1303986 - Make softoken handle curve 25519 correctly

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Franziskus Kiefer [:franziskus]]

softoken enables CKA_SIGN for all ec keys by default. This must not be the case for curve 25519.

Comment 1

[Franziskus Kiefer [:franziskus]]

Attachment: curve25519-followup1.patch

don't perform sign/verify tests for curve 25519 keys

Comment 2

[Martin Thomson [:mt:]]

Comment on attachment 8792891 [details] [diff] [review]
curve25519-followup1.patch

Review of attachment 8792891 [details] [diff] [review]:
-----------------------------------------------------------------

Where are the tests?

Comment 3

[Franziskus Kiefer [:franziskus]]

Attachment: curve25519-followup1.patch

ok, here with a test.

Note that it's necessary to use the database here in order to reproduce the setting as generating a key pair without a db works just fine (there we can set CKA_SIGN properly).

Comment 4

[Martin Thomson [:mt:]]

Comment on attachment 8793304 [details] [diff] [review]
curve25519-followup1.patch

Review of attachment 8793304 [details] [diff] [review]:
-----------------------------------------------------------------

::: tests/ec/ectest.sh
@@ +20,5 @@
>  ############################## ectest_init #############################
>  # local shell function to initialize this script
>  ########################################################################
>  
> +# set -v -e -x

remove

@@ +62,5 @@
> +  done
> +  echo "Test sect571r1 key generation using certutil that should fail ..."
> +  certutil -G -d "${HOSTDIR}" -k ec -q sect571r1 -f "${R_PWFILE}" -z ${NOISE_FILE}
> +  if [ $? -eq 0 ]; then
> +    return 1

I confess that I don't know why this curve has to fail.

@@ +72,5 @@
> +if [ $? -ne 0 ] ; then
> +  html_failed "ec(test certutil keygen) test"
> +else
> +  html_passed "ec(test certutil keygen) test"
> +fi

I'd prefer if you moved the reporting to the function so that you can report with better granularity.

Comment 5

[Franziskus Kiefer [:franziskus]]

https://hg.mozilla.org/projects/nss/rev/f308ad30db42