Bug ID: 6678503 DSA signature conversion in pk11_dsa_do_verify() ignores size of big numbers leading to failures

Bug ID	6678503
Synopsis	DSA signature conversion in pk11_dsa_do_verify() ignores size of big numbers leading to failures
State	10-Fix Delivered (Fix available in build)
Category:Subcategory	solaris-crypto:openssl
Keywords	rtiq_reviewed
Responsible Engineer	Vladimir Kotal
Reported Against
Duplicate Of
Introduced In	solaris_10
Commit to Fix	snv_93
Fixed In	snv_93
Release Fixed	solaris_nevada(snv_93) , solaris_10u7(s10u7_01) (Bug ID:2165121)
Related Bugs	6554248 , 6678508
Submit Date	21-March-2008
Last Update Date	3-July-2008
Description	Call to C_Verify() from OpenSSL PKCS#11 engine's pk11_dsa_do_verify() returns CKR_SIGNATURE_INVALID from time to time when used in the context with number of SSL/TLS connections. This leads to failures in SSL/TLS handshake during key setup phase, e.g.: ** client_dh.c:112 SSL_connect() failed, i.e. error connecting SSL object: ERR queue:** 1832:error:8107E081:lib(129):func(126):reason(129):/export/ws/vk199839/openssl_pk11-poison_locking.onnv/usr/src/common/openssl/crypto/engine/hw_pk11_pub.c:1636:"PK11 CK_RV=0Xc0" 1832:error:1408D07B:SSL routines:SSL3_GET_KEY_EXCHANGE:bad signature:../../../../common/openssl/ssl/s3_clnt.c:1375:""
Work Around	do not use pkcs11 engine, DSA or nothing
Comments	N/A

OpenSolaris