Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

BUG: sign DATA over 512 bytes doesn't work

Open
  • Is something wrong?
#154 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
cryptography, security

Research direction

Reproduce the issue with the Python script shown in the report, focusing on priv.sign(..., mechanism=Mechanism.ECDSA_SHA256) and the DataLenRange traceback through pkcs11/_pkcs11.pyx. Check the surrounding signing implementation and existing tests for input-length handling. Done means signing data over 512 bytes no longer raises this error and the resulting signature passes the verification step.

Written by the indexing model from the issue text.

Description

vendor

I have the following python script:

#! /usr/bin/env python3

import os
import pkcs11

from Crypto.Hash import SHA256
from Crypto.PublicKey import ECC
from Crypto.Signature import DSS

from pkcs11 import KeyType, ObjectClass, Mechanism
from pkcs11.util.ec import encode_ec_public_key

lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
token = lib.get_token(token_label='SmartCard-HSM (UserPIN)')

with token.open(rw=True, user_pin='123456') as session:

    priv   = session.get_key(label='testkeyEC666', key_type=KeyType.EC, object_class=ObjectClass.PRIVATE_KEY)
    pubkey = session.get_key(label='testkeyEC666', key_type=KeyType.EC, object_class=ObjectClass.PUBLIC_KEY)

    with open('somefile.bin', 'rb') as f:
        data = bytearray(f.read())
    signature = priv.sign(bytes(data), mechanism=Mechanism.ECDSA_SHA256)
    h = SHA256.new(data)
    verifier = DSS.new(ECC.import_key(encode_ec_public_key(pubkey)), 'fips-186-3')
    try:
        verifier.verify(h, signature)
        print("signature ok.")
    except ValueError:
        print("signature not ok!")

It throws me the following error:

Traceback (most recent call last):
  File "/home/Projects/Playground/python-pkcs11/./pkcs11-sign.py", line 30, in <module>
    signature = priv.sign(bytes(data), mechanism=Mechanism.ECDSA_SHA256)
  File "/usr/local/lib/python3.10/dist-packages/pkcs11/types.py", line 939, in sign
    return self._sign(data, **kwargs)
  File "pkcs11/_pkcs11.pyx", line 1072, in pkcs11._pkcs11.SignMixin._sign
  File "pkcs11/_pkcs11.pyx", line 1083, in pkcs11._pkcs11.SignMixin._sign
  File "pkcs11/_errors.pyx", line 88, in pkcs11._pkcs11.assertRV
pkcs11.exceptions.DataLenRange
Dominant language
Python
Stars
170
Forks
79
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from pyauth/python-pkcs11

All issues in pyauth/python-pkcs11

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.