Yubikey defines and enforces 4 (NEO) or 24 (YubiKey YK4, YubiKey YK5)
slots with special, fixed names.
Add a dropdown box if "fixed_ids" are present and let the user select
the slot during key generation.
In commit 9767a3dca7
OpenSSL changed sign behavior, that now it calls sign mechanism two
times - first with NULL output buffer, to get size of it, for next call.
This causes two sign operations in token for ED25519, so, let's detect
NULL buffer and return size of signature.
I haven't tested other type of keys - it's possible that they have
the same issue.
What works:
- Importing ED25519 Signature key from Yubikey token (OpenSC with openpgp driver, key generated via gpg)
- Creating self-signed certificate for CA, for Signature key from card
- Signing Certificates using new CA
I haven't tested other features, e.g. storing new certificate on card, so, they're probably broken
Change pkcs11List from QListWidget to QListView
The pkcs11_lib_list holds the data of the loaded libraries.
For the model a QList "model_data" is used to
hold indexes into QList dirs to allow duplicates,
moves and removes.
On windows it now displays the paths with \ separators.
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
With this commit PKCS#11 libraries may be reordered
and enabled or disabled.
The slot selection dialog iterates over all enabled and successfully
loaded libraries in the configured order and collects the slots
of each of them.
In the options dialog the library info is shown in the tool-tip
No need to translate "X Certificate and Key management",
"Form", "Dialog" or "TimeInput"
"Select Token" and "New Key" window titles were never shown.
Remove them.
When using PKCS11 library to manage smart cards the code assumes
that all slots returned by the library call are not empty.
In some cases Gemalto's library returns list of slots in which the
first one is empty and the second one is occupied by the smart card,
this causes xca to report an error and isn't able to use the smart card.
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.
Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.
When using Smartcards, use the Smartcard RNG
as additional entropy source.
