<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Great find, Ed! Thanks a lot! I would love to make it parametrized
but as I mentioned<br>
I don't have Windows environment nowdays. But I do accept patches :)<br>
<pre class="moz-signature" cols="72">Aleksey
</pre>
<br>
On 7/11/11 7:42 PM, EdShallow wrote:
<blockquote
cite="mid:CAB3xoRj4uEwP6ca6RZ7+7KpEK+EceP8-Z2Gv_pd=MYxV9tpBag@mail.gmail.com"
type="cite">PostScript ...<br>
<br>
Really, this behavior should be paramaterized via a setter
method on a SILENT flag exactly as MS does it.<br>
<br>
Cheers,<br>
Ed <br>
<br>
<div class="gmail_quote">On Mon, Jul 11, 2011 at 10:35 PM,
EdShallow <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:ed.shallow@gmail.com">ed.shallow@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid
rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left:
1ex;">OK guys, I found the source of the changed behavior in
1.2.18<br>
<br>
It is in certkeys.c and relates to the SILENT flag below ...<br>
<br>
if (!CryptAcquireCertificatePrivateKey(pCert,<br>
CRYPT_ACQUIRE_SILENT_FLAG |
CRYPT_ACQUIRE_COMPARE_KEY_FLAG,<br>
NULL,<br>
&hProv,<br>
&(ctx->dwKeySpec),<br>
&fCallerFreeProv)) {<br>
xmlSecError(XMLSEC_ERRORS_HERE,<br>
NULL,<br>
"CryptAcquireCertificatePrivateKey",<br>
XMLSEC_ERRORS_R_CRYPTO_FAILED,<br>
XMLSEC_ERRORS_NO_MESSAGE);<br>
return(-1);<br>
<br>
If one removes the CRYPT_ACQUIRE_SILENT_FLAG and re-compiles,
then the old behavior can be achieved. In other words, with
the removal of this flag, one will be prompted for the
MSCRYPTO KeyName and password to login to (i.e. acquire) the
key-pair as was the case with XMLSec 1.2.13 where this was the
default behavior.<br>
<br>
Hope this helps those using XMLSec on the workstation as
opposed to on the server where clearly a modal dialog prompt
is not desirable.<br>
<br>
Cheers,<br>
Ed <br>
<br>
<div class="gmail_quote">
<div class="im">On Wed, Jun 22, 2011 at 1:09 AM, EdShallow <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:ed.shallow@gmail.com" target="_blank">ed.shallow@gmail.com</a>></span>
wrote:<br>
</div>
<div>
<div class="h5">
<blockquote class="gmail_quote" style="border-left: 1px
solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex;
padding-left: 1ex;">Some updates with respect to
mscrypto 1.2.18<br>
<br>
The "key is not found" error with 1.2.18 is
misleading. In fact what is happening is that when
specifying a KeyName for a certificate associated with
its private key in a key store that is not "logged
in", you get the "key is not found" error.<br>
<br>
If the CSP's container allows you to log in to the key
store prior to usage, then XMSec mscrypto will succeed
as long as the session with the private key has been
logged in.<br>
<br>
Now please be aware not all CSPs allow you to login in
advance of searching the certificate and adopting the
key. In fact most don't and prompt at first
programmatic usage (i.e. adoption or context acquire).<br>
<br>
The only CSP I have tried (and this is how I found the
problem) is Entrust's CAPI CSP called Entrust Service
Provider for Windows version 9.1. If I login to my
Entrust key store before running an XMLSec sign
operation, it works. If I am NOT already logged in to
my Entrust key store when I executed the XMLSec
command, it fails. Additionally the error message
generated by XMLSec is not indicative of really what
is happening.<br>
<br>
The standard Microsoft Cryptographic Service Provider
and the Microsoft Enhanced Cryptographic Service
Provider do NOT allow this login in advance of usage.
