From darrenm@sac.sfbay.sun.com Tue Sep 16 11:42:41 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8GIgfWm022419 for ; Tue, 16 Sep 2008 11:42:41 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m8GIgdHE019576; Tue, 16 Sep 2008 11:42:40 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K7A00901XB39H00@brm-avmta-1.central.sun.com>; Tue, 16 Sep 2008 12:42:39 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K7A007Q9XAV2L10@brm-avmta-1.central.sun.com>; Tue, 16 Sep 2008 12:42:31 -0600 (MDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m8GIgVKU051903; Tue, 16 Sep 2008 11:42:31 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8GIgQZl022387; Tue, 16 Sep 2008 11:42:26 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m8GIgQMS022383; Tue, 16 Sep 2008 11:42:26 -0700 (PDT) Date: Tue, 16 Sep 2008 11:42:26 -0700 (PDT) From: Darren J Moffat Subject: Slot/token selection enhancement for the pam_pkcs11 module [PSARC/2008/585 Self Review] To: PSARC-ext@sun.com Cc: Huie-Ying.Lee@sun.com Message-id: <200809161842.m8GIgQMS022383@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3847 Template Version: @(#)sac_nextcase %I% %G% SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Slot/token selection enhancement for the pam_pkcs11 module 1.2. Name of Document Author/Supplier: Author: Huie-Ying Lee 1.3 Date of This Document: 16 September, 2008 4. Technical Description To port the pam_pkcs11 module to OpenSolaris, we made a change in the slot/token selection scheme to resolve a serious problem in the original OpenSC/pam_pkcs11 module. The original pam_pkcs11 module used a slot number to select a slot, which is not safe, because the PKCS#11 specification does not guarantee slot ordering. To resolve this problem, we changed the selection scheme to use slot_description to select a slot instead. After we contributed the code back to the upstream communtity (opensc.org), they requested that we make further changes to allow a user to use either slot_num or slot_description, but not both, to specify a slot to use. This enhancement request has been implemented and integrated into the upstream community recently. To keep the OpenSolaris source in sync with the upstream OpenSC community, we will like to integrate the change sot OpenSolaris as well. Note that using "slot_description" is still the preferred way to select a slot. "slot_num" should only be used with those PKCS#11 implementations that guarantee constant slot numbering. This notice will be documented explicitly in the pam_pkcs11.conf configuration file. For more information, see the attached diffs to the default pam_pkcs11.conf below. *** pam_pkcs11.conf.orig Tue Sep 16 10:01:36 2008 --- pam_pkcs11.conf Tue Sep 16 10:18:05 2008 *************** *** 17,31 **** module = /usr/lib/libpkcs11.so; description = "Solaris PKCS#11 Cryptographic Framework library"; # ! # Which slot to use. The slot is specified by the slot description. ! # For example, slot_description = "Sun Crypto Softtoken". # ! # The default value is "none" which means to use the first slot with ! # an available token. # ! # An administrator can use the "cryotoadm list -v" command to find ! # all the available slots and their slot descriptions. For more # information, see the libpkcs11(3LIB) and cryptoadm(1m) man pages. # slot_description = "none"; --- 17,41 ---- module = /usr/lib/libpkcs11.so; description = "Solaris PKCS#11 Cryptographic Framework library"; + # Which slot to use? + # You can use "slot_description" or "slot_num", but not both, to specify + # the slot to use. Using "slot_description" is preferred because the + # PKCS#11 specification does not guarantee slot ordering. "slot_num" should + # only be used with those PKCS#11 implementations that guarantee + # constant slot numbering. # ! # slot_description = "xxxx" ! # The slot is specified by the slot description, for example, ! # slot_description = "Sun Crypto Softtoken". The default value is ! # "none" which means to use the first slot with an available token. # ! # slot_num = a_number ! # The slot is specified by the slot number, for example, slot_num = 1. ! # The default value is zero which means to use the first slot with an ! # available token. # ! # On Solaris OS, an administrator can use the "cryotoadm list -v" command ! # to find all the available slots and their slot descriptions. For more # information, see the libpkcs11(3LIB) and cryptoadm(1m) man pages. # slot_description = "none"; 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: SFW 6.5. ARC review type: Automatic 6.6. ARC Exposure: open