Add AES support for PIV General Authenticate

This adds algorithm IDs 0xA, 0xA, 0xC which as documented
by the NIST PIV specification is algorithms AES-128, AES-192
and AES-256 respectively.

This patch also addresses some of the hardcodes that prevented
nonces greater than the single byte TLV length tags would allow.
It was explicitly tested with AES-256 and 256 byte nonces.

Signed-off-by: William Roberts <w2.roberts@samsung.com>
On Tue, Jul 29, 2014 at 7:42 AM, Doug Engert <notifications@github.com>
wrote:

> In src/libopensc/card-piv.c:
>
> >  	}
> >
> > -	r = piv_get_3des_key(card, key);
> > -	if (r != SC_SUCCESS)
> > +	r = piv_get_key(card, &key, &keylen);
> > +	if (r) {
> > +		sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error getting key\n");
> > +		goto err;
> > +	}
> > +
> > +	r = sc_is_hex_encoded(key, keylen);
>
> On 7/28/2014 6:20 PM, shootingatshadow wrote: In src/libopensc/card-piv.c:
> > } > > - r = piv_get_3des_key(card, key); > - if (r != SC_SUCCESS) > + r =
> piv_get_key(card, &key, &keylen); > + if (r) { > + sc_debug(card->ctx,
> SC_LOG_DEBUG_VERBOSE, "Error getting key\n"); > + goto err; > + } > + > + r
> = sc_is_hex_encoded(key, keylen); Yeah I realised that as I was making the
> change. Good point.
> If it is binary, the length read will match the keylen. If it is hex
> encoded (It may have a trailing ":", LF or CR LF) The length read would be
> between keylen*3-1 and keylen*3+2 So by the length you can tell if it is
> binary or maybe hex encoded. So sc_is_hex_encoded is not needed, as the
> conversion will fail if it is not encoded correctly. Knowing that AES 256
> is the largest key size supported, the max read size would be 256/8*3+2 =
> 98 bytes. these changes could be in piv_get_key if it knew what keylen to
> expect.
>

I think uses keylen is a great suggestion. However, on windows it doesn't
just end with \n it also has a carraige return \r\n, so we may need to trim
2 bytes.


> … <#147829274576353d_>
>  — Reply to this email directly or view it on GitHub <
> https://github.com/OpenSC/OpenSC/pull/270/files#r15497661>.
>  -- Douglas E. Engert <DEEngert@gmail.com>
>
> —
>
> Reply to this email directly or view it on GitHub
> <https://github.com/OpenSC/OpenSC/pull/270/files#r15526776>.
>
>


-- 
Respectfully,

William C Roberts