201333 - PSM and NSS do not support 3 key authentication systems.

Status: RESOLVED DUPLICATE of bug 511652

(Core Graveyard :: Security: UI, enhancement)

Description

[Peeter Russak]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.1; Linux)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312

Hi,  
  
Let me explain the situation: We have national ID-card 
(http://www.id.ee/pages.php/0303) that contains two certificates:  
authentication one and signing one. First one can be used for any kind of  
authentication, but signature given using second one has the same power as  
signature written by hand. Yes, it's official, yes we have digital signature law and  
stuff:)  
We have a PKCS#11 library so we can use ID-card through Mozilla's security  
devices as authentication tool  to access protected sites (online banking etc).  
  
Problem is that when one of the certificates is accessed and PIN-code for that cert  
is needed then Mozilla asks PIN-codes for *all* certificates. It's not that clever to  
enter both PINs (of which one could be equal to your official signature) every time  
you only want  authenticate yourself in online bank. At the moment we use modified  
PKCS#11 library that shows out only authentication certificate as a workaround so  
that Mozilla asks only one password. This workaround's problem is that this same  
pkcs#11 library can't be used for digital signing purposes because signing  
certificate needed for that action is not shown.  
  
Ideal would be if Mozilla would ask certificate's PIN *not* before certificate is  
actually used and only this certificate's PIN. I'm not that deeply into PKCS internals  
but as I've heard there's a kind of FRIENDLY mechanism that must be set to get  
behavior I need. Could it be possible to add checkbox or smth into security devices  
manager that toggles this friendly mechanism?  
  
I'm not that much into hacking Mozilla code but I would like to start discussion to get  
problems with our national ID-card and Mozilla fixed or to understand at least how  
much work is needed to be done to fix this situation. At the moment Internet Explorer  
is the only really well-working browser for authentication using ID-card and that is  
not that good to know;)  
  
Thanks in advance  
  

Reproducible: Always

Steps to Reproduce:
1. Register fully functional PKCS#11 module as security device 
2. Access any site that can be entered using ID-card (https://www.hanza.net) 
3. 
Actual Results:  
PIN-s are asked for both certificates although only first  one is needed. 

Expected Results:  
PIN is asked only for this certificate that is needed. PIN for the other certificate is 
asked only when this will be accessed.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Adding NSS folks to CC list.  This is almost certainly related to NSS.

Comment 2

[Robert Relyea]

There are multiple issues here.

1st Pins on specific *KEYS* (the user talks about certificates, but in fact it
is the private keys which are protected), separate from pins for each object are
not yet supported by PKCS #11, there are ways to 'work around this', namely
create a separate token for each key in the token (that is protected), this
appears to be what this vendor has done.

This runs into the second problem, whenever NSS searches for certs and keys, it
authenticates to All the tokens. This is what the vendor is complaining about.

Unfortunately NSS needs to authenticate to All the tokens because it doesn't
know if it can read the certificates (and determine if the given certificates
have corresponding private keys) unless it authenticates to the token. If you
follow some stricter rules for your token (certs and public keys are visible in
the token without authenticating), you can set your token as
"PUBLIC_READABLE_CERTS" (also sometimes known as "FRIENDLY"). Tokens with this
bit on are not authenticated when simply doing certificate lookups, and are only
authenticated if we need to access the private key. This bit is set at install
time (You will need an install tool to make this work) in the secmod.db file.

I suspect you will still have problems though, because 3 key systems are not
supported by PSM (that is systems with separate
authentication/signing/encryption keys). Currently PSM treats all signing keys
the same.

bob

Comment 3

[Marie Fischer]

I set the "FRIENDLY" bit with modutil and the problem seems to be solved with
that, Mozilla is not asking for all PIN-s any more. However, modutil is not a
good thing for end-users - is there any way the pkcs11 module by itself can say
that it wants to be "friendly"?

With regard to "3 key authentication systems", I think we have some
misunderstanding here, there are 2 keys on the Estonian ID card, not 3, so we
don't have problems with that.

Thanks for your help.

marie

Comment 4

[Jaanus Kase]

I believe reference to "3 key authentication systems" was made because there 
are both 2 and 3 key systems in operation in different places in the world. 
sometimes, encryption, signing and authentication all use 3 keys (hence calling 
it 3-key system). in case of EstEID, encryption and authentication use the same 
key, so we have a 2-key system.

Comment 5

[Stephane Saux]

This should work (replace modulename and moduleDLL.dll with appropriate values):
(javascript to include in a web page to let users load the module.)
// set the flags for 
//Stored certs can be read off the token w/o logging in 
PKCS11_PUB_READABLE_CERT_FLAG  =  0x1<<28;
var flags = 0;
flags |= PKCS11_PUB_READABLE_CERT_FLAG;

result = pkcs11.addmodule("modulename", "moduleDLL.dll", flags, 0); 
if (result >= 0) 
{
	document.write(strOk);
}
else
{
	document.write(strError);
}

Comment 6

[Marie Fischer]

Thanks, this seems to work (for me at least).

I still don't understand why we couldn't have just a simple checkbox "Publicly
readable certs" like there was in old Netscape. Especially since it seems to me
that most cards actually would want to set the FRIENDLY bit - is everybody
supposed to install them via javascript?

Comment 7

[John G. Myers]

Is there a way for the PKCS11 module to identify itself as being friendly?  I
believe it would be better to extend PKCS11 to allow a module to advertise
frendliness than to add a checkbox for the user to set to the wrong value.

Is there NSS support for 3 key systems?  What, roughly, would PSM have to do to
support 3 key systems?

Comment 8

[Martin Paljak]

What about this issue? Why not remove the FRIENDLY thing / enable it by default ?

This is actually as annoying as bug 328346 - manual loading of a module with several slots results in PIN havoc.

Comment 9

[Robert Relyea]

At the very least, we should have a way to clicking the friendly box.

The problem with making it default is if you're token doesn't support just the right sematics (which PKCS #11 compliant tokens are allowed to do), then your token will be completely invisible until you the user explicitly log into it.

The initial design was that tokens would supply packages with .js installers which would set the bits for the modules. Lately many vendors just use modutil and their own installers.

At one point I had an .html file that would allow you to load a pkcs11 module and set the appropriate bits.

That being said, the Publically readable certs flag (AKA 'Friendly'). should probably be setable from the device manager UI.

bob