OpenSSL provider implementation does not handle properly unitialized keys.

[reds71]

When using the OpenSSL CLI using public keys stored in the Trust M, when the key object has not been initialized, either the operation succeeds as if normal (RSA) or crashes with a segmentation fault (ECC). Note that all works fine when we create the key first with 0xe0f1:*:NEW:...

Knowing the 0xe0f1 and 0xe0fc OID were never initialized (I agree it may happen a limited period of time, but...), the following OpenSSL executed in a bash on a RPi3 with latest Raspcerry Pi OS and a Trust M Security Shield2GO :

$ openssl pkeyutl -provider trustm_provider -inkey 0xe0fc:^ -sign -rawin -in data.txt -out sig2.bin
Input OID E0FC
$ openssl pkeyutl -provider trustm_provider -inkey 0xe0f1:^ -sign -rawin -in data.txt -out sig2.bin
Input OID E0F1
Segmentation fault

The first should not produce a signature but an error and the second one should not crash obviously. There must miss some defensive code somewhere.

Software version:

• Branch: provider_dev
• OpenSSL 3.0.14 4 Jun 2024 (Library: OpenSSL 3.0.14 4 Jun 2024)

Chip info:

$ ./bin/trustm_chipinfo 
Read Chip Info [0xE0C2]: Success.
========================================================
CIM Identifier             [bCimIdentifer]: 0xcd
Platform Identifer   [bPlatformIdentifier]: 0x16
Model Identifer         [bModelIdentifier]: 0x33
ID of ROM mask                  [wROMCode]: 0x9301
Chip Type                    [rgbChipType]: 0x00 0x1c 0x00 0x05 0x00 0x00
Batch Number              [rgbBatchNumber]: 0x0a 0x01 0x27 0x17 0x00 0x0a
X-coordinate              [wChipPositionX]: 0x0067
Y-coordinate              [wChipPositionY]: 0x0053
Firmware Identifier [dwFirmwareIdentifier]: 0x80101071
Build Number                 [rgbESWBuild]: 24 40

Chip software build: 
OPTIGA(TM) Trust M rev.3; Firmware Version: 3.00.2440
========================================================

Host:

• Raspberry Pi3 model B
• Trust M Security Shield2GO

Host OS and Version:

Linux rpi3 6.6.47+rpt-rpi-v7 #1 SMP Raspbian 1:6.6.47-1+rpt1 (2024-09-02) armv7l GNU/Linux

Compiler:

cc (Raspbian 12.2.0-14+rpi1) 12.2.0

Thank you!