From c2a5a98045cbbfda2ab2cee2b19baa42717f112e Mon Sep 17 00:00:00 2001
From: Jack Magne <jmagne@localhost.localdomain>
Date: Thu, 14 Jan 2016 10:41:58 -0800
Subject: [PATCH] Enhance tkstool for capabilities and security

This simple ticket is to fix tkstool to allow it
to create the master key with the proper flags to make
the key data private such that it can't be easily viewed when
using tools to print out sym keys on the token.

Fix tested on the "internal" token by trying the various tkstool
cmds to make sure having the key private does not cause issues.
Also tried a simple key changeover operation with tpsclient to make
sure that symkey can still do what it needs to do witht the master key.

Further testing with a full hsm will be required.
The goal was the create the key with the same flags that are used with the
previous "PK11_GenKeyOnToken" (name approx) is used. This version had no
flags and created a default set. This fix uses the version With flags and
does what the old one did, but made sure the key is private and sensitive.

Ticket : https://fedorahosted.org/pki/ticket/1641
---
 base/native-tools/src/tkstool/tkstool.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/base/native-tools/src/tkstool/tkstool.c b/base/native-tools/src/tkstool/tkstool.c
index 5368b2e..b8edea7 100644
--- a/base/native-tools/src/tkstool/tkstool.c
+++ b/base/native-tools/src/tkstool/tkstool.c
@@ -1682,13 +1682,14 @@ main( int argc, char **argv )
                     "on the specified token . . .\n\n" );
 
         if( MASTER_KEY_LENGTH == ( 2 * DES_LENGTH ) ) {
-            masterKey = PK11_TokenKeyGen(
+            masterKey = PK11_TokenKeyGenWithFlags(
             /* slot                     */  slot,
             /* mechanism                */  CKM_DES2_KEY_GEN,
             /* param                    */  0,
             /* keySize                  */  0,
             /* keyid                    */  0,
-            /* isToken (i. e. - isPerm) */  PR_TRUE,
+            /* opFlags */ CKF_SIGN | CKF_DECRYPT | CKF_ENCRYPT,
+            /* pk11AtrFlags */ PK11_ATTR_SENSITIVE | PK11_ATTR_PRIVATE | PK11_ATTR_TOKEN,
             /* wincx                    */  &pwdata );
             if( masterKey == NULL ) {
                 PR_fprintf( PR_STDERR,
@@ -1701,13 +1702,14 @@ main( int argc, char **argv )
                 goto shutdown;
             }
         } else if( MASTER_KEY_LENGTH == ( 3 * DES_LENGTH ) ) {
-            masterKey = PK11_TokenKeyGen(
+            masterKey = PK11_TokenKeyGenWithFlags(
             /* slot                     */  slot,
             /* mechanism                */  CKM_DES3_KEY_GEN,
             /* param                    */  0,
             /* keySize                  */  0,
             /* keyid                    */  0,
-            /* isToken (i. e. - isPerm) */  PR_TRUE,
+            /* opFlags */ CKF_SIGN | CKF_DECRYPT | CKF_ENCRYPT,
+            /* pk11AtrFlags */ PK11_ATTR_SENSITIVE | PK11_ATTR_PRIVATE | PK11_ATTR_TOKEN,
             /* wincx                    */  &pwdata );
             if( masterKey == NULL ) {
                 PR_fprintf( PR_STDERR,
@@ -2307,13 +2309,14 @@ main( int argc, char **argv )
                     "on the specified token . . .\n\n" );
 
         if( WRAPPED_KEY_LENGTH == ( 2 * DES_LENGTH ) ) {
-            masterKey = PK11_TokenKeyGen(
+            masterKey = PK11_TokenKeyGenWithFlags(
             /* slot                     */  slot,
             /* mechanism                */  CKM_DES2_KEY_GEN,
             /* param                    */  0,
             /* keySize                  */  0,
             /* keyid                    */  0,
-            /* isToken (i. e. - isPerm) */  PR_TRUE,
+            /* opFlags */ CKF_SIGN | CKF_DECRYPT | CKF_ENCRYPT,
+            /* pk11AtrFlags */ PK11_ATTR_SENSITIVE | PK11_ATTR_PRIVATE | PK11_ATTR_TOKEN,
             /* wincx                    */  &pwdata );
             if( masterKey == NULL ) {
                 PR_fprintf( PR_STDERR,
@@ -2326,13 +2329,14 @@ main( int argc, char **argv )
                 goto shutdown;
             }
         } else if( WRAPPED_KEY_LENGTH == ( 3 * DES_LENGTH ) ) {
-            masterKey = PK11_TokenKeyGen(
+            masterKey = PK11_TokenKeyGenWithFlags(
             /* slot                     */  slot,
             /* mechanism                */  CKM_DES3_KEY_GEN,
             /* param                    */  0,
             /* keySize                  */  0,
             /* keyid                    */  0,
-            /* isToken (i. e. - isPerm) */  PR_TRUE,
+            /* opFlags */ CKF_SIGN | CKF_DECRYPT |  CKF_ENCRYPT,
+            /* pk11AtrFlags */ PK11_ATTR_SENSITIVE | PK11_ATTR_PRIVATE | PK11_ATTR_TOKEN,
             /* wincx                    */  &pwdata );
             if( masterKey == NULL ) {
                 PR_fprintf( PR_STDERR,
-- 
2.1.0

