PKCS11: storing a secret fails with CKR_KEY_TYPE_INCONSISTENT

Bug #1704141 reported by Jan Stodt
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Barbican
Won't Fix
Undecided
Unassigned

Bug Description

Barbican currently uses the key type AES for HMAC signing, while
 the pkcs11 standard v2.40 specifies GENERIC SECRET [1].
 This causes key signing to fail.

 TODO:
 - Should both types still
 - add functionality to barbican_manage.py

 [1] http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/os/pkcs11-curr-v2.40-os.pdf
 p.69

How to reporduce:
- generate HMAC using pkcs11_key_generation.py
- store a secret
- KEK loading fails with CKR_KEY_TYPE_INCONSISTENT

Tested with:
openCrypoki v.3.4.1 with ICA token, Barbican master

Jan Stodt (stodtj)
description: updated
Revision history for this message
Andreas Scheuring (andreas-scheuring) wrote :
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on barbican (master)

Change abandoned by Douglas Mendizábal (<email address hidden>) on branch: master
Review: https://review.openstack.org/483400
Reason: Abandoning patch due to lack of activity for months. Feel free to re-submit if needed.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Change abandoned by Douglas Mendizábal (<email address hidden>) on branch: master
Review: https://review.openstack.org/483401
Reason: Abandoning patch due to lack of activity for months. Feel free to re-submit if needed.

Revision history for this message
Grzegorz Grasza (xek) wrote :

Closing out bugs created before migration to StoryBoard. Please re-open if you are of the opinion it is still current.

Changed in barbican:
status: New → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.