OpenPGP card v3.4: Is it possible to use C_GenerateKeyPair to generate keypair

[msetina]

I am trying to generate keypair (RSA or EC), but I keep getting CKR_ARGUMENTS_BAD (0x00000007).
Example templates are:
[(0, 3), (2, 1), (256, 0), (1, 1), (259, 1), (261, 1), (264, 0), (263, 0), (268, 0), (265, 0), (3, 'Decryption key'), (258, b'2')]
[(0, 2), (2, 0), (256, 0), (289, 4096), (1, 1), (260, 1), (266, 0), (262, 0), (267, 0), (3, 'Decryption key'), (258, b'2')]

[msetina]

I guess this error (by runing over code) that there is an argument that is null. As far as I can check the pubkey template it is not as I get different result if I play with modulus_bits (The card does not do 1024 bits)

[msetina]

I was playing enough with templates, that I can say that I am not triggering this:
https://github.com/OpenSC/OpenSC/blob/master/src/pkcs11/pkcs11-object.c#L1155C2-L1158C28

So the return value I get is not from this. Is there some information how a template for OpenPGP card whould look?

[dengert]

I assume you are using OpenSC as the pkcs11 module. Get an OpenSC debug log to see where it is failing.

[msetina]

This is strange. I set Id (and it is not 32) in the template, but this comes out to the place where it fails:

P:6502; T:0x140578996969472 19:40:27.729 [opensc-pkcs11] pkcs15-openpgp.c:373:openpgp_generate_key: called
P:6502; T:0x140578996969472 19:40:27.729 [opensc-pkcs11] pkcs15-openpgp.c:209:openpgp_generate_key_rsa: called
P:6502; T:0x140578996969472 19:40:27.729 [opensc-pkcs11] pkcs15-openpgp.c:211:openpgp_generate_key_rsa: Key ID to be generated: 32
P:6502; T:0x140578996969472 19:40:27.729 [opensc-pkcs11] pkcs15-openpgp.c:221:openpgp_generate_key_rsa: Key ID must be 1, 2 or 3!
P:6502; T:0x140578996969472 19:40:27.729 [opensc-pkcs11] pkcs15-openpgp.c:222:openpgp_generate_key_rsa: returning with: -1300 (Invalid arguments)

also I think someone noticed something like this and wrote this:

OpenSC/src/pkcs15init/pkcs15-openpgp.c

Lines 213 to 219 in fe2c1c8

	/* Accept KeyID = 45, which is default value set by pkcs15init */
	if (kid->len == 1 && kid->value[0] == 0x45) {
	/* Default key is authentication key. We choose this because the common use
	* is to generate from PKCS#11 (Firefox/Thunderbird) */
	sc_log(ctx, "Authentication key is to be generated.");
	key_info.key_id = 3;
	}

In my case calling from code the value is 32 instead of 45.

I noticed the same with SC-HSM where for some reason the id of the key was 3031.... and I did set it in the template.

[msetina]

In the case of OpenPGP key_id matters as it is linked to type of key.

[dengert]

CKA_ID is byte array i.e. binary.
I don 't know what language you are writing your template in but Template looks like:

typedef struct CK_ATTRIBUTE { 
    CK_ATTRIBUTE_TYPE type;  
    CK_VOID_PTR pValue;
    CK_ULONG ulValueLen; 
} CK_ATTRIBUTE;

The CKA_ATRIBUTE _TYPE for CKA_ID would be 0x102UL
The pValue is a pointer to a byte array of length ulValureLen = 0x01UL
and  it looks like you set it to a ASCI char "2" which is 0x32.
It should be value 0x02

[msetina]

In same time I have found my mistake, to not escape the the value in the id. b'2' is not the same as b'\x02'

[msetina]

I can also confirm that EC key can be made in contrast to openpgp-tool that says that only rsa keys can be made.