linux-kernel - [PATCH] sign-file,read_private_key_pkcs11: add pkcs11 provider PIN setting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250321133956.154597-1-ayoub.zaki@embetrix.com>
Date: Fri, 21 Mar 2025 14:39:56 +0100
From: Ayoub Zaki <ayoub.zaki@...etrix.com>
To: linux-kernel@...r.kernel.org
Cc: dhowells@...hat.com,
	dwmw2@...radead.org,
	keyrings@...r.kernel.org,
	Ayoub Zaki <ayoub.zaki@...etrix.com>
Subject: [PATCH] sign-file,read_private_key_pkcs11: add pkcs11 provider PIN setting

in the same way as for PKCS11_ENGINE, add PKCS#11 token PIN injection
for PKCS11_PROVIDER from key_pass environment variable if set.

Signed-off-by: Ayoub Zaki <ayoub.zaki@...etrix.com>
---
 scripts/sign-file.c | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 7070245edfc1..bdd26e438ff6 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -31,6 +31,7 @@
 # define USE_PKCS11_PROVIDER
 # include <openssl/provider.h>
 # include <openssl/store.h>
+#include <openssl/ui.h>
 #else
 # if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
 #  define USE_PKCS11_ENGINE
@@ -107,19 +108,45 @@ static int pem_pw_cb(char *buf, int len, int w, void *v)
 	return pwlen;
 }
 
+#ifdef USE_PKCS11_PROVIDER
+int ui_get_pin(UI *ui, UI_STRING *uis)
+{
+	const char *pin = (const char *)UI_get0_user_data(ui);
+
+	if (pin == NULL)
+		return -1;
+
+	int ret = UI_set_result(ui, uis, pin);
+
+	return (ret == 0) ? 1 : -1;
+}
+#endif
+
 static EVP_PKEY *read_private_key_pkcs11(const char *private_key_name)
 {
 	EVP_PKEY *private_key = NULL;
 #ifdef USE_PKCS11_PROVIDER
 	OSSL_STORE_CTX *store;
+	UI_METHOD *ui_method = NULL;
 
 	if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
 		ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
 	if (!OSSL_PROVIDER_try_load(NULL, "default", true))
 		ERR(1, "OSSL_PROVIDER_try_load(default)");
-
-	store = OSSL_STORE_open(private_key_name, NULL, NULL, NULL, NULL);
-	ERR(!store, "OSSL_STORE_open");
+	if (key_pass) {
+		ui_method = UI_create_method("PIN reader");
+		ERR(!ui_method, "UI_create_method");
+		if (UI_method_set_reader(ui_method, ui_get_pin) != 0)
+			ERR(1, "UI_method_set_reader");
+
+		store = OSSL_STORE_open_ex(private_key_name, NULL, NULL,
+									ui_method, (void *)key_pass,
+									NULL, NULL, NULL);
+		ERR(!store, "OSSL_STORE_open_ex");
+	} else {
+		store = OSSL_STORE_open(private_key_name, NULL, NULL, NULL, NULL);
+		ERR(!store, "OSSL_STORE_open");
+	}
 
 	while (!OSSL_STORE_eof(store)) {
 		OSSL_STORE_INFO *info = OSSL_STORE_load(store);
-- 
2.43.0