A login dialog box appears only when your CAPI code
attempts to acquire the certificate context and use
the key for signing. Any use of these 2 CSPs fails
with XMLSec 1.2.18.<br>
<br>
This "key is not found" behavior does NOT happen with
1.2.10, 1.2.11, 1.2.13 all of which work fine.<br>
<br>
When using these earlier versions of XMLSec, a dialog
box with login prompt is presented as a result of key
adoption and everything works fine after a successful
password is entered. The dialog re-prompts until the
correct password is provided. This is expected
behavior.<br>
<br>
All this testing was done with Igor's 1.2.18
Unicode=yes binaries which do not crash but do exhibit
the incorrect behavior described above. I did not test
much with the Unicode=no binaries as soon as I
encountered the crashes.<br>
<br>
I am not sure what triggers the dialog box with the
key protection password prompt, but this is the error
with 1.2.18. All earlier versions before 1.2.13 DO
trigger this dialog box correctly.<br>
<br>
Hope this helps,<br>
Ed
<div>
<div><br>
<br>
<br>
<br>
<div class="gmail_quote">On Tue, Jun 21, 2011 at
4:38 PM, Roumen Petrov <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:xmlsec@roumenpetrov.info"
target="_blank">xmlsec@roumenpetrov.info</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204,
204); margin: 0pt 0pt 0pt 0.8ex; padding-left:
1ex;">
EdShallow wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204,
204); margin: 0pt 0pt 0pt 0.8ex;
padding-left: 1ex;">
<div>
OK guys, here is the story with mscrypto:<br>
<br>
</div>
[SNIP]
<div><br>
throughout the above tests. it is clear
that the mscrypto code somewhere<br>
after 1.2.13 has introduced the error.<br>
<br>
</div>
</blockquote>
[SNIP]<br>
One change , if i remember well , is CP_ACP
-> CP_UTF8 . It is based on request posted
to the list.<br>
I don't have environment to test. Probably
this could be issue, but you report
ascii(latin1) names and I'm not sure that this
modification is reason for failure.<br>
<br>
If "Shallow, Ed" and "Adam Grossman" work fine
with 1.2.13 there is not reason to fail if
CP_ACP -> CP_UTF8.<br>
<br>
Also I'm afraid with report like "openssl sign
with .p12 - crash". I don't know what to say .<br>
<font color="#888888">
<br>
<br>
Roumen<br>
</font></blockquote>
</div>
<br>
<br clear="all">
<br>
</div>
</div>
<div>
<div>-- <br>
Ed's Contact Information:<br>
Mobile Phone: <a moz-do-not-send="true"
href="tel:613-852-6410" value="+16138526410"
target="_blank">613-852-6410</a><br>
Gmail: <a moz-do-not-send="true"
href="mailto:ed.shallow@gmail.com"
target="_blank">ed.shallow@gmail.com</a><br>
VOIP Address: <a moz-do-not-send="true"
href="mailto:107529@sip.ca1.voip.ms"
target="_blank">107529@sip.ca1.voip.ms</a><br>
VOIP DID#: <a moz-do-not-send="true"
href="tel:613-458-5004" value="+16134585004"
target="_blank">613-458-5004</a><br>
Skype ID: edward.shallow<br>
Home Phone: <a moz-do-not-send="true"
href="tel:613-482-2090" value="+16134822090"
target="_blank">613-482-2090</a><br>
<br>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<div>
<div class="h5"><br>
<br clear="all">
<br>
-- <br>
Ed's Contact Information:<br>
Mobile Phone: <a moz-do-not-send="true"
href="tel:613-852-6410" value="+16138526410"
target="_blank">613-852-6410</a><br>
Gmail: <a moz-do-not-send="true"
href="mailto:ed.shallow@gmail.com" target="_blank">ed.shallow@gmail.com</a><br>
VOIP Address: <a moz-do-not-send="true"
href="mailto:107529@sip.ca1.voip.ms" target="_blank">107529@sip.ca1.voip.ms</a><br>
VOIP DID#: <a moz-do-not-send="true"
href="tel:613-458-5004" value="+16134585004"
target="_blank">613-458-5004</a><br>
Skype ID: edward.shallow<br>
Home Phone: <a moz-do-not-send="true"
href="tel:613-482-2090" value="+16134822090"
target="_blank">613-482-2090</a><br>
<br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Ed's Contact Information:<br>
Mobile Phone: 613-852-6410<br>
Gmail: <a moz-do-not-send="true"
href="mailto:ed.shallow@gmail.com">ed.shallow@gmail.com</a><br>
VOIP Address: <a moz-do-not-send="true"
href="mailto:107529@sip.ca1.voip.ms">107529@sip.ca1.voip.ms</a><br>
VOIP DID#: 613-458-5004<br>
Skype ID: edward.shallow<br>
Home Phone: 613-482-2090<br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
<a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a>
</pre>
</blockquote>
</body>
</html>