{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/771","repository_url":"https://api.github.com/repos/OpenSC/OpenSC","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/771/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/771/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/771/events","html_url":"https://github.com/OpenSC/OpenSC/issues/771","id":157382195,"number":771,"title":"Towards-0.16.0 broke EC key derivation on a PIV token via pkcs11-tool ","user":{"login":"mouse07410","id":5923577,"avatar_url":"https://avatars.githubusercontent.com/u/5923577?v=3","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-05-29T11:39:42Z","updated_at":"2016-05-29T18:08:54Z","closed_at":null,"body":"### Expected behaviour\r\n\r\nSymmetric key should be generated and stored in the specified file, without any errors. Here's the output from the *master* branch of a few months ago (sorry, as this used to **always** work, I did not bother to re-test it often):\r\n```\r\npkcs11-tool --module /Library/OpenSC/lib/opensc-pkcs11.so -l --derive -m ECDH1-COFACTOR-DERIVE -d 03 -i /tmp/derive.31436.pub.der -o /tmp/derive.31436.shared2\r\nLogging in to \"PIV_II (PIV Card Holder pin)\".\r\nPlease enter User PIN:\r\nUsing derive algorithm 0x00001051 ECDH1-COFACTOR-DERIVE\r\n\r\n```\r\n\r\n\r\n### Actual behaviour\r\n\r\n\r\n```\r\n$ OPENSC_DEBUG=9 pkcs11-tool -v --module /Library/OpenSC/lib/opensc-pkcs11.dylib -l --derive -m ECDH1-DERIVE -d 03 -i ephem256.pub.der -o t.bin\r\nUsing slot 0 with a present token (0x0)\r\nLogging in to \"PIV_II (PIV Card Holder pin)\".\r\nPlease enter User PIN:\r\nUsing derive algorithm 0x00001050 ECDH1-DERIVE\r\nerror: PKCS11 function C_DeriveKey failed: rv = CKR_GENERAL_ERROR (0x5)\r\n\r\nAborting.\r\n$ OPENSC_DEBUG=9 pkcs11-tool -v --module /Library/OpenSC/lib/opensc-pkcs11.dylib -l --derive -m ECDH1-COFACTOR-DERIVE -d 03 -i ephem256.pub.der -o t.bin\r\nUsing slot 0 with a present token (0x0)\r\nLogging in to \"PIV_II (PIV Card Holder pin)\".\r\nPlease enter User PIN:\r\nUsing derive algorithm 0x00001051 ECDH1-COFACTOR-DERIVE\r\nerror: PKCS11 function C_DeriveKey failed: rv = CKR_GENERAL_ERROR (0x5)\r\n\r\nAborting.\r\n```\r\n\r\nNote that this process worked with the *master* branch. Also note that it still works with OpenSSL and libp11:\r\n```\r\n$ openssl pkeyutl -engine pkcs11 -keyform engine -derive -inkey \"pkcs11:object=KEY%20MAN%20key;object-type=private\" -peerform DER -peerkey ephem256.pub.der -hexdump\r\nengine \"pkcs11\" set.\r\nPKCS#11 token PIN:\r\n0000 - 16 2d 11 e2 19 f8 af 5f-97 c4 6f fa 39 65 5c 5b   .-....._..o.9e\\[\r\n0010 - 65 5a 5c fc eb bd 89 0a-d6 59 b8 ea e6 5d 95 8f   eZ\\......Y...]..\r\n$\r\n```\r\n\r\nAlso note that specifying `--slot 0` (or whatever) does not change the outcome.\r\n\r\n### Steps to reproduce\r\n\r\n1. Generate a random EC key pair using OpenSSL 1.0.2h, like \r\n```\r\n$ openssl ecparam -name prime256v1 -genkey -out ephem256.priv\r\n$ openssl ec -in ephem256.priv -pubout -outform DER -out ephem256.pub.der\r\nread EC key\r\nwriting EC key\r\n$\r\n```\r\n\r\n2. Insert a PIV token (e.g., Yubikey NEO) with ECC keys\r\n\r\n3. Invoke `pkcs11-tool` to derive a shared key:\r\n```\r\n$ pkcs11-tool -v --module /Library/OpenSC/lib/opensc-pkcs11.dylib -l --derive -m ECDH1-DERIVE -d 03 -i ephem256.pub.der -o t.bin\r\n```\r\n\r\n\r\n### Logs\r\n\r\nThe following log shows two attempts - one using `ECDH1-DERIVE`, the other one using `ECDH1-COFACTOR-DERIVE`. With the same result, of course.