GeneralAuthenticate - RSA signature clobbering

[makinako]

The General Authenticate command takes a number of BET-TLV tags/objects as arguments (Request, Response, Challenge, Witness). When multiple tags are supplied, there is no clear direction as to which order these should be in, and this is evident in various middleware implementations.
When an INTERNAL AUTHENTICATE is performed (which is used for all RSA cryptographic operations), GeneralAuthenticate expects a Challenge and Response (request) to be presented.
A bug exists in OpenFIPS201 where if the Challenge is received before the response request, part of the resulting ciphertext may be clobbered. This is because the same buffer is used for the input and output.

[makinako]

This issue has been resolved. Until beta6 is released this is not included in the latest binary release.