Fix to openCryptoki PKCS#11 TPM generated key handling

Fix to openCryptoki PKCS#11 TPM generated key handling

Change-Id: I6074d6674665e69c0e0725f8e61826a53bc55ef5

BUG=chromium-os:9984
TEST=all pkcs11 entd/run_tests.sh succeeded.

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=6c14915

Upstream fix tracking: http://sourceforge.net/tracker/index.php?func=detail&aid=3131950&group_id=128009&atid=710344

[Nelson Araujo, 2010-12-07 03:02:21]

PTAL. Thanks.

[James Simonsen, 2010-12-07 22:32:21]

http://codereview.chromium.org/5179001/diff/1/dev-libs/opencryptoki/files/ope...
File dev-libs/opencryptoki/files/opencryptoki-2.2.8-tpm_pubexp.patch (right):

http://codereview.chromium.org/5179001/diff/1/dev-libs/opencryptoki/files/ope...
dev-libs/opencryptoki/files/opencryptoki-2.2.8-tpm_pubexp.patch:9: +            
     Return default public exponent if not stored and/or returned
This doesn't feel like the right place to put in this specific workaround. It
seems like the default value either belongs in our TPM driver or we should pass
in the public exponent to opencryptoki. I don't really understand how this code
fits in to everything else though; are either of those ideas reasonable?

http://codereview.chromium.org/5179001/diff/1/dev-libs/opencryptoki/files/ope...
dev-libs/opencryptoki/files/opencryptoki-2.2.8-tpm_pubexp.patch:28: +         if
(pTemplate[i].ulValueLen < sizeof(pub_exp)) {
It seems like this should only be checked if we're actually going to use
pub_expr.

[Nelson Araujo, 2010-12-07 23:20:33]

http://codereview.chromium.org/5179001/diff/1/dev-libs/opencryptoki/files/ope...
File dev-libs/opencryptoki/files/opencryptoki-2.2.8-tpm_pubexp.patch (right):

http://codereview.chromium.org/5179001/diff/1/dev-libs/opencryptoki/files/ope...
dev-libs/opencryptoki/files/opencryptoki-2.2.8-tpm_pubexp.patch:9: +            
     Return default public exponent if not stored and/or returned
On 2010/12/07 22:32:21, James Simonsen wrote:
> This doesn't feel like the right place to put in this specific workaround. It
> seems like the default value either belongs in our TPM driver or we should
pass
> in the public exponent to opencryptoki. I don't really understand how this
code
> fits in to everything else though; are either of those ideas reasonable?

Without this code *all* operations with a openCryptoki TPM-generated key pair
fails. The idea here is that because the exponent is always 65537 it is not
stored in the TPM (this library ensures it is this value throughout the code).

Because it is a well-known value it is not stored in the TPM. When building a
response back to the caller we need to pass the default value along. Callers of
the API does not need to know in advance the exponent, and they will all fail if
it is missing.

http://codereview.chromium.org/5179001/diff/1/dev-libs/opencryptoki/files/ope...
dev-libs/opencryptoki/files/opencryptoki-2.2.8-tpm_pubexp.patch:28: +         if
(pTemplate[i].ulValueLen < sizeof(pub_exp)) {
On 2010/12/07 22:32:21, James Simonsen wrote:
> It seems like this should only be checked if we're actually going to use
> pub_expr.

correct. that's what the if() in the line immediately above ensures.

[James Simonsen, 2010-12-07 23:41:49]

LGTM

Nelson explained everything over the phone. This seems like the safest patch
that works for us. Nelson will work with the upstream devs to get it committed
there.

[Nelson Araujo, 2010-12-08 01:16:23]

PTAL.

[Nelson Araujo, 2010-12-21 04:38:33]

On 2010/12/08 01:16:23, Nelson Araujo wrote:
> PTAL.

Upstream fix tracking:
http://sourceforge.net/tracker/index.php?func=detail&aid=3131950&group_id=128...