turnkey/openpgp-card
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Explicitly handle RSA keysizes that are not in the card's algorithm list as an error.

Browse source
This commit is contained in:
Heiko Schaefer 2021-08-29 18:21:38 +02:00
parent 5a6a5754e1
commit 65780cf352
1 changed files with 14 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
openpgp-card/src/keys.rs
View file

@ -158,7 +158,8 @@ pub(crate) fn upload_key(
// Does the card offer a list of algorithms? // Does the card offer a list of algorithms?
let rsa_attrs = if let Some(algo_list) = algo_list { let rsa_attrs = if let Some(algo_list) = algo_list {
// Yes -> Look up the parameters for key_type and rsa_bits. // Yes -> Look up the parameters for key_type and rsa_bits.
get_card_algo_rsa(algo_list, key_type, rsa_bits) // (Or error, if the list doesn't have an entry for rsa_bits)
get_card_algo_rsa(algo_list, key_type, rsa_bits)?
} else { } else {
// No -> Get the current algorithm attributes for key_type. // No -> Get the current algorithm attributes for key_type.
@ -242,7 +243,7 @@ fn get_card_algo_rsa(
algo_list: AlgoInfo, algo_list: AlgoInfo,
key_type: KeyType, key_type: KeyType,
rsa_bits: u16, rsa_bits: u16,
) -> RsaAttrs { ) -> Result<RsaAttrs, OpenpgpCardError> {
// Find suitable algorithm parameters (from card's list of algorithms). // Find suitable algorithm parameters (from card's list of algorithms).
// FIXME: handle "no list available" (older cards?) // FIXME: handle "no list available" (older cards?)
// (Current algo parameters of the key slot should be used, then (?)) // (Current algo parameters of the key slot should be used, then (?))
@ -262,10 +263,17 @@ fn get_card_algo_rsa(
.filter(|&a| a.len_n() == rsa_bits) .filter(|&a| a.len_n() == rsa_bits)
.collect(); .collect();
// FIXME: handle error if no algo found // Did we find a suitable algorithm entry?
let algo = *algo[0]; if !algo.is_empty() {
Ok((*algo[0]).clone())
algo.clone() } else {
// RSA with this bit length is not in algo_list
return Err(anyhow!(
"RSA {} unsupported according to algo_list",
rsa_bits
)
.into());
}
} }
// Check if `oid` is supported for `key_type` in algo_list. // Check if `oid` is supported for `key_type` in algo_list.