We've recently updated to OpenSC 0.15.0 and for some reason we can no longer use it to decrypt a message with the private key from a smartcard.
Apparently the same happens whether we use the pkcs11-tool (providaded with OpenSC) and the OpenSSL Engine.
Below is an example of what we did:
pkcs11-tool:
% pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so --decrypt -v -l --input-file encrypted.bin --id 9352
Using slot 1 with a present token (0x1)
Logging in to "OpenSC Card".
Please enter User PIN:
Using decrypt algorithm RSA-PKCS
error: PKCS11 function C_Decrypt failed: rv = CKR_DATA_LEN_RANGE (0x21)
Aborting.
Or by using the OpenSSL engine, here is a small sample program:
#include <iostream>
#include <openssl/engine.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/crypto.h>
using namespace std;
int main()
{
OpenSSL_add_all_algorithms();
ENGINE_load_dynamic();
// Setup OpenSSL engine
ENGINE* engine = ENGINE_by_id("dynamic");
string enginePath = "/usr/local/lib/engines/pkcs11.so";
string modulePath = "/usr/local/lib/opensc-pkcs11.so";
ENGINE_ctrl_cmd_string(engine, "SO_PATH", enginePath.c_str(), 0);
ENGINE_ctrl_cmd_string(engine, "LIST_ADD", "1", 0);
ENGINE_ctrl_cmd_string(engine, "LOAD", NULL, 0);
ENGINE_ctrl_cmd_string(engine, "MODULE_PATH", modulePath.c_str(), 0);
string pin = "123456";
ENGINE_ctrl_cmd_string(engine, "PIN", pin.c_str(), 0);
ENGINE_ctrl_cmd_string(engine, "VERBOSE", NULL, 0);
ENGINE_init(engine);
ENGINE_set_default(engine, ENGINE_METHOD_ALL);
string keyName = "id_9352";
EVP_PKEY *evp = ENGINE_load_private_key(engine, keyName.c_str(), NULL, NULL);
// Read encrypted file
long unsigned int length = 128;
unsigned char buf[length];
FILE* f = fopen("encrypted.bin", "r");
fread(buf, 1, length, f);
fclose(f);
// Try to decrypt
unsigned char output[length];
unsigned char* p = output;
RSA *rsa = EVP_PKEY_get1_RSA(evp);
int outputLen = RSA_private_decrypt(length, buf, p, rsa, RSA_PKCS1_PADDING);
if (outputLen == -1) {
long err = ERR_get_error();
cout << "Error decrypting: " << ERR_error_string(err, NULL) << endl;
return 1;
}
cout << output << endl;
return 0;
}
But when I run it:
% ./sc-decrypt
PKCS#11: Initializing the engine
Found 2 slots
Loading private key "slot_1-id_9352"
Looking in slot 1 for key: 9352
[18446744073709551615] Virtual hotplug slot no tok
[1] Gemalto PC Twin Reader 00 login (OpenSC Card)
Found slot: Gemalto PC Twin Reader 00 00
Found token: OpenSC Card
Found 0 certificate:
Found 1 private key:
1 P Private Key
Error decrypting: error:80008021:Vendor defined:PKCS11_rsa_decrypt:Data len range
Apparently, it's the same error in both cases, something about "Data len range"
What is even more strange, is that when using pkcs11-tool to do a signing operation (which also uses the private key) works fine:
% echo "test signing" > input.txt
% pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so --sign -v --input-file input.txt --output-file out.sign --id 9352 -l
Using slot 1 with a present token (0x1)
Logging in to "OpenSC Card".
Please enter User PIN:
Using signature algorithm RSA-PKCS
% ls -l out.sign
-rw------- 1 user user 128 May 18 10:08 out.sign
So, if anyone could point out what I'm doing wrong, I'd be very thankful
