BUG: sign DATA over 512 bytes doesn't work
Open
Nobody has claimed this yet.
vendor
- Dominant language
- Python
- Stars
- 170
- Forks
- 79
- PR merge metrics
- No merged PRs in 30d
Description
I have the following python script:
#! /usr/bin/env python3
import os
import pkcs11
from Crypto.Hash import SHA256
from Crypto.PublicKey import ECC
from Crypto.Signature import DSS
from pkcs11 import KeyType, ObjectClass, Mechanism
from pkcs11.util.ec import encode_ec_public_key
lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
token = lib.get_token(token_label='SmartCard-HSM (UserPIN)')
with token.open(rw=True, user_pin='123456') as session:
priv = session.get_key(label='testkeyEC666', key_type=KeyType.EC, object_class=ObjectClass.PRIVATE_KEY)
pubkey = session.get_key(label='testkeyEC666', key_type=KeyType.EC, object_class=ObjectClass.PUBLIC_KEY)
with open('somefile.bin', 'rb') as f:
data = bytearray(f.read())
signature = priv.sign(bytes(data), mechanism=Mechanism.ECDSA_SHA256)
h = SHA256.new(data)
verifier = DSS.new(ECC.import_key(encode_ec_public_key(pubkey)), 'fips-186-3')
try:
verifier.verify(h, signature)
print("signature ok.")
except ValueError:
print("signature not ok!")
It throws me the following error:
Traceback (most recent call last):
File "/home/Projects/Playground/python-pkcs11/./pkcs11-sign.py", line 30, in <module>
signature = priv.sign(bytes(data), mechanism=Mechanism.ECDSA_SHA256)
File "/usr/local/lib/python3.10/dist-packages/pkcs11/types.py", line 939, in sign
return self._sign(data, **kwargs)
File "pkcs11/_pkcs11.pyx", line 1072, in pkcs11._pkcs11.SignMixin._sign
File "pkcs11/_pkcs11.pyx", line 1083, in pkcs11._pkcs11.SignMixin._sign
File "pkcs11/_errors.pyx", line 88, in pkcs11._pkcs11.assertRV
pkcs11.exceptions.DataLenRange
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the Python script shown in the report, focusing on priv.sign(..., mechanism=Mechanism.ECDSA_SHA256) and the DataLenRange traceback through pkcs11/_pkcs11.pyx. Check the surrounding signing implementation and existing tests for input-length handling. Done means signing data over 512 bytes no longer raises this error and the resulting signature passes the verification step.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100