Add AES support for PIV General Authenticate

This adds algorithm IDs 0xA, 0xA, 0xC which as documented
by the NIST PIV specification is algorithms AES-128, AES-192
and AES-256 respectively.

This patch also addresses some of the hardcodes that prevented
nonces greater than the single byte TLV length tags would allow.
It was explicitly tested with AES-256 and 256 byte nonces.

Signed-off-by: William Roberts <w2.roberts@samsung.com>


On 7/29/2014 12:56 PM, shootingatshadow wrote:
> In src/libopensc/card-piv.c:
>
>>  	}
>>
>> -	r = piv_get_3des_key(card, key);
>> -	if (r != SC_SUCCESS)
>> +	r = piv_get_key(card, &key, &keylen);
>> +	if (r) {
>> +		sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error getting key\n");
>> +		goto err;
>> +	}
>> +
>> +	r = sc_is_hex_encoded(key, keylen);
>
> On Tue, Jul 29, 2014 at 7:42 AM, Doug Engert <notifications@github.com> wrote: In src/libopensc/card-piv.c: > } > > - r = piv_get_3des_key(card, key); > - if (r != SC_SUCCESS) > + r =
> piv_get_key(card, &key, &keylen); > + if (r) { > + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error getting key\n"); > + goto err; > + } > + > + r = sc_is_hex_encoded(key, keylen); On 7/28/2014 6:20
> PM, shootingatshadow wrote: In src/libopensc/card-piv.c: > } > > - r = piv_get_3des_key(card, key); > - if (r != SC_SUCCESS) > + r = piv_get_key(card, &key, &keylen); > + if (r) { > +
> sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error getting key\n"); > + goto err; > + } > + > + r = sc_is_hex_encoded(key, keylen); Yeah I realised that as I was making the change. Good point. If it is
> binary, the length read will match the keylen. If it is hex encoded (It may have a trailing ":", LF or CR LF) The length read would be between keylen*3-1 and keylen*3+2 So by the length you can tell
> if it is binary or maybe hex encoded. So sc_is_hex_encoded is not needed, as the conversion will fail if it is not encoded correctly. Knowing that AES 256 is the largest key size supported, the max
> read size would be 256/8*3+2 = 98 bytes. these changes could be in piv_get_key if it knew what keylen to expect.
> I think uses keylen is a great suggestion. However, on windows it doesn't just end with \n it also has a carraige return \r\n, so we may need to trim 2 bytes.

Thats what I said above, (It may have a trailing ":", LF or CR LF)

> … <#>
> … <#147829274576353d_> — Reply to this email directly or view it on GitHub < https://github.com/OpenSC/OpenSC/pull/270/files#r15497661>. -- Douglas E. Engert <DEEngert@gmail.com> — Reply to this email
> directly or view it on GitHub <https://github.com/OpenSC/OpenSC/pull/270/files#r15526776>.
> -- Respectfully, William C Roberts
>
> —
> Reply to this email directly or view it on GitHub <https://github.com/OpenSC/OpenSC/pull/270/files#r15540274>.
>

-- 

  Douglas E. Engert  <DEEngert@gmail.com>