[Bug 60443] New: ncrypt: Support importing ECDSA key blobs.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60443

            Bug ID: 60443
           Summary: ncrypt: Support importing ECDSA key blobs.
           Product: Wine
           Version: 11.19
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: crypt32
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

Symptom:
`NCryptImportKey` with `BCRYPT_ECCPRIVATE_BLOB` or `BCRYPT_ECCPUBLIC_BLOB`
fails
with `Unhandled key magic`.

Wine today:
- `dlls/ncrypt/main.c`: `NCryptImportKey` handles only RSA magics.
- The internal `enum algid` has `ECDSA_P256` but no P-384 or P-521.
- EC key objects have no `NCRYPT_ALGORITHM_PROPERTY` and no
  `NCRYPT_ALGORITHM_GROUP_PROPERTY`, which callers need to choose an export
blob type.
- `include/ncrypt.h` lacks `MS_KEY_STORAGE_PROVIDER` and the
`NCRYPT_*_ALGORITHM_GROUP`
  strings ("RSA", "DH", "DSA", "ECDSA", "ECDH") that the Windows SDK header
defines.

Should do:
- Import ECDSA P-256, P-384 and P-521 public and private blobs, by handing them
to bcrypt.
- Set the name, group, length and public-key-length properties on the new key.
- Add the missing header definitions in their own commit.

Confirm on Windows:
- The property values for imported EC keys: `Algorithm Name` is "ECDSA_P256",
or "ECDSA"
  on newer Windows with curve-generic keys.
- Whether ECDH magics are accepted too, and what the group is then.
- That `NCryptExportKey` round-trips the imported blob.

Software Affected:
Control4 Composer Pro

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 60443] ncrypt: Support importing ECDSA key blobs.

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60443

--- Comment #1 from [e-mail] ---
Created attachment 82337
  --> http://bugs.winehq.org/attachment.cgi?id=82337
Suggested patch (tested on Wine 11.19, not upstream-ready)

For reference, a minimal patch along these lines (P-256 only) that was tested
here
is attached: it sets Algorithm Name / Algorithm Group / ECCCurveName /
SignatureLength on
ECDSA_P256 key objects, imports BCRYPT_ECDSA_{PUBLIC,PRIVATE}_P256_MAGIC blobs
through
BCryptImportKeyPair(BCRYPT_ECDSA_P256_ALG_HANDLE), and FIXME-ignores the
NCryptBufferDesc
parameter list instead of failing.

Observed with .NET Framework 4.8 on Wine 11.19:
ECDsa.Create(ECCurve.NamedCurves.nistP256)
works, but ExportParameters(), CertificateRequest.CreateSelfSigned() and
anything copying the
key fail with CryptographicException 0x80090027, because .NET queries
"Algorithm Name" and then
re-imports the key with NCryptImportKey(BCRYPT_ECCPRIVATE_BLOB, params =
NCRYPTBUFFER_PKCS_KEY_NAME).

It is a suggestion, not an upstream-ready patch: no P-384/P-521, no new tests,
and ignoring the
key-name parameter means a named key silently becomes ephemeral. Applies to
wine-11.19 and
current master; ncrypt conformance tests unchanged (i386 and x86_64).

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.