pkcs11: Move to sha256 for the default hash to use

In case the user doesn't set the environment variable OCICRYPT_OAEP_HASHALG sha256 will be used now. This breaks default usage with SoftHSM because the only hash it currently (v2.6.1) supports is sha1. So a user of SoftHSM now has to set the environment variable to 'sha1' and we have to adjust the test case because of this. SoftHSM link to OAEP only supporting sha1: https://github.com/opendnssec/SoftHSMv2/blob/7f99bedae002f0dd04ceeb8d86d59fc4a68a69a0/src/lib/SoftHSM.cpp#L3123-L3127 Signed-off-by: Stefan Berger <[email protected]>
containers · Apr 28, 2022 · 566b808 · 566b808
1 parent 0818e64
commit 566b808
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 7 deletions.
diff --git a/crypto/pkcs11/pkcs11helpers.go b/crypto/pkcs11/pkcs11helpers.go
@@ -67,12 +67,12 @@ func rsaPublicEncryptOAEP(pubKey *rsa.PublicKey, plaintext []byte) ([]byte, stri
 	)
 
 	oaephash := os.Getenv("OCICRYPT_OAEP_HASHALG")
-	// The default is 'sha1'
+	// The default is sha256 (previously was sha1)
 	switch strings.ToLower(oaephash) {
-	case "sha1", "":
+	case "sha1":
 		hashfunc = sha1.New()
 		hashalg = "sha1"
-	case "sha256":
+	case "sha256", "":
 		hashfunc = sha256.New()
 		hashalg = "sha256"
 	default:
@@ -281,12 +281,12 @@ func publicEncryptOAEP(pubKey *Pkcs11KeyFileObject, plaintext []byte) ([]byte, s
 
 	var oaep *pkcs11.OAEPParams
 	oaephash := os.Getenv("OCICRYPT_OAEP_HASHALG")
-	// The default is 'sha1'
+	// The default is sha256 (previously was sha1)
 	switch strings.ToLower(oaephash) {
-	case "sha1", "":
+	case "sha1":
 		oaep = OAEPSha1Params
 		hashalg = "sha1"
-	case "sha256":
+	case "sha256", "":
 		oaep = OAEPSha256Params
 		hashalg = "sha256"
 	default:

diff --git a/crypto/pkcs11/pkcs11helpers_test.go b/crypto/pkcs11/pkcs11helpers_test.go
@@ -16,7 +16,6 @@
    limitations under the License.
 */
 
-
 package pkcs11
 
 import (
@@ -133,6 +132,10 @@ module:
 	p11pubkeyfileobj.Uri.SetModuleDirectories(p11conf.ModuleDirectories)
 	p11pubkeyfileobj.Uri.SetAllowedModulePaths(p11conf.ModuleDirectories)
 
+	// SoftHSM 2.6.1 only supports OAEP with sha1
+	// https://github.com/opendnssec/SoftHSMv2/blob/7f99bedae002f0dd04ceeb8d86d59fc4a68a69a0/src/lib/SoftHSM.cpp#L3123-L3127
+	os.Setenv("OCICRYPT_OAEP_HASHALG", "sha1")
+
 	pubKeys := make([]interface{}, 1)
 	pubKeys[0] = p11pubkeyfileobj
 	p11json, err := EncryptMultiple(pubKeys, []byte(testinput))
@@ -185,6 +188,8 @@ func TestPkcs11EncryptDecryptPubkey(t *testing.T) {
 
 	testinput := "Hello World!"
 
+	// SoftHSM 2.6.1 only supports OAEP with sha1
+	// https://github.com/opendnssec/SoftHSMv2/blob/7f99bedae002f0dd04ceeb8d86d59fc4a68a69a0/src/lib/SoftHSM.cpp#L3123-L3127
 	os.Setenv("OCICRYPT_OAEP_HASHALG", "sha1")
 
 	pubKeys := make([]interface{}, 1)