topic SE050 and Middleware v4.3.0 - Possible bug with Openssl engine? in Secure Authentication

SE050 and Middleware v4.3.0 - Possible bug with Openssl engine?

TonyMo — Fri, 14 Jul 2023 12:54:23 GMT

I'm using the SE050F2 With middleware v4.3.0. I'm using the an openssl engine so external libs like security-xml-c can leverage the RSA keys in the SE050.

I'm finding a failure in sss/plugin/openssl/engine/src/ax_sssEngine_rsa.c in the function EmbSe_RSA_Priv_Encrypt() where if the RSA padding selected is not set to RSA_NO_PADDING, the call fails. Is this correct or a bug? xml-security-c uses RSA padding RSA_PKCS1_PADDING which complies with the XML security standard.

Also, in the same function EmbSe_RSA_Priv_Encrypt(), I notice that sss_asymmetric_context_init() uses the kMode_SSS_Decrypt and makes a call to sss_assymmetric_decrypt(). I intuitively would expect that RSA_Priv_Encrypt() is doing "encrypt" operations, not "decrypt" operations. Is this a bug?

Thank you for your help.

Cheers,

Tony

Re: SE050 and Middleware v4.3.0 - Possible bug with Openssl engine?

Kan_Li — Fri, 21 Jul 2023 01:36:36 GMT

Hi @TonyMo ,

Indeed the function EmbSE_RSA_Priv_Encrypt is actually the method referenced to “sign” data. With RSA the signature is correctly created with the method “decrypt”. From the openSSL documentation:

I agree that the engine’s function name is misleading as it actually should be the signing function.

For the RSA padding methods support, we are checking with the R&D now, will let you know when I have any more info from there.

Thanks for your patience and understanding!

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: SE050 and Middleware v4.3.0 - Possible bug with Openssl engine?

TonyMo — Sat, 22 Jul 2023 08:00:51 GMT

Thank you Kan. There is no concern with the SE050 not being to support RSA padding. I was able to leverage Openssl's RSA padding commands to achieve what I needed.