[24.10 FEAT] [SEC2356] openCryptoki ep11 token: support protected keys for extractable keys

[bugproxy]

With version 4.1 of the ep11 support program key may based on a new control point have both the CKA_EXTRACTABLE and the CKA_PROT_KEY_EXTRACTABLE attributes set to CK_TRUE. The ep11 token shall support keys that have both attributes set to true if version 4.1 of the ep11 library is linked.
With this support also the value ENABLED for the PKEY_MODE attribute in the EP11 config file. If the linked ep11 library has a version smaller than 4.1 then the semantics of the ENABLED attribute value should be set to the semantics of the ENABLE4NONEXTR.

[Frank Heimes (fheimes)]

Thanks for raising this.
Is the opencryptoki version already known where this should land in?

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2024-01-23 07:17 EDT-------
This feature will not make it in time.

[Frank Heimes (fheimes)]

Ok, I'll update the ticket accordingly.

[Launchpad Janitor (janitor)]

[Expired for opencryptoki (Ubuntu) because there has been no activity for 60 days.]

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2024-07-10 07:56 EDT-------
The backports of the required 9 commits for this feature are now available at https://github.com/ifranzki/opencryptoki/commits/SEC2356-backport/

[Frank Heimes (fheimes)]

Test builds were successful here:
launchpad.net/~fheimes/+archive/ubuntu/lp2050018

[Launchpad Janitor (janitor)]

This bug was fixed in the package opencryptoki - 3.23.0+dfsg-0ubuntu4

---------------
opencryptoki (3.23.0+dfsg-0ubuntu4) oracular; urgency=medium

  * Add support for protected keys and extractable keys with EP11 token, with:
    - d/p/lp-2050018-EP11-pkey-option-add-new-PKEY_MODE-parms-to-ep11-con.patch
    - d/p/lp-2050018-EP11-pkey-option-handle-new-PKEY_MODE-parms-for-new-.patch
    - d/p/lp-2050018-EP11-pkey-option-handle-new-PKEY_MODE-parms-in-eligi.patch
    - d/p/lp-2050018-EP11-pkey-option-add-NO_PKEY-compile-option-for-EP11.patch
    - d/p/lp-2050018-EP11-pkey-option-consolidate-code-parts-no-logic-cha.patch
    - d/p/lp-2050018-EP11-add-check-if-protected-key-support-available-at.patch
    - d/p/lp-2050018-EP11-consider-combined-extract-for-XTS-pkey-check.patch
    - d/p/lp-2050018-EP11-Reject-combined-extract-attribute-settings-if-i.patch
    - d/p/lp-2050018-EP11-Fix-compile-error-with-NO_PKEY-defined.patch
    (LP: #2050018)

 -- Frank Heimes <email address hidden> Fri, 26 Jul 2024 13:04:25 +0200