Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FindAllKeyPairs breaks on unsupported key type #68

Open
Knacktus opened this issue Mar 28, 2020 · 0 comments
Open

FindAllKeyPairs breaks on unsupported key type #68

Knacktus opened this issue Mar 28, 2020 · 0 comments

Comments

@Knacktus
Copy link

Hello,

I'm using this awesome library to read a certificate and get the corresponding signer from a smartcard.
The smartcard contains 3 proper certificates (RSA).
However, the following code returns an empty slice:

allKeyPairs, err := c.FindAllKeyPairs()
if err != nil {
	fmt.Errorf("error finding all key pairs", err)
}

fmt.Println("Number of key pairs ", len(allKeyPairs))

Now, I've found that for some reason there's a case where there is an unsupported key type (in file keys.go on line 209).

On the smartcard I can see a total of 13 objects (but I'm not a PKCS#11 expert so I don't really know what is going on in depth).

This unsupported key type in turn causes the loop in the function FindKeyPairsWithAttributes to return on line 232.

Replacing this return statement with a continue statement keeps the loop running and leads to the desired result (in my case a slice with 3 signer interfaces).

err = c.withSession(func(session *pkcs11Session) error {
	// Add the private key class to the template to find the private half
	privAttributes := attributes.Copy()
	err = privAttributes.Set(CkaClass, pkcs11.CKO_PRIVATE_KEY)
	if err != nil {
		return err
	}

	privHandles, err := findKeysWithAttributes(session, privAttributes.ToSlice())
	if err != nil {
		return err
	}

	for _, privHandle := range privHandles {
		k, err := c.makeKeyPair(session, &privHandle)

		if err == errNoCkaId || err == errNoPublicHalf {
			continue
		}
		if err != nil {
                           // keep looping in case of an unsupported key type
			continue
			//return err
		}

		keys = append(keys, k)
	}

	return nil
})

I can't judge if this should be fixed in this lib. If not, are there any workarounds? I basically need to read all certificates from the smartcard, choose the one with usage of clientauth and then get the corresponding singer to use the cert and the signer to perform a http client request.

Cheers,

Jan

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant