325494 - Multipart verification broken for CKM_ECDSA_SHA1

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Andreas Sterbenz]

The issue reported and fixed in 191467 for CKM_DSA_SHA1 still exists for CKM_ECDSA_SHA1. context->multi is incorrectly set to false for CKM_DSA_SHA1, so multi part verification operations do not work. The fix is to delete the assignment, which is unnecessary as context->multi is set to false at the beginning of the function.

===
From pkcs11c.c:NSC_VerifyInit:

    case CKM_ECDSA_SHA1:
        context->multi = PR_TRUE;
        crv = sftk_doSubSHA1(context);
        if (crv != CKR_OK) break;
        /* fall through */
    case CKM_ECDSA:
        if (key_type != CKK_EC) {
            crv = CKR_KEY_TYPE_INCONSISTENT;
            break;
        }
/*      context->multi = PR_FALSE; DELETE THIS LINE */
        pubKey = sftk_GetPubKey(key,CKK_EC,&crv);
===

Comment 1

[Wan-Teh Chang]

Attachment: Patch proposed by Andreas

I gave this patch r=wtc.

Comment 2

[Robert Relyea]

Comment on attachment 210417 [details] [diff] [review]
Patch proposed by Andreas

r+=rrelyea
this function defaults to multi=PR_FALSE (the most common usage in NSS), so the patch is correct.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 210417 [details] [diff] [review]
Patch proposed by Andreas

sr=nelson.bolyard

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Checked in on 3.11 branch
Checking in pkcs11c.c;  new revision: 1.68.2.2; previous revision: 1.68.2.1

Trunk checkin delayed due to change of my CVS login name :-/
Wan-Teh, would you care to checkin on the trunk?

Comment 5

[Wan-Teh Chang]

I checked in the patch on the NSS trunk (3.12).
pkcs11c.c, revision 1.72