From 806312800de5ee893720df490a971e494dc984e0 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <chohnstaedt@innominate.com>
Date: Wed, 2 Dec 2015 08:48:30 +0100
Subject: [PATCH] Thales nCipher key generation changes for EC and DSA keys

Developed and tested by
 Mak, Mcken <Mcken.Mak@thalesesec.com>

Thanks!
---
 lib/pkcs11.cpp | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/lib/pkcs11.cpp b/lib/pkcs11.cpp
index 8d55f537..6a5384eb 100644
--- a/lib/pkcs11.cpp
+++ b/lib/pkcs11.cpp
@@ -498,6 +498,8 @@ pk11_attr_data pkcs11::generateKey(QString name, unsigned long mech,
 		pk11_attr_bool(CKA_SIGN, true) <<
 		pk11_attr_bool(CKA_UNWRAP, true);
 
+	QString mID = tokenInfo().manufacturerID();
+
 	switch (mech) {
 	case CKM_RSA_PKCS_KEY_PAIR_GEN:
 		pub_atts <<
@@ -505,12 +507,20 @@ pk11_attr_data pkcs11::generateKey(QString name, unsigned long mech,
 		pk11_attr_data(CKA_PUBLIC_EXPONENT, 0x10001);
 		break;
 	case CKM_DSA_KEY_PAIR_GEN: {
-		//DSA: Spec Seite 191 (175) C_GenerateKey
+		//DSA: Spec Page 191 (175) C_GenerateKey
 		CK_MECHANISM mechanism = {CKM_DSA_PARAMETER_GEN, NULL_PTR, 0};
+
+		// nCipher Attributes
+		// as on 10/26/2015 - Thales' PKCS11 provider has
+		// issue to generate Domain Parameters
+		bool token = true;
+		if (mID == "nCipher Corp. Ltd")
+			token = false;
+
 		dsa_param << label <<
 			pk11_attr_ulong(CKA_CLASS, CKO_DOMAIN_PARAMETERS) <<
 			pk11_attr_ulong(CKA_KEY_TYPE, CKK_DSA) <<
-			pk11_attr_bool(CKA_TOKEN, true) <<
+			pk11_attr_bool(CKA_TOKEN, token) <<
 			pk11_attr_bool(CKA_PRIVATE, false) <<
 			pk11_attr_ulong(CKA_PRIME_BITS, bits);
 		p11slot.isValid();
@@ -539,11 +549,12 @@ pk11_attr_data pkcs11::generateKey(QString name, unsigned long mech,
 			OPENSSL_EC_NAMED_CURVE : 0);
 
 		// Workaround for "www.CardContact.de" bug
-		if (tokenInfo().manufacturerID() == "www.CardContact.de") {
+		if (mID == "www.CardContact.de") {
 			EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
 		}
-		priv_atts << pk11_attr_bool(CKA_DERIVE, true);
-		pub_atts  << pk11_attr_data(CKA_EC_PARAMS,
+
+		priv_atts << pk11_attr_bool(CKA_DERIVE, false);
+		pub_atts << pk11_attr_data(CKA_EC_PARAMS,
 			i2d_bytearray(I2D_VOID(i2d_ECPKParameters), group));
 		EC_GROUP_free(group);
 		break;