From sacadmin Wed Feb 14 11:48:51 2007 Received: from jurassic.eng.sun.com (jurassic.SFBay.Sun.COM [129.146.226.31]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id l1EJmpiB007448; Wed, 14 Feb 2007 11:48:51 -0800 (PST) Received: from jurassic.eng.sun.com (localhost [127.0.0.1]) by jurassic.eng.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l1EJmd6R108459 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 14 Feb 2007 11:48:39 -0800 (PST) Received: (from darrenm@localhost) by jurassic.eng.sun.com (8.13.8+Sun/8.13.8/Submit) id l1EJmc5b108449; Wed, 14 Feb 2007 11:48:39 -0800 (PST) Date: Wed, 14 Feb 2007 11:48:39 -0800 (PST) From: Darren J Moffat Message-Id: <200702141948.l1EJmc5b108449@jurassic.eng.sun.com> To: PSARC@sac.sfbay.sun.com Cc: crypto-discuss@zion.eng.sun.com, kmf-discuss@opensolaris.org, org@jurassic.eng.sun.com Subject: encrypt(1) / mac(1) token key support [PSARC/2007/094 Timeout: 02/21/2007] Status: RO Content-Length: 4574 Subject: PSARC FastTrack [02/21/2007]: encrypt(1) / mac(1) token key support Template Version: @(#)sac_nextcase %I% %G% SMI 1. Introduction 1.1. Project/Component Working Name: encrypt(1) / mac(1) token key support 1.2. Name of Document Author/Supplier: Author: Huie-Ying Lee 1.3 Date of This Document: 14 February, 2007 4. Technical Description ====================== Background ====================== About 3 years ago, the Solaris EF team discussed about a possible enhancement to the encrypt/decrypt/mac commands to support token objects. A RFE(4868006) was submitted, but it was not implemented due to lack of a convenient tool that a user can use to generate a token key object before. With the newly improved KMF/pktool command integrated in snv_53, I think that implementing this enhancement now can provide some real benefit to users. A user can use the "pktool genkey" command to create a token key in a pkcs11 keystore first, then use this pre-generated token key *anytime* later to perform encryption, descryption or MAC operation with the new encrypt/descrypt/mac command. This provides a higher degree of security, because the key is safely stored in a keystore which can be a hardware. An example of usage is provided at the end of this proposal. The encrypt(1) command was originally Evolving, so this is now Committed. The new functionality is Committed. A release binding of patch is requested. ========================================================= Updated CLI's for the encrypt, decrypt, and mac commands ========================================================= To support token objects in these 3 commands, 2 new options are added: -K keylabel -T token[:manuf[:serial]] These 2 options are used to identify the symmetric token key in the token. If the token keystore is the Solaris Softtoken keystore, -T can be omitted. The diff files between the original man pages and the updated man pages are attached: - encrypt.1.diff for the encrypt and decrypt commands. - mac.1.diff for the mac command. ================================================================== Updated CLI for the "pktool genkey" command ================================================================== Because a generic secret key is needed by the MAC command when the algorithm is not "des_mac", and the current "pktool genkey" command doesn't support that, we need to enhance the "pktool genkey" to support a generic secret key as following: pktool genkey [keystore=pkcs11] label=key-label [keytype=aes|arcfour|des|3des|generic] [keylen=key-size (AES, ARCFOUR or GENERIC only)] [token=token[:manuf[:serial]]] [sensitive=y|n] [extractable=y|n] To be consistent across all the keystores supported in KMF, a generic secret key support will be added for the NSS keystore and the file-based keystore also. The diff file between the pktool(1) man page of ONNV_53 and the updated pktool(1) man page, pktool.1.diff, is attached. ======================================================= One typical usage to leverage both KMF and EF ======================================================= The following example illustrates a use case which uses the pktool(1), encrypt(1) and decrypt(1) commands together to perform cryptographic operations with a 3DES token key. Step 1. Use the "pktool genkey" command to generate a 3DES token key in the pkcs11 softtoken keystore. $pktool genkey keystore=pkcs11 keytype=3des label=my3deskey Enter pin for Sun Software PKCS#11 softtoken : XXXXXXX Step 2. Use the "pktool list" command to see the newly created 3DES token key. $pktool list objtype=key Enter pin for Sun Software PKCS#11 softtoken : XXXXXXX Found 1 keys. Key #1 - Triple-DES: my3deskey (1740352 bits) 192 bits Step 3. Use the new "encrypt" command to encrypt an input file with the 3DES token key. $encrypt -a 3des -K my3deskey -i /etc/my_secret -o encrypt.out Enter pin for Sun Software PKCS#11 softtoken : XXXXXXX Step 4: Use the new "decrypt" command to decrypt the encrypted output with the 3DES token key. $decrypt -a 3des -K my3deskey -i encrypt.out -o decrypt.out Enter pin for Sun Software PKCS#11 softtoken : XXXXXXX Step 5: diff /etc/my_secret decrypt.out 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack From sacadmin Fri Feb 23 04:01:29 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id l1NC1TWj013254 for ; Fri, 23 Feb 2007 04:01:29 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l1NC1R6K012395 for <@sunmail2sca.sfbay.sun.com:psarc@sun.com>; Fri, 23 Feb 2007 04:01:29 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JDX0031302G1S00@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Fri, 23 Feb 2007 04:01:28 -0800 (PST) Received: from gmp-ea-fw-1.sun.com ([129.156.42.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JDX000RY02FQH60@nwk-avmta-1.sfbay.Sun.COM> for psarc@sun.com (ORCPT psarc@sun.com); Fri, 23 Feb 2007 04:01:28 -0800 (PST) Received: from d1-emea-09.sun.com ([192.18.2.119]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l1NC1QXj008618 for ; Fri, 23 Feb 2007 12:01:26 +0000 (GMT) Received: from conversion-daemon.d1-emea-09.sun.com by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JDX0060100O5G00@d1-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for psarc@sun.com (ORCPT psarc@sun.com); Fri, 23 Feb 2007 12:01:26 +0000 (GMT) Received: from [192.168.73.101] (nessieroo.force9.co.uk [81.174.224.49]) by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JDX00FHG02BNZ00@d1-emea-09.sun.com> for psarc@sun.com (ORCPT psarc@sun.com); Fri, 23 Feb 2007 12:01:26 +0000 (GMT) Date: Fri, 23 Feb 2007 12:01:22 +0000 From: Darren J Moffat Subject: encrypt(1) / mac(1) token key support [PSARC/2007/094 closed-approved] Sender: Darren.Moffat@sun.com To: psarc@sun.com, crypto-discuss@opensolaris.org, kmf-discuss@opensolaris.org Message-id: <45DED792.8010507@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 1.5.0.8 (X11/20061127) Status: RO Content-Length: 139 Since the timer has expired (02/21/2007) and there were no comments on this case I'm marking it as closed approved. -- Darren J Moffat