Hardware Security Modules and Smart Cards

OpenSSL_add_all_algorithms();
ERR_load_crypto_strings();
ERR_clear_error();
ENGINE_load_builtin_engines();

e = ENGINE_by_id("pkcs11");
if (!e) {
  display_openssl_errors(__LINE__);
  exit(1);
}

if (module_path) {
  fprintf(stderr, "loading: %s\n", module_path);
  if (!ENGINE_ctrl_cmd_string(e, "MODULE_PATH", module_path, 0)) {
    display_openssl_errors(__LINE__);
    exit(1);
  }
}

if (!ENGINE_init(e)) {
  display_openssl_errors(__LINE__);
  exit(1);
}

if (key_pass && !ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
  display_openssl_errors(__LINE__);
  exit(1);
}

private_key = ENGINE_load_private_key(e, private_key_name, NULL, NULL);
if (!private_key) {
  fprintf(stderr, "cannot load: %s\n", private_key_name);
  display_openssl_errors(__LINE__);
  exit(1);
}

display_openssl_errors(__LINE__);

digest_algo = EVP_get_digestbyname("sha256");

EVP_MD_CTX_init(&ctx);
if (EVP_DigestInit(&ctx, digest_algo) <= 0) {
  display_openssl_errors(__LINE__);
  exit(1);
}

EVP_SignInit(&ctx, digest_algo);

#define TEST_DATA "test data"
if (EVP_SignUpdate(&ctx, TEST_DATA, sizeof(TEST_DATA) - 1) <= 0) {
  display_openssl_errors(__LINE__);
  exit(1);
}

n = sizeof(buf);
if (EVP_SignFinal(&ctx, buf, &n, private_key) <= 0) {
  display_openssl_errors(__LINE__);
  exit(1);
}

EVP_PKEY_free(private_key);
ENGINE_finish(e);

if (module_path) {
  ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
  if (ret < 0) {
    fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
    exit(1);
  }

  ret = gnutls_pkcs11_add_provider(module_path, NULL);
  if (ret < 0) {
    fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
    exit(1);
  }
}

if (key_pass)
  gnutls_pkcs11_set_pin_function(pin_function, key_pass);

ret = gnutls_privkey_init(&private_key);
if (ret < 0) {
  fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
  exit(1);
}

ret = gnutls_privkey_import_url(private_key, private_key_name, 0);
if (ret < 0) {
  fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
  exit(1);
}

ret = gnutls_privkey_sign_data(private_key, GNUTLS_DIG_SHA256, 0,
                               &testdata, &signature);
if (ret < 0) {
  fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
  exit(1);
}

gnutls_privkey_deinit(private_key);
gnutls_free(signature.data);

int pin_function(void *userdata, int attempt, const char *token_url,
                 const char *token_label, unsigned flags, char *pin, size_t pin_max)
{
  if (flags & GNUTLS_PIN_FINAL_TRY)
    printf("This is the final try before locking!\n");
  if (flags & GNUTLS_PIN_COUNT_LOW)
    printf("Only few tries left before locking!\n");
  if (flags & GNUTLS_PIN_WRONG)
    printf("Wrong PIN has been provided in the previous attempt\n");

  /* userdata is the second value passed to gnutls_pkcs11_set_pin_function()
   * in this example we passed the PIN as a null terminated value.
   */
  snprintf(pin, pin_max, "%s", (char*)userdata);
  return 0;
}

SECStatus rv;
CERTCertificate *cert = NULL;
SECKEYPrivateKey *pvtkey = NULL;
SECItem signature = { siBuffer, NULL, 0 };
SECOidTag algTag;
int r = 1;
unsigned char buf[] = "test data to sign";
const char *cert_name;
unsigned i;

if (argc < 3) {
  fprintf(stderr, "usage: %s [cert name] [PIN]\n\n", argv[0]);
  exit(1);
}

cert_name = argv[1];
pin = argv[2];

PK11_SetPasswordFunc(passwdcb);
NSS_InitializePRErrorTable();
rv = NSS_Init(".");
if (rv != SECSuccess) {
  fprintf(stderr, "NSS initialization failed (err %d)\n", PR_GetError());
  goto cleanup;
}

cert = PK11_FindCertFromNickname(cert_name, NULL);
if (cert == NULL) {
  fprintf(stderr, "Couldn't find cert %s in NSS db (err %d: %s)\n",
	    cert_name, PR_GetError(), PORT_ErrorToString(PR_GetError()));
  goto cleanup;
}

fprintf(stderr, "Buffer being signed = \n%s\n", buf);

pvtkey = PK11_FindKeyByAnyCert(cert, NULL);
if (pvtkey == NULL) {
  fprintf(stderr, "Couldn't find private key for cert %s (err %d: %s)\n",
	    cert_name, PR_GetError(), PORT_ErrorToString(PR_GetError()));
  goto cleanup;
}

/* get the algtag. Pick the default hash algorithm */
algTag = SEC_GetSignatureAlgorithmOidTag(pvtkey->keyType, SEC_OID_UNKNOWN);

fprintf(stderr, "Signing with alg = %s (%d)\n",
	  SECOID_FindOIDTagDescription(algTag), algTag);

rv = SEC_SignData(&signature, buf, sizeof(buf)-1, pvtkey, algTag);
if (rv != SECSuccess) {
  fprintf(stderr, "sign with Private Key failed (err %d: %s)\n",
	    PR_GetError(), PORT_ErrorToString(PR_GetError()));
  goto cleanup;
}

char *passwdcb(PK11SlotInfo * slot, PRBool retry, void *arg)
{
  if (!isatty(STDIN_FILENO) && retry) {
    /* we're just reading from a file, and the value is known to be wrong,
     * don't keep bounding the token with the wrong password. */
    return NULL;
  }

  if (retry) {
    printf("Warning: Wrong PIN has been provided in the previous attempt\n");
    if (PK11_IsHW(slot)) {
      printf
	  ("  NOTE: multiple pin failures could result in locking your device\n");
    }
  }

  if (pin == NULL)
    return pin;
  else
    return strdup(pin);
}