\r\n[opensc-16-tool-broken.txt](https://github.com/OpenSC/OpenSC/files/288299/opensc-16-tool-broken.txt)\r\n\r\n\r\nThe following log shows how key derivation succeeds when `libp11` (under OpenSSL) drives OpenSC library:\r\n[opensc-ssl-good.txt](https://github.com/OpenSC/OpenSC/files/288326/opensc-ssl-good.txt)\r\n\r\n\r\nExcerpt from the error log:\r\n```\r\n0x7fff70ae2000 07:24:27.748 [opensc-pkcs11] reader-pcsc.c:270:pcsc_transmit:\r\nOutgoing APDU (12 bytes):\r\n00 87 11 9D 06 7C 04 82 00 85 00 00 .....|......\r\n0x7fff70ae2000 07:24:27.748 [opensc-pkcs11] reader-pcsc.c:199:pcsc_internal_transmit: called\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] reader-pcsc.c:279:pcsc_transmit:\r\nIncoming APDU (2 bytes):\r\n6F 00 o.\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] apdu.c:386:sc_single_transmit: returning with: 0 (Success)\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] apdu.c:539:sc_transmit: returning with: 0 (Success)\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card-piv.c:503:piv_general_io: DEE r=0 apdu.resplen=0 sw1=6f sw2=00\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] iso7816.c:121:iso7816_check_sw: No precise diagnosis\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card-piv.c:515:piv_general_io: Card returned error\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card-piv.c:565:piv_general_io: returning with: -1200 (Card command failed)\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card-piv.c:2334:piv_validate_general_authentication: returning with: -1200 (Card command failed)\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card-piv.c:2419:piv_decipher: returning with: -1200 (Card command failed)\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] sec.c:44:sc_decipher: returning with: -1200 (Card command failed)\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 07:24:27.765 [opensc-pkcs11] pkcs15-sec.c:279:sc_pkcs15_derive: use_key() failed: -1200 (Card command failed)\r\n```\r\n\r\n\r\nThis is the excerpt from the \"good\" log, showing how key derivation succeeds (it's longer than 10 lines, sorry):\r\n```\r\n: Slot:0 Setting object handle of 0x0 to 0x7f8db343b060\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] pkcs11-object.c:126:sc_create_object_int: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] misc.c:254:session_start_operation: called\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] misc.c:255:session_start_operation: Session 0x7f8db350a3b0, type 5\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] framework-pkcs15.c:3668:pkcs15_prkey_derive: Initiating derivation\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] framework-pkcs15.c:3674:pkcs15_prkey_derive: derivation 0x7f8db350a3b0 0x7f8db3507410 0x7f8db343aa48 0x7f8db343b1e0 40 0x0 0\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] pkcs15-sec.c:252:sc_pkcs15_derive: called\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] pkcs15-sec.c:262:sc_pkcs15_derive: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] framework-pkcs15.c:3719:pkcs15_prkey_derive: Derivation complete. Result 0.\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] framework-pkcs15.c:3668:pkcs15_prkey_derive: Initiating derivation\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] framework-pkcs15.c:3674:pkcs15_prkey_derive: derivation 0x7f8db350a3b0 0x7f8db3507410 0x7f8db343aa48 0x7f8db343b1e0 40 0x7f8db343aa70 32\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] card.c:394:sc_lock: called\r\n0x7fff70ae2000 08:30:23.615 [opensc-pkcs11] reader-pcsc.c:547:pcsc_lock: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] pkcs15-sec.c:252:sc_pkcs15_derive: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] padding.c:283:sc_get_encoding_flags: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] padding.c:287:sc_get_encoding_flags: