Wrong certificate returned if multiple certs have same label but different ID

[Graham Leggett]

Right now, when an attempt is made to store two certificates on a smartcard, where the ID of the certs are the same but the labels are not, or the labels are the same but IDs not, the wrong certificate is selected not matching the key. This typically happens when a certificate is renewed, and the smartcard (possibly a software smartcard) contains both the old cert and the new cert. In this case the IDs may be the same.

Fixed upstream here:

https://github.com/OpenSC/libp11/pull/433

When ID and label are specified, both need to match, not either.

To fix this id-match OR label-match was replaced with id-match AND
label-match.

A tiebreak was added when multiple matching certificates could be
returned. The certificate with the latest expiry wins, and if we
still have a tie we deterministically choose a certificate using
X509_cmp().

If we do not specify a certificate, we return the first certificate
(or first certificate with an ID) as before.

Debug logging updated to show the expiry date used in the decision.

[Athos Ribeiro (athos-ribeiro)]

Thanks for taking the time to report this bug here, Graham.

As you already pointed out, the proper fix should go into the upstream project first.

https://github.com/OpenSC/libp11/pull/433 seems to be reviewed and approved. Once it is merged, we should be able to backport the patch as needed.

[Bryce Harrington (bryce)]

PR 433 appears to have landed in March, but there has not been a new release yet. Tagging this server-todo for someone to examine for applicability to backport for SRU, and to consider backporting for kinetic if a new release isn't likely to be forthcoming this cycle.

[Christian Ehrhardt  (paelzer)]

Due to the size and complexity I'm not sure about a Jammy SRU.
But clearly it would be grat to ensure picking it up for Kinetic if upstream releases something in time. Thanks Bryce for flagging this.

[Bryce Harrington (bryce)]

Upstream released 0.4.12 a few days ago. It's not packaged by Debian yet but I confirmed it includes this fix.

[Andreas Hasenack (ahasenack)]

I'll take a look at this.

[Andreas Hasenack (ahasenack)]

Hello,

I'm trying to reproduce this in jammy, but so far things are working. I tried with p11tool, pkcs11-tool, and openssl configured with a pkcs11 engine.

I don't doubt the issue exists, I'm definitely just missing something in this very complicated stack.

My testing has been around loading certificates and keys into a smart card byt forcing specific labels and IDs. In particular, my last test was forcing an empty label, and different ids, and then specifying the object I want via a pkcs11 url of the form "pkcs11:id=%XX".

The bug report at https://github.com/OpenSC/libp11/issues/435 specifically mentioned the case of different IDs, but same (empty) label, so that's what I tried. That bug report doesn't show the exact commands that were being tried, nor how to produce that debug output.

What I have loaded:
$ p11tool --login --list-all
Token 'label1' with URL 'pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1' requires user PIN
Enter PIN:
Object 0:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;id=%99;type=cert
 Type: X.509 Certificate (RSA-2048)
 Expires: Sat Sep 3 16:30:50 2022
 Label:
 Flags: CKA_PRIVATE;
 ID: 99

Object 1:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;id=%11;type=cert
 Type: X.509 Certificate (RSA-2048)
 Expires: Sat Sep 3 16:33:27 2022
 Label:
 Flags: CKA_PRIVATE;
 ID: 11

Object 2:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;id=%11;type=public
 Type: Public key (RSA-2048)
 Label:
 Flags: CKA_WRAP/UNWRAP;
 ID: 11

Object 3:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;id=%99;type=public
 Type: Public key (RSA-2048)
 Label:
 Flags: CKA_WRAP/UNWRAP;
 ID: 99

Object 4:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;id=%99;type=private
 Type: Private key (RSA-2048)
 Label:
 Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_SENSITIVE;
 ID: 99

Object 5:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;id=%11;type=private
 Type: Private key (RSA-2048)
 Label:
 Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_SENSITIVE;
 ID: 11

Object 6:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;object=User%20Pin
 Type: Unknown
 Label: User Pin
 Flags: CKA_SENSITIVE;
 ID:

Object 7:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1;object=SO%20Pin
 Type: Unknown
 Label: SO Pin
 Flags: CKA_SENSITIVE;
 ID:

Object 8:
 URL: pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1
 Type: Unknown
 Label:
 ID:

Filtering by id seems to work fine:
$ p11tool --login --list-all "pkcs11:id=%11"
Token 'label1' with URL 'pkcs11:model=19C43A06010D0000;manufacturer=A.E.T.%20Europe%20B.V.;serial=0191001F00670608;token=label1' requires user PIN
Enter PIN:
Ob...

[Andreas Hasenack (ahasenack)]

I guess I could try next the complementary combination: different label, same id. But how do I specify a label in the pkcs11 url? Just "label=<foo>" didn't seem to work.

[Andreas Hasenack (ahasenack)]

Hm, the 0.4.12 release tarball is missing the detached signature:

https://github.com/OpenSC/libp11/issues/454

$ uscan
uscan: Newest version of libp11 on remote site is 0.4.12, local version is 0.4.11
uscan: => Newer package available from:
        => https://github.com/OpenSC/libp11/releases/download/libp11-0.4.12/libp11-0.4.12.tar.gz
uscan warn: In directory ., downloading
  https://github.com/OpenSC/libp11/releases/download/libp11-0.4.12/libp11-0.4.12.tar.gz.asc failed: 404 Not Found
uscan die: FAIL Checking OpenPGP signature (no signature file downloaded).

[Andreas Hasenack (ahasenack)]

I was also bitten by this: https://github.com/OpenSC/libp11/issues/455

So probably 0.4.12 will need that patch (I was on 0.4.11, but on openssl 3).

[Graham Leggett (minfrin)]

When I hit the bug, I didn’t change my config until I’d found the problem and fixed it. Didn’t want symptoms to vanish on me.

I was developing redwax-tool at the time, which was returning discovered pkcs11 URLs with empty labels (quirk of p11kit, but still valid). The correct PKCS11 URL was passed to httpd, which then picked up the other cert (with different key and different id, but same empty label because bug), resulting in error “key does not match certificate”.

Reproducing could be hard as your system may accidentally choose the correct cert, masking the problem.

Possible approach could be to add many keys, each key having one cert. all certs should have different id corresponding to each unique key, but give them no label (no label and blank label are the same in PKCS11, as the label is a space padded constant width string).

Then try refer to each cert in turn, specifying id and same label. In theory as soon as wrong cert is matched with the given key, you’ll get the system telling you cert and key don’t belong together.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libp11 - 0.4.12-0ubuntu1

---------------
libp11 (0.4.12-0ubuntu1) kinetic; urgency=medium

  * New upstream release: 0.4.12 (LP: #1982011)
    - Fixes wrong certificate returned if multiple certs have same label but
      different ID (LP: #1964141)
  * d/t/{control,engine-smoke}: add simple pcks11 openssl engine smoke
    test
  * d/t/{control,engine}: a more thorough pkcs11 engine test, using a
    software-based smart card implementation (softhsm2)

 -- Andreas Hasenack <email address hidden> Thu, 18 Aug 2022 19:44:51 +0000