如何使用OpenSC使用智能卡中的私钥解密消息

Question

我们最近更新到OpenSC 0.15.0，由于某种原因，我们不能再使用它来解密带有来自智能卡的私钥的消息。

显然，无论我们使用pkcs11工具（提供OpenSC）还是OpenSSL引擎，都会发生同样的情况。

以下是我们所做的一个例子：

PKCS11工具：

% pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so --decrypt -v -l --input-file encrypted.bin --id 9352
Using slot 1 with a present token (0x1)
Logging in to "OpenSC Card".
Please enter User PIN: 
Using decrypt algorithm RSA-PKCS
error: PKCS11 function C_Decrypt failed: rv = CKR_DATA_LEN_RANGE (0x21)

Aborting.

或者通过使用OpenSSL引擎，这是一个小示例程序：

#include <iostream>
#include <openssl/engine.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/crypto.h>

using namespace std;

int main()
{
    OpenSSL_add_all_algorithms();
    ENGINE_load_dynamic();

    // Setup OpenSSL engine
    ENGINE* engine = ENGINE_by_id("dynamic");
    string enginePath = "/usr/local/lib/engines/pkcs11.so";
    string modulePath = "/usr/local/lib/opensc-pkcs11.so";

    ENGINE_ctrl_cmd_string(engine, "SO_PATH", enginePath.c_str(), 0);
    ENGINE_ctrl_cmd_string(engine, "LIST_ADD", "1", 0);
    ENGINE_ctrl_cmd_string(engine, "LOAD", NULL, 0);
    ENGINE_ctrl_cmd_string(engine, "MODULE_PATH", modulePath.c_str(), 0);

    string pin = "123456";
    ENGINE_ctrl_cmd_string(engine, "PIN", pin.c_str(), 0);
    ENGINE_ctrl_cmd_string(engine, "VERBOSE", NULL, 0);
    ENGINE_init(engine);
    ENGINE_set_default(engine, ENGINE_METHOD_ALL);

    string keyName = "id_9352";
    EVP_PKEY *evp = ENGINE_load_private_key(engine, keyName.c_str(), NULL, NULL);

    // Read encrypted file
    long unsigned int length = 128;
    unsigned char buf[length];
    FILE* f = fopen("encrypted.bin", "r");
    fread(buf, 1, length, f);
    fclose(f);

    // Try to decrypt
    unsigned char output[length];
    unsigned char* p = output;
    RSA *rsa = EVP_PKEY_get1_RSA(evp);
    int outputLen = RSA_private_decrypt(length, buf, p, rsa, RSA_PKCS1_PADDING);
    if (outputLen == -1) {
        long err = ERR_get_error();
        cout << "Error decrypting: " << ERR_error_string(err, NULL) << endl;
        return 1;
    }

    cout << output << endl;
    return 0;
}

但是当我运行它时：

% ./sc-decrypt
PKCS#11: Initializing the engine
Found 2 slots
Loading private key "slot_1-id_9352"
Looking in slot 1 for key: 9352
[18446744073709551615] Virtual hotplug slot       no tok          
[1] Gemalto PC Twin Reader 00  login             (OpenSC Card)
Found slot:  Gemalto PC Twin Reader 00 00
Found token: OpenSC Card
Found 0 certificate:
Found 1 private key:
   1 P  Private Key
Error decrypting: error:80008021:Vendor defined:PKCS11_rsa_decrypt:Data len range

显然，在这两种情况下都是同样的错误，关于“数据范围”

更奇怪的是，当使用pkcs11-tool进行签名操作（也使用私钥）时工作正常：

% echo "test signing" > input.txt
% pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so --sign -v --input-file input.txt --output-file out.sign --id 9352 -l
Using slot 1 with a present token (0x1)
Logging in to "OpenSC Card".
Please enter User PIN: 
Using signature algorithm RSA-PKCS
% ls -l out.sign 
-rw-------  1 user  user  128 May 18 10:08 out.sign

所以，如果有人能指出我做错了什么，我会非常感激

Answer 1

我知道这已经很晚了（问题发生3年后），但它可能对某人有所帮助。

我遇到了同样的问题。但是当我列出OpenSC支持的所有机制时，我可以看到RSA_PKCS的最小密钥大小是512。实际上，这是模数大小。相应的密钥大小是4096。因此，只需确保生成的密钥对至少为4096位。在我的情况下，它工作（使用pkcs11-tool命令。我还没有实现C代码fr）。