{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/508","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/508/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/508/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/508/events","html_url":"https://github.com/OpenSC/OpenSC/issues/508","id":98604336,"number":508,"title":"GemSafe Card: Can't sign a SHA256 hash","user":{"login":"velter","id":2226804,"avatar_url":"https://avatars.githubusercontent.com/u/2226804?v=3","gravatar_id":"","url":"https://api.github.com/users/velter","html_url":"https://github.com/velter","followers_url":"https://api.github.com/users/velter/followers","following_url":"https://api.github.com/users/velter/following{/other_user}","gists_url":"https://api.github.com/users/velter/gists{/gist_id}","starred_url":"https://api.github.com/users/velter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/velter/subscriptions","organizations_url":"https://api.github.com/users/velter/orgs","repos_url":"https://api.github.com/users/velter/repos","events_url":"https://api.github.com/users/velter/events{/privacy}","received_events_url":"https://api.github.com/users/velter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OpenSC/OpenSC/labels/Enhancement","name":"Enhancement","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":32,"created_at":"2015-08-02T11:42:48Z","updated_at":"2015-09-08T14:00:23Z","closed_at":null,"body":"I'm trying to use a GemSafe card (OpenTrust KSign) with opensc pkcs11 interface (windows x64). All is work well except that I can't sign a SHA256 hash. Pkcs11 return a general error. \r\nAfter enabling logging, the error come from \r\n\r\n2015-08-02 13:08:58.513 [opensc-pkcs11] card-gemsafeV1.c:430:gemsafe_compute_signature: called\r\n2015-08-02 13:08:58.513 error: input data too long: 51 bytes\r\n2015-08-02 13:08:58.513 [opensc-pkcs11] sec.c:58:sc_compute_signature: returning with: -1300 (Invalid arguments)\r\n\r\nThere seem to be a hard limit in the code to 36 bytes.\r\n\r\nI know the card is able to process more data than this with the Gemalto provided pkcs11 lib.\r\n\r\nIs this check really necessary ?\r\n\r\nCard ATR : 3b:7d:96:00:00:80:31:80:65:b0:83:11:00:c8:83:00:90:00"},"comment":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/comments/138568522","html_url":"https://github.com/OpenSC/OpenSC/issues/508#issuecomment-138568522","issue_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/508","id":138568522,"user":{"login":"velter","id":2226804,"avatar_url":"https://avatars.githubusercontent.com/u/2226804?v=3","gravatar_id":"","url":"https://api.github.com/users/velter","html_url":"https://github.com/velter","followers_url":"https://api.github.com/users/velter/followers","following_url":"https://api.github.com/users/velter/following{/other_user}","gists_url":"https://api.github.com/users/velter/gists{/gist_id}","starred_url":"https://api.github.com/users/velter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/velter/subscriptions","organizations_url":"https://api.github.com/users/velter/orgs","repos_url":"https://api.github.com/users/velter/repos","events_url":"https://api.github.com/users/velter/events{/privacy}","received_events_url":"https://api.github.com/users/velter/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T14:00:23Z","updated_at":"2015-09-08T14:00:23Z","body":"@dengert  I didn't imagine that this problem will open such a can of worms :(\r\nFor myself, I can live with the current behavior. SHA1 is not that bad for what I'm using it for right now. I reach the limit of my knowledge about smartcards, but if you want me to do more tests I can do them. Unfortunatly I have no doc at all about this card.\r\n\r\n@mouse07410  yes my pubkey is in PEM format. And I'm sure it's right because\r\n\r\npkcs11-tool -s -m SHA1-RSA-PKCS --pin XXXXXX -d 1d228aeee53d5b320aaede6715592afa6491791a -i mytest -o sha1-2.out\r\nUsing slot 1 with a present token (0x1)\r\nUsing signature algorithm SHA1-RSA-PKCS\r\nopenssl dgst -sha1 -verify pubkey.pem -keyform pem -signature sha1-2.out mytest\r\nVerified OK\r\n\r\nopenssl dgst -sha1 -binary -out mytest1.dgst < mytest\r\npkcs11-tool -s -m RSA-PKCS --pin XXXXXX -d 1d228aeee53d5b320aaede6715592afa6491791a -i mytest1.dgst -o sha1.out\r\nUsing slot 1 with a present token (0x1)\r\nUsing signature algorithm RSA-PKCS\r\nopenssl dgst -sha1 -verify pubkey.pem -keyform pem -signature sha1.out mytest\r\nVerification Failure\r\n\r\nSHA256 result in the same failure.\r\n\r\n"}}