507538 - allow selection of token to provide the signature verification

Status: RESOLVED FIXED

(JSS Graveyard :: Library, enhancement)

Description

[Matthew Harmsen]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.19) Gecko/20081216 Fedora/2.0.0.19-1.fc8 Firefox/2.0.0.19
Build Identifier: 

Kai sent this.

Thomas,

I assume we talk about public Mozilla Firefox, which is not able/allowed to use
ECC signing.

You must implement the new dhMac POP it in the server, or it will not work.
No, POP is not optional.

With the current version of Cert System, the client will attempt to use signing
for POP - but that will fail. This causes the cert request message to fail.

Only if the server uses the new, extended syntax of crypto.generateCRMFRequest,
the client is able to produce a dhMac POP.

When requesting a ECC cert, on the HTML page the server produces, which contains
the crypto.generateCRMFRequest call, you must provide a "key generation
parameter". It must look like
popcert=<base64-encoded-ECC-cert-selected-by-server>. The server must own the
private key for that "popcert". It will be used by the client for a ECDH key
agreement operation.

Please note a consequence of using popcert. The curve used in the key pair of
popcert will also define the curve used by the client when it generates the key
pair. (So you might need multiple popcerts for each curve you want to support in
the client. But Cert System can keep its popcerts for the complete deployment
cycle of the installation.).

Kai

Reproducible: Always




Both Red Hat Certificate System 8.0 and Dogtag Certificate System 1.2.0 use a
JSS 4.2.6 which utilizes this patch.  Therefore, it needs to be applied to both
the JSS 4.2.6 BRANCH as well as the JSS TIP.

Comment 1

[Matthew Harmsen]

Attachment: Patch 4: ECC Pop Support

NOTE:  This is 4 of 4 patches that need to be applied to the JSS 4.2.6 BRANCH
       as well as the JSS TIP.

Comment 2

[glen beasley]

Comment on attachment 391772 [details] [diff] [review]
Patch 4: ECC Pop Support

I would r+ this patch but then I reread the description and I don't see how this patch is for ECC POP and the provided description?

Comment 3

[u289492]

The new interface I added in JSS was only to allow selection of token to provide the signature verification with ECC keys.  The existing interface only assumes the use of the internal token, which does not provide ECC functionality.

I would not call this patch with "pop" in it, although the new interface is used by RHCS to verify signature for proof of possession purposes.

Comment 4

[glen beasley]

Thanks Christina.

Checked in to the trunk:

cvs commit: Examining .
Checking in CertReqMsg.java;
/cvsroot/mozilla/security/jss/org/mozilla/jss/pkix/crmf/CertReqMsg.java,v  <--  CertReqMsg.java
new revision: 1.6; previous revision: 1.5
done

in Comment 1 matthew states in Comment #1 this also need to be checked into the 4.2.6 Branch, I will do that if necessary, but I believe you should move to the trunk and use JSS 4.3.x. JSS 4.3 is backwards compatible with JSS 4.2 you should have no compatibility issues.

https://developer.mozilla.org/En/JSS/4_3_ReleaseNotes