1965328 - Implement PKCS #11 v3.2 trust objects.

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P3)

Description

[Robert Relyea]

PKCS #11 defined official versions of trust objects, which NSS has used almost forever the PKCS #11 version is based on the NSS version, with most types having semantically identical usages.

Comment 1

[Robert Relyea]

Attachment: Bug 1965328 Implement PKCS #11 v3.2 trust objects in softoken.

lib/softoken/legacydb/lgattr.c
lib/softoken/legacydb/lgcreate.c
lib/softoken/legacydb/lgdb.h
lib/softoken/legacydb/lgdbdestroy.c
lib/softoken/legacydb/lgfind.c

• Update legacydb to handle PKCS #11 trust objects:
• writing CKO_TRUST will update the database trust normally.
• change the code to allow searching for CKO_TRUST and CKO_NSS_TRUST and
  return the same object as both types.
• Understand both versions of CKA_TRUST_* attributes (CKA_NSS_TRUST and
  CKA_PKCS_TRUST). Return the approriate CKT_ values for the given trust
  object.
• On create or set, accept both CKA_NSS_TRUST* and CKA_PKCS_TRUST* and
  their respective CKT_ values.
• return SHA1 hashs for both CKA_NSS_CERT_SHA1_HASH and
  CKA_HASH_OF_CERTIFICATE.
  (ignore hash on write, hash is always generated from a certificate)
  lib/softoken/sdb.c
  - Add PKCS #11 v3.2 attributes to the known attribute list. export the
  list so we can use it in sftkdb.c rather than recplicating it there.
  lib/softoken/sftkdb.c
  - use the proper explicit names for CKA_TRUST_* (so CKA_PKCS_TRUST_*
  and CK_NSS_TRUST_* for those labels that collide.
  - map everything to CKO_TRUST (PKCS#11 trust) internally for merges.
  lib/softoken/sftkdbti.h
  - include external defines for the known attributes.
  lib/softoken/sftkpwd.c
  - update the CKA_TRUST names and add the PKCS attributes.

Comment 2

[Robert Relyea]

Attachment: Bug 1965328 Implement PKCS #11 v3.2 trust objects - nss proper

cmd/dbtool/dbtool.c
cmd/lib/pk11table.c

• add knowledge of the pkcs trust attributes for the dbtool.

lib/dev/ckhelper.c
lib/dev/ckhelper.h

• add pkcs CKT_TRUST values to the trust to STAN conversion tables.
• handle transparently fetching the appropriate attributes from the trust
  objects:
  • Use CKA_PKCS_TRUST for CKO_TRUST objects and CKA_NSS_TRUST for
    CKO_NSS_TRUST objects.
  • Fetch that hash from CKA_HASH_OF_CERTIFICATE for CKO_TRUST and
    CKA_NSS_CERT_SHA1_HASH for CKO_NSS_TRUST.
  • The actual hash mechanism is now variable, so we need to pass the
    hash mechanism with the hash.

lib/dev/devt.h

• space to store the actual object type so we can later reference it when
  fetching attributes.

lib/dev/devtoken.c

• nssToken_UsePKCS11Trust()
  • use the token's function table version to decide which type of trust
    object to store in the token.
• nssToken_ImportTrust()
  • use the token type to choose the flavor of CK_TRUCT values stored in the
    attributes.
  • make the two hashBufs generic. for CKO_TRUST (PKCSTrust), we'll use SHA256,
    for the CKO_NSS_TRUST (NSSTrust) we use SHA1 and MD5. We use the new
    NSSAlgorithm_DigestBuff which takes a PKCS #11 mechanism to decide which
    hash function to use.
• nssToken_FindTrustForCertificate()
  • search for CKO_TRUST first, then search for CKO_NSS_TRUST. Record the actual
    trust object in the trust structure for ckhelper.c to find.
• nssToken_Digest()
  • update the rvOpt->size with the actual hash result size.
    lib/dev/devutil.c
• nssCryptokiObject_create
  • initialize trustType to CKM_INVALID_MECHANISM so we don't get confused
    about the type of the object if we happend to be called with an object
    that didn't go through nssToken_FindTrustForCertificate().
• create_trust()
  • use the trusttype to decide what attributes are appropriate for the
    object we are going to create.
• NSSAlgorithmAndParameters_CreateDigest()
  • remove the very hash specific versions of CreateDigest() with a generic
    version that takes a hash value.
• NSSAlgorithm_DigestBuf()
  • this function hashes an NSSItem (input) and places the result in another
    NSS item, output. Output should already allocate space for the hash in
    output->data. The amount of space is in output->size.

lib/dev/nssdev.h

• Add NSSAlgorithmAndParameters_CreateDigest() and NSSAlgorithm_DigestBuf()

lib/pk11wrap/debug_module.c

• Update debug data with the new Trust Attributes, Objects and CKT_TRUST values

lib/pk11wrap/pk11merge.c

• Merge two trust objects into a target database. The two objects could be of
  different types (CKO_TRUST or CKO_NSS_TRUST). If the resulting trust is to
  update the target value, the target's trust object type is used on write,
  otherwise the source's type is used. Potential TODO: if the copy fails
  from the sources type we probably should retry with the opposite trust type.

lib/pk11wrap/pk11nobj.c

• replace the hand lookup of the trust object with the existing stan code,
  which uses the correct full token search for the trust object.

lib/pki/certificate.c

• nssTrustIsValidHash()
  • we now have to deal with potential different hashes. The old code hashed
    the certificate once with SHA-1. In order to keep that performance if the
    hashes are all the same, we keep a cache of the last hash value and what
    mechanism was used to hash it. If the new hash to compare is a different
    mechanism, we hash the cert (potentially again) with that new algorithm and
    cache the result.
  • we return true if the hashes match.
• nssTrust_Create()
  • use generic names for the hashbuf (since they may or may not be sha-1
    hashes).
  • hashMech == to CKM_INVALID_MECHANISM is the equivalent of no hash present

lib/pki/pki3hack.c
lib/pki/pki3hack.h

• get_nss3trust_from_nss4trust()
  • CERTDB_NSS_TRUSTED_CA was set whenever the cert was trusted in
    pk11_HandleTrustObject(), preserve this semenatic even when it's calling
    into stan code.
• nssTrust_HandleTrustForCERTCert()
  • new function of pk11_HandleTrustObject() to call

Comment 3

[Robert Relyea]

Now that we have PKCS #11 v3.2 functions included. I'm closing this one since both halves are now integrated and working.