Engine allowed to use private keys without a PIN

Access control policies should be enforced by PKCS#11 modules, and not by our engine or libp11. Fixes #242
OpenSC · Sep 12, 2018 · 6c2263b · 6c2263b
1 parent c2512ee
commit 6c2263b
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 4 deletions.
diff --git a/NEWS b/NEWS
@@ -1,6 +1,7 @@
 NEWS for Libp11 -- History of user visible changes
 
 New in 0.4.10; unreleased
+* Engine allowed to use private keys without a PIN (Michał Trojnara)
 
 New in 0.4.9; 2018-09-03; Michał Trojnara
 * Fixed EVP_PKEY ENGINE reference count with the EC EVP_PKEY_METHOD

diff --git a/src/eng_back.c b/src/eng_back.c
@@ -750,10 +750,6 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 	 * with some other (which ones?) PKCS#11 libraries */
 	if (!tok->initialized)
 		ctx_log(ctx, 0, "Found uninitialized token\n");
-	if (isPrivate && !tok->userPinSet && !tok->readOnly) {
-		ctx_log(ctx, 0, "Found slot without user PIN\n");
-		goto error;
-	}
 
 	ctx_log(ctx, 1, "Found slot:  %s\n", slot->description);
 	ctx_log(ctx, 1, "Found token: %s\n", slot->token->label);