iFlags 0x0, card capabilities 0x30010\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] padding.c:316:sc_get_encoding_flags: pad flags 0x0, secure algorithm flags 0x10000\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] padding.c:317:sc_get_encoding_flags: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card.c:394:sc_lock: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] sec.c:68:sc_set_security_env: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:2221:piv_set_security_env: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:2225:piv_set_security_env: flags=00000015 op=4 alg=2 algf=00010000 algr=00000100 kr0=9d, krfl=1\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:2252:piv_set_security_env: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] sec.c:72:sc_set_security_env: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] sec.c:40:sc_decipher: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:2417:piv_decipher: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:2281:piv_validate_general_authentication: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:454:piv_general_io: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:457:piv_general_io: 87 11 9d 71 : 255 256\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card.c:394:sc_lock: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card-piv.c:497:piv_general_io: calling sc_transmit_apdu flags=1 le=256, resplen=4096, resp=0x7fff5bf34150\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] apdu.c:550:sc_transmit_apdu: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] card.c:394:sc_lock: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] apdu.c:517:sc_transmit: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] apdu.c:371:sc_single_transmit: called\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] apdu.c:376:sc_single_transmit: CLA:0, INS:87, P1:11, P2:9D, data(71) 0x7fff5bf35240\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] reader-pcsc.c:269:pcsc_transmit: reader 'Yubico Yubikey NEO OTP+U2F+CCID'\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] reader-pcsc.c:270:pcsc_transmit:\r\nOutgoing APDU (77 bytes):\r\n00 87 11 9D 47 7C 45 82 00 85 41 04 EC 47 63 1F ....G|E...A..Gc.\r\nC6 05 85 D2 FE 5F 54 AB 88 FF 77 B7 58 BD 97 7D ....._T...w.X..}\r\n24 E1 BC 80 15 00 F3 09 9E 8C 8A F0 67 62 00 43 $...........gb.C\r\nD1 4F B7 EA BC F6 BB 76 FF D2 D8 D7 CA E7 90 46 .O.....v.......F\r\n88 D2 F1 92 39 50 37 07 D2 AE 28 17 00          ....9P7...(..\r\n0x7fff70ae2000 08:30:23.616 [opensc-pkcs11] reader-pcsc.c:199:pcsc_internal_transmit: called\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] reader-pcsc.c:279:pcsc_transmit:\r\nIncoming APDU (38 bytes):\r\n7C 22 82 20 16 2D 11 E2 19 F8 AF 5F 97 C4 6F FA |\". .-....._..o.\r\n39 65 5C 5B 65 5A 5C FC EB BD 89 0A D6 59 B8 EA 9e\\[eZ\\......Y..\r\nE6 5D 95 8F 90 00                               .]....\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] apdu.c:386:sc_single_transmit: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] apdu.c:539:sc_transmit: returning with: 0 (Success)\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card-piv.c:503:piv_general_io: DEE r=0 apdu.resplen=36 sw1=90 sw2=00\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card-piv.c:548:piv_general_io: DEE got buffer 0x7f8db343b8e0 len 36\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card-piv.c:565:piv_general_io: returning with: 36\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card-piv.c:2334:piv_validate_general_authentication: