dogtagpki

#2282 The TPS does not properly communicate symmetricKeys.requiredVersion to the TKS
Closed: Invalid Opened by dsirrine.

Closed: Invalid
Reopen Issue

In the TPS CS.cfg if you set the value of ..update.symmetricKeys.requiredVersion to a decimal number that corelates to an ASCII charecter (~32 to ~127) the TKS will interpret the value as an ASCII cahrter instead of a key identifier.

For example: if you set the TPS to ..update.symmetricKeys.requiredVersion=65 then the TKS will receive the key identifier as "A#01"

This is affecting key changeover.

Steps to Reproduce:

1. Modify tps CS.cfg
op.enroll.userKey.update.enable=true
op.enroll.userKey.update.symmetricKeys.requiredVersion=66
op.format.userKey.update.enable=true
op.format.userKey.update.symmetricKeys.requiredVersion=66
op.pinReset.userKey.update.enable=true
op.pinReset.userKey.update.symmetricKeys.requiredVersion=66
2. Restart tps.
# systemctl restart pki-tomcatd@pki-tomcat.service
3. attempt to format, enroll, or reset pin on a token.
Actual results:
1. ESC fails with "Formatting of smart card failed. Error: Your smart card can not perform the operation requested by the Smart Card Server"
2. TKS debug logs show the following where the key name is B#01:
[26/Jan/2016:14:00:43][http-13443-Processor24]: keySet selected: defKeySet
[26/Jan/2016:14:00:43][http-13443-Processor24]: keySet selected: defKeySet
[26/Jan/2016:14:00:43][http-13443-Processor24]: SignedAuditEventFactory: create() message=[AuditEvent=DIVERSIFY_KEY_REQUEST][CUID_encoded=SN#06P#000#00D#16#08][KDD_encoded=#00#00#00#00#00#00#00#00#00#00][Outcome=Success][AgentID=TPS-cs81.dsirlab.com-7889][oldMasterKeyName=#01#01][newMasterKeyName=B#01] TKS Key Change Over request
[26/Jan/2016:14:00:43][http-13443-Processor24]: TokenServlet: processDiversifyKey():  xkeyInfo[0] (old) = 0x1,  xkeyInfo[1] (old) = 0x1,  xnewkeyInfo[0] = 0x42,  xnewkeyInfo[1] = 0x1
[26/Jan/2016:14:00:43][http-13443-Processor24]: TokenServlet: processDiversifyKey():  Nist SP800-108 KDF will be used for key versions >= 0x0
[26/Jan/2016:14:00:43][http-13443-Processor24]: TokenServlet: processDiversifyKey():  Nist SP800-108 KDF (if used) will use KDD.
[26/Jan/2016:14:00:43][http-13443-Processor24]: process DiversifyKey for oldSelectedToke=Internal Key Storage Token newSelectedToken=Internal Key Storage Token oldKeyNickName=#01#01 newKeyNickName=B#01
[26/Jan/2016:14:00:43][http-13443-Processor24]: TokenServlet:outputString.length 8
[26/Jan/2016:14:00:43][http-13443-Processor24]: SignedAuditEventFactory: create() message=[AuditEvent=DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE][CUID_decoded=534E0650003000441608][KDD_decoded=00000000000000000000][Outcome=Failure][status=1][AgentID=TPS-cs81.dsirlab.com-7889][oldMasterKeyName=#01#01][newMasterKeyName=B#01][TKSKeyset=defKeySet][OldKeyInfo_KeyVersion=0x1][NewKeyInfo_KeyVersion=0x42][NistSP800_108KdfOnKeyVersion=0x0][NistSP800_108KdfUseCuidAsKdd=false][Error=Problem diversifying key data.] TKS Key Change Over request failed
[26/Jan/2016:14:00:43][http-13443-Processor24]: CMSServlet: curDate=Tue Jan 26 14:00:43 EST 2016 id=tksCreateKeySetData time=17

Expected results:

Key changeover succeeds where key nickname and master key name = 66#01 or similar.

After some digging, I conclude that the reported issue does not exist in the rewritten JAVA version of TPS. I think the Util.java specialURLEncode() turns integers to Hex string correctly, while in 8.1 (C++ TPS) the Util::SpecialURLEncode() misses the conversion if the integer happens to be isAlphaNumeric().

Metadata Update from @dsirrine:
- Issue assigned to cfu
- Issue set to the milestone: 10.3.1

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2402

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
defect
TPS
RHCust
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.