From c3c2fc3f519abf06b4cf0acf05cde09eb022c12c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sosth=C3=A8ne=20Gu=C3=A9don?= <sosthene@nitrokey.com>
Date: Wed, 7 Dec 2022 15:49:41 +0100
Subject: [PATCH] Fix generation of RSA keys

---
 Cargo.toml      |  8 +++++++-
 src/lib.rs      |  6 +++---
 src/state.rs    |  2 +-
 tests/opensc.rs | 30 +++++++++++++++++++++++++++++-
 4 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 45056f8..eda47f4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,7 +23,7 @@ hex-literal = "0.3"
 interchange = "0.2.2"
 iso7816 = "0.1"
 serde = { version = "1", default-features = false, features = ["derive"] }
-trussed = "0.1"
+trussed = { version = "0.1", features = ["rsa2048", "rsa4096"] }
 untrusted = "0.9"
 vpicc = { version = "0.1.0", optional = true }
 log = "0.4"
@@ -63,3 +63,9 @@ log-error = []
 
 [patch.crates-io]
 trussed = { git = "https://github.com/Nitrokey/trussed", tag = "v0.1.0-nitrokey-3"}
+
+[profile.dev.package.rsa]
+opt-level = 2
+
+[profile.dev.package.num-bigint-dig]
+opt-level = 2
diff --git a/src/lib.rs b/src/lib.rs
index 7bbfe94..fe80336 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -899,7 +899,7 @@ impl<'a, T: trussed::Client + trussed::client::Ed255> LoadedAuthenticator<'a, T>
         match parsed_mechanism {
             AsymmetricAlgorithms::P256 => {
                 let serialized_key = syscall!(self.trussed.serialize_key(
-                    trussed::types::Mechanism::P256,
+                    parsed_mechanism.key_mechanism(),
                     public_key,
                     trussed::types::KeySerialization::Raw
                 ))
@@ -916,7 +916,7 @@ impl<'a, T: trussed::Client + trussed::client::Ed255> LoadedAuthenticator<'a, T>
                 reply.expand(&[0x7F, 0x49])?;
                 let offset = reply.len();
                 let serialized_e = syscall!(self.trussed.serialize_key(
-                    trussed::types::Mechanism::P256,
+                    parsed_mechanism.key_mechanism(),
                     public_key,
                     trussed::types::KeySerialization::RsaE
                 ))
@@ -926,7 +926,7 @@ impl<'a, T: trussed::Client + trussed::client::Ed255> LoadedAuthenticator<'a, T>
                 reply.expand(&serialized_e)?;
 
                 let serialized_n = syscall!(self.trussed.serialize_key(
-                    trussed::types::Mechanism::P256,
+                    parsed_mechanism.key_mechanism(),
                     public_key,
                     trussed::types::KeySerialization::RsaN
                 ))
diff --git a/src/state.rs b/src/state.rs
index 7ddd92e..55a92d8 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -396,7 +396,7 @@ impl Persistent {
         client: &mut impl trussed::Client,
     ) -> KeyId {
         let id = syscall!(client.generate_key(
-            alg.key_mechanism(),
+            dbg!(alg.key_mechanism()),
             StorageAttributes::default().set_persistence(Location::Internal)
         ))
         .key;
diff --git a/tests/opensc.rs b/tests/opensc.rs
index ba38dd5..5e935a9 100644
--- a/tests/opensc.rs
+++ b/tests/opensc.rs
@@ -9,7 +9,7 @@ use std::process::Command;
 
 use card::with_vsc;
 
-use expectrl::{spawn, Eof, Regex, WaitStatus};
+use expectrl::{spawn, Eof, WaitStatus};
 
 #[test]
 fn list() {
@@ -56,3 +56,31 @@ fn admin_card() {
         assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
     });
 }
+
+#[test]
+fn generate_key() {
+    with_vsc(|| {
+        let mut command = Command::new("piv-tool");
+        command
+            .env("PIV_EXT_AUTH_KEY", "tests/default_admin_key")
+            .args(&["-A", "M:9B:03", "-G", "9A:11"]);
+        let mut p = expectrl::session::Session::spawn(command).unwrap();
+        p.check("Using reader with a card: Virtual PCD 00 00")
+            .unwrap();
+        p.check(Eof).unwrap();
+        // Non zero exit code?
+        assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 1));
+    });
+    with_vsc(|| {
+        let mut command = Command::new("piv-tool");
+        command
+            .env("PIV_EXT_AUTH_KEY", "tests/default_admin_key")
+            .args(&["-A", "M:9B:03", "-G", "9A:07"]);
+        let mut p = expectrl::session::Session::spawn(command).unwrap();
+        p.check("Using reader with a card: Virtual PCD 00 00")
+            .unwrap();
+        p.check(Eof).unwrap();
+        // Non zero exit code?
+        assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 1));
+    });
+}