returning with: 32\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card-piv.c:2419:piv_decipher: returning with: 32\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] sec.c:44:sc_decipher: returning with: 32\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] pkcs15-sec.c:291:sc_pkcs15_derive: returning with: 32\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] card.c:434:sc_unlock: called\r\n0x7fff70ae2000 08:30:23.736 [opensc-pkcs11] reader-pcsc.c:587:pcsc_unlock: called\r\n0x7fff70ae2000 08:30:23.737 [opensc-pkcs11] framework-pkcs15.c:3719:pkcs15_prkey_derive: Derivation complete. Result 32.\r\n```\r\n\r\n\r\n**Addendum**\r\nThere is one difference: the working example of `pkcs11-tool` shown above, had incorrect *Key Usage* - it included both `KeyEncipherment` **and** `KeyAgreement`. As the standard says, for RSA only `KeyEncipherment` must be specified, and for EC (or DH) - only `KeyAgreement` (without `KeyEncipherment`). OpenSSL and libp11 work fine with the correct Key Usage as shown above."},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/222374235","html_url":"https://github.com/OpenSC/OpenSC/issues/771#issuecomment-222374235","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/771","id":222374235,"user":{"login":"mouse07410","id":5923577,"avatar_url":"https://avatars.githubusercontent.com/u/5923577?v=3","gravatar_id":"","url":"https://api.github.com/users/mouse07410","html_url":"https://github.com/mouse07410","followers_url":"https://api.github.com/users/mouse07410/followers","following_url":"https://api.github.com/users/mouse07410/following{/other_user}","gists_url":"https://api.github.com/users/mouse07410/gists{/gist_id}","starred_url":"https://api.github.com/users/mouse07410/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mouse07410/subscriptions","organizations_url":"https://api.github.com/users/mouse07410/orgs","repos_url":"https://api.github.com/users/mouse07410/repos","events_url":"https://api.github.com/users/mouse07410/events{/privacy}","received_events_url":"https://api.github.com/users/mouse07410/received_events","type":"User","site_admin":false},"created_at":"2016-05-29T18:08:54Z","updated_at":"2016-05-29T18:08:54Z","body":"I've added debugging print in `pkcs11-tool`:\r\n```\r\n\t\tlen = EC_POINT_point2oct(ecgroup, ecpoint, POINT_CONVERSION_UNCOMPRESSED, buf, sizeof(buf),NULL);\r\n\r\n\t\t// Dump converted EC Pubkey\r\n\t\tif (verbose) {\r\n\t\t  fprintf(stderr, \"  pkcs11-tool.derive_key(): point (%d bytes):\\n\", len);\r\n\t\t  for (int ii = 0; ii < len; ii++) {\r\n\t\t    if (ii > 0 && (ii % 16 == 0)) fprintf(stderr, \"\\n\");\r\n\t\t    fprintf(stderr, \"%02x \", buf[ii]);\r\n\t\t  }\r\n\t\t  fprintf(stderr, \"\\n\");\r\n\t\t}\r\n\t\t\r\n\t\tmemset(&ecdh_parms, 0, sizeof(ecdh_parms));\r\n```\r\n\r\nThis is the result:\r\n```\r\n$ OPENSC_DEBUG=9 src/tools/.libs/pkcs11-tool -v --module /Library/OpenSC/lib/opensc-pkcs11.so -l --derive -m ECDH1-COFACTOR-DERIVE -d 03 -i ephem256.pub.der -o t.bin\r\nUsing slot 0 with a present token (0x0)\r\nLogging in to \"PIV_II (PIV Card Holder pin)\".\r\nPlease enter User PIN:\r\nUsing derive algorithm 0x00001051 ECDH1-COFACTOR-DERIVE\r\n  pkcs11-tool.derive_key(): point (65 bytes):\r\n04 ec 47 63 1f c6 05 85 d2 fe 5f 54 ab 88 ff 77\r\nb7 58 bd 97 7d 24 e1 bc 80 15 00 f3 09 9e 8c 8a\r\nf0 67 62 00 43 d1 4f b7 ea bc f6 bb 76 ff d2 d8\r\nd7 ca e7 90 46 88 d2 f1 92 39 50 37 07 d2 ae 28\r\n17\r\nerror: PKCS11 function C_DeriveKey failed: rv = CKR_GENERAL_ERROR (0x5)\r\n\r\nAborting.\r\n$\r\n```"}}
{"actor":{"display_login":"mouse07410"}}