1658042 - osclientcerts: differentiate between keys that can/cannot do modern crypto

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Right now, osclientcerts has one slot that it claims can do RSA PKCS#1, ECDSA, and RSA-PSS. However, since the keys backing these operations may live on modules that cannot actually do these operations, we need to separate them into two slots: one that can only do RSA PKCS#1 and another that can do all of them.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1658042 - osclientcerts: differentiate between keys that can and cannot do modern crypto r?kjacobs!,rmf!

The keys exposed by osclientcerts may be from tokens that cannot do modern
crypto (namely, ECDSA and RSA-PSS). This patch attempts to identify and
differentiate between these keys. Unfortunately, there is no good way of doing
this on macOS at this time, so the implementation assumes everything supports
modern crypto on that platform.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a93095760b1f
osclientcerts: differentiate between keys that can and cannot do modern crypto r=kjacobs,rmf

Comment 3

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/a93095760b1f

Comment 4

[Noemi Erli[:noemi_erli]]

Backed out changeset a93095760b1f (Bug 1658042) for causing Bug 1658576 a=backout

Backout: https://hg.mozilla.org/mozilla-central/rev/7bd6cb8b76c078f5e687574decdde97f1e4affce

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7e5f806e44a8
osclientcerts: differentiate between keys that can and cannot do modern crypto r=kjacobs,rmf

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/7e5f806e44a8

Comment 7

[Ivaylo Ivanov]

After this code has landed to nightly - I have issues with sites requiring SSL certificate for SignIn on Windows 10 - FF just freezes and never passes the SSL authentication. The it's only possible to kill it via task manager.

Comment 8

[J.C. Jones [:jcj] (he/they)]

Dana's out this week, so I'm needinfoing her for this on her return.
ivivanov.bg - Can you open a new bug to track that regression, and maybe give us a bit more information about the client certificate/key you're using? Since this already landed in Beta, we'll need to track the hang separately. Please do cc me directly into it - [e-mail]. Thanks!

Comment 9

[Ivaylo Ivanov]

Opened: Bug 1662636
Please let me know if you need any more info about the certificates.