4@gmail.com","name":"Frank Morgner"},"message":"Merge pull request #670 from CardContact/nm_scheme_fix\n\nsc-hsm: Fix share calculation if prime number is less than secret","distinct":false,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/5e75dfc529d975ed71175b976b956de5dbb4dc08"},{"sha":"13621db9710433e1dbbc86f554a2a439aa3f9ebc","author":{"email":"fa8d9f64cc2f421746b18a1fdda77727eaf381b3@gmail.com","name":"Viktor Tarasov"},"message":"config: allow disabling of PKCS15 application","distinct":true,"url":"https://api.github.com/repos/viktorTarasov/OpenSC-SM/commits/13621db9710433e1dbbc86f554a2a439aa3f9ebc"}]}