When using PKCS11 library to manage smart cards the code assumes
that all slots returned by the library call are not empty.
In some cases Gemalto's library returns list of slots in which the
first one is empty and the second one is occupied by the smart card,
this causes xca to report an error and isn't able to use the smart card.
The API changed heavily. New functions arrived, old functions
disappeared and many structures became opaque.
This version of the patch implements pkcs11 signing as follows:
- openssl < 1.0.0: rsa & dsa without engine
- openssl 1.0.x: rsa, dsa & ec with engine
- openssl >= 1.1.0: rsa, dsa & ec without engine
In the operation, we therefore also gain implementation of dsa signing for openssl < 1.0.0 (ec disabled because EC_KEY_METHOD was not yet invented!).
I've given up trying to use a PKEY_ENGINE with openssl 1.1: seems not possible anymore.
I've succeeded compiling the patched xca with openssl 0.9.8n, 1.0.2j and 1.1.0e.
I've successfully tested pkcs11 signing using softhsm with openssl 1.0.2j and 1.1.0e.
The patch also removes gcc7 new warnings.
On startup use "/dev/random" and "/dev/hwrng"
as additional entropy for the OpenSSL random pool.
Collect mouse position and key press time entropy
for seeding the openssl random pool before generating keys.
When using Smartcards, use the Smartcard RNG
as additional entropy source.
Since OpenSC is not part of XCA anymore, set the default
PKCS#11 lib on windows to C:\WINDOWS\system32\opensc-pkcs11.dll
Also disable Token menu after closing a database.
change storage type of passwords from char[] to QByteArray
Create PwDialog class and drop passWrite and passRead
Create Passwd class derived from QBytearray
move PKCS12 password input to PwDialog
the sole use of the engine was signing.
But on the other hand it had to be compiled for all platforms
and it prevented the use of multiple PKCS#11 libs.
- use token.label to identify the slot
- show min and max PIN lengths when changing USER and SO PIN
- sanitize token strings like label
- pad token strings correctly with ' ' 0x20
- reenable "Init Security token"
- add tokenInfo.model to the card information, revamp tokenInfo
- add driverInfo()
- use token_info.label (card_label) as token descriptor for reading passwords
- use only CKA_LABEL as internal name
- replace occurances of "Smart Card" by "Token"
- Support for creating keys on a token
- Store existing keys on a token
- delete keys and certs from a token
- update docs
