Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service

From	Ansgar <ansgar@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service
Date	2022-07-04 22:10 +0200
Message-ID	<EFAyl-997I-3@gated-at.bofh.it> (permalink)
References	(5 earlier) <ExMwG-4ugp-17@gated-at.bofh.it> <EFtdv-94R5-1@gated-at.bofh.it> <EFwbn-96x0-3@gated-at.bofh.it> <ExMwG-4ugp-17@gated-at.bofh.it> <EFwbn-96x0-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

I experimented a bit more and could reproduce the problem with a local
YK (Yubikey 4, Firmware 4.3.7) and a known private key and certificate.

The correct signature (using OpenSSL) has:

+---
| 138 256:           OCTET STRING
|        :             00 00 45 75 A8 93 B1 B1 37 0A 53 69 82 BB 1C B6
+---[ data.ko.p7s.success ]

The incorrect signature from the YK has:

+---
| 138 254:           OCTET STRING
|        :             82 45 75 A8 93 B1 B1 37 0A 53 69 82 BB 1C B6 E7
+---[ data.ko.p7s.fail ]

So there is also a wrong byte at the beginning.
The incorrect signature also misses one byte at the end.

The attached archive contains:

 - data.ko: random data to be signed
 - data.ko.p7s.fail: incorrect signature generated by YK4
 - data.ko.p7s.success: correct signature generated by OpenSSL
 - reproduce.sh: sign with YK4 (set serial# in the first lines)
 - reproduce2.sh: sign with OpenSSL
 - sign-file: make this a symlink to linux' sign-file
 - test.key: private key
 - test.pem: self-signed certificate

The test.{key,pem} need to be loaded in the Digital Signature (Slot 9c)
slot of the PIV application.

I haven't checked if this is reproducible with another YK with the same
data/key/cert, but it is reproducible with the same key.

Ansgar

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ben Hutchings <ben@decadent.org.uk> - 2022-06-13 18:30 +0200
  Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ben Hutchings <ben@decadent.org.uk> - 2022-06-18 16:30 +0200
    Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ben Hutchings <ben@decadent.org.uk> - 2022-06-18 16:40 +0200
    Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ben Hutchings <ben@decadent.org.uk> - 2022-06-19 13:10 +0200
      Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ansgar <ansgar@debian.org> - 2022-07-04 14:20 +0200
        Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ben Hutchings <ben@decadent.org.uk> - 2022-07-04 17:30 +0200
          Bug#1012741: modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service Ansgar <ansgar@debian.org> - 2022-07-04 22:10 +0200

csiph-web