search

OpenSC / OpenSC

Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend
https://github.com/OpenSC/OpenSC/wiki
GNU Lesser General Public License v2.1
2.56k stars 733 forks source link

Add support for NIST SP 800-78-5? #2971

Open Headcrabed opened 10 months ago

Headcrabed commented 10 months ago

Problem Description

NIST SP 800-78-5 (Initial Public Draft) was released in september 2023. It has multiple modification including RSA3072 key support. Maybe we should add support for it? Or wait for final version? Draft release page: https://csrc.nist.gov/pubs/sp/800/78/5/ipd

dengert commented 10 months ago

14 card drivers in OpenSC have support for RSA 3072. But you need a card/token with applet that supports RSA 3072. NIST sp800-73-1 in 2006 defined it for PIV, but it was dropped in later versions. It looks like it is coming back.

grep "_sc_card_add_rsa_alg(card,.*3072" card-*

frankmorgner commented 9 months ago

I assume you are referring specifically to the PIV card driver as NIST SP 800-78-5 is about Cryptographic Algorithms and Key Sizes for Personal Identity Verification

From the ChangeLog, I read the following:

In 2023, Revision 5 updates incorporate the following changes: • Table 1 reflects additional higher strength keys with at least 128-bit security and suggested sunsets of lower sized keys by 2030 in anticipation of the recommended migration to 128-bit security strength in 2031. • Accommodation of the Secure Messaging Authentication key • Deprecation of the symmetric card authentication key • Deprecation of 3TDEA algorithm with identifiers ‘00’ and ‘03’ • Removal of the retired RNG from CAVP PIV component testing where applicable

The only new feature added is the PIV Secure Messaging key. As far as I read the code, we're currently only supporting the pairing code for key establishment with PIV SM being disabled by default.

AFAICT, the new version should be supported if we add support for the asymmetric PIV SM key.