Questions tagged [pkcs#11]
PKCS#11 is a standard that defines the Cryptoki API for accessing and operating cryptographic tokens such as smartcards and HSM.
709
questions
0
votes
0
answers
7
views
Digital signature using USB Token on word file pkcs#11
I want to add a digital signature in word document using USB Token which is not having installer how to complete please help
0
votes
0
answers
21
views
+100
XAdES creation with manual signature entry
I am trying to create a digitally signed XML document using the signature from my ID card.
I have two parts of the program. The first one is getting the certificates and signature of the file from the ...
-1
votes
0
answers
31
views
Signing a CSR fails with extended key usage set to critical
I have the following Root CA certificate:
basic constraints: critical,ca:true
key usage: keycertsign,crlsign
I'm trying to set the extended key usage to critical
Unfortunately, I can only sign the ...
0
votes
0
answers
41
views
Signing a CSR with a self-signed certificate : attribute troubleshoot
I'm currently working with an HSM and I'm trying to generate a self-signed certificate that aims to sign an intermediate certificate.
I already know how to generate these but I've never gone that deep ...
0
votes
0
answers
34
views
Why am I getting an initialization error when using python-pkcs11?
In the past I was able to successfully use the python-pkcs11 package to perform cryptographic operations with a Thales netHsm. I'm using Python 3.7 and I have an environment variable called ...
0
votes
0
answers
57
views
PKCS11 - Select and Decrypt a Key from HSM
I am having some issues selecting a key from the HSM and process encrypt/decrypt with it. Found an example on how to generate -> encrypt -> decrypt a key by Amazon which works perfectly fine:
...
0
votes
0
answers
35
views
how to fix CKR_GENERAL_ERROR when i use iaik to read gemalto smart card java
I use iaik to read gemalto smartcard by java. I use gclib.dll to access smart card.
pkcs11Module = Module.getInstance("C:\\Windows\\System32\\gclib.dll");
pkcs11Module.initialize(null);
...
0
votes
0
answers
18
views
correspondence between TRUSTED CERTIFICATE and TrustAnchorInfo
OpenSSL supports certificates with auxiliary trust/distrust information stored with the PEM label "TRUSTED CERTIFICATE". Other projects like p11-kit seem to have at least partial ...
0
votes
0
answers
54
views
Sign hash using CADES-BES signature using USB token
under the regulation of the e-invoicing in Egypt, the invoices must be electronically signed before submission.
I have been trying to follow the steps in there website: here
but I dont have much ...
1
vote
1
answer
56
views
unable to load private key on the virtual smart card
problem description
I have used bixVirtualReader with OpenSC-isoApplet
but I am unable to load private key on the smart card
what I tried
I tried this instruction after creating my 2048/rsa key ...
0
votes
1
answer
101
views
How to communicate via PKCS#11 with a HSM
I have a Python application which needs to encrypt data. The symmetric keys lying in a separate hardware called HSM.
I have implemented a wrapper in python
pip install python-pkcs11
and set the path ...
2
votes
2
answers
104
views
How to get number of password retries in eToken SafeNet by IAIK PKCS#11
I use Java and IAIK to read eToken info.
Module pkcs11Module = Module.getInstance("PKCS11.dll");
pkcs11Module.initialize(null);
Slot[] slotsWithToken = pkcs11Module.getSlotList(...
1
vote
0
answers
284
views
java: package sun.security.pkcs11.wrapper is not visible
how to solve this error
java: package sun.security.pkcs11.wrapper is not visible
(package sun.security.pkcs11.wrapper is declared in module jdk.crypto.cryptoki, which is not in the module graph)
0
votes
0
answers
105
views
How i extract a certificate and a private key from a token with PKCS11 Interop LowLevele API
I have an application to sign a PDF file and I need to extract from token certificate and private key to do this.
I need a code in C# with Pkcs11Interop LowLevel API. I've tried with this code:
bool ...
0
votes
0
answers
155
views
How to add multiple yubikey PIV authentication keys to ssh-agent with ssh-add?
I have to ssh through a jump host to a remote server, both the jumpbox and the remote server have their own ssh keys stored on yubikeys.
When I have tried using ssh-agent with ssh-add to add the keys ...
0
votes
0
answers
77
views
Is there a way to load multiple yubikey ssh keys into paramiko?
I have to ssh through a jump host to a remote server, both the jumpbox and the remote server have their own ssh keys stored on yubikeys.
Is there a way to load ssh keys in python and pass them to ...
0
votes
0
answers
79
views
How to setup an open source USB token for testing iText 7 digital signature feature?
So basically the feature is to digitally sign a PDF using a USB token.
Digitally signing code is present on Page 96 in this iText guide.
Also, this iText repo.
How can I setup an open source USB token ...
1
vote
0
answers
143
views
How to export ed25519 public key from []*pkcs11.Attribute
I generated an ed25519 key pair with golang PKCS11 library branch v3 (it is connected to SoftHSM2):
publicKeyTemplate := []*pkcs11.Attribute{
pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11....
0
votes
0
answers
54
views
openssl ocsp can not use key from softhsm/ pkcs11 engine
with openssl i'm trying to create ocsp service
i use this command to create ocsp
openssl ocsp -index demoCA/index.txt -port 8080 -rsigner ocspSigning.crt -rkey ocspSigning.key -CA rootCA.crt -text
...
0
votes
0
answers
163
views
problem in importing private key to the token
I am trying to inject an der formated private key to a PKC11 compatible token, with the below command:
pkcs11-tool --module /path_tp/libparskey11.so --login --write-object private.der --type privkey --...
1
vote
1
answer
129
views
URI to identify certificates
Are there some commonly used or standardized URI schemes or patterns that are used to identify SSL certificates, for example for description in linked data applications? The URI does not necessarily ...
-1
votes
1
answer
66
views
Can pkcs#11 library of one vendor be used with an HSM of another vendor? [closed]
Trying to understand whether it is feasible to create a multi-platform Python package that could be able to sign objects using HSM of any vendor?
Since pkcs#11 libraries of different vendors must ...
0
votes
0
answers
117
views
Laravel Mix error Module parse failed: Unexpected character ''
I get a Laravel-mix error Module parse failed: Unexpected character ''. So in my Laravel/Vue project, I installed the following library.
npm i pkcs11js file-loader url-loader
However, when I run...
...
0
votes
0
answers
100
views
How to connect to AWS iot using ngix proxy for TLS?
The problem: I need to connect to AWS iot broker from a python client using paho mqtt. A TLS connection is required to be able to connect to AWS iot, but my certificates are stored in a secure element ...
0
votes
0
answers
186
views
Unable to load PKCS#11 library automatically using p11-kit in ubuntu 20.04
I am trying to load PKCS#11 library automatically using p11-kit in ubuntu 20.04. I tried the same in Fedora 35 it worked.However, in ubuntu it doesn't load the p11-kit-proxy.so.
My main aim is to sign ...
1
vote
0
answers
249
views
Delphi SSL connection using a certificate on a smart card
I'm trying to access a certain API and I have been provided with a smart card which contains the certificate that I'm supposed to use to establish a SSL connection with the said API. I'm trying to do ...
0
votes
0
answers
97
views
tpm2-pkcs11 from inside container (ubuntu)
I have a container that generate its own signing keys. Right now, those key are in memory, which does not provide persistency.
I would like to store those keys, one way is to use a KMS but this is ...
0
votes
1
answer
129
views
PKCS#11Interop.X509Store unable to find Private Key
Pkcs11X509Certificate is unable to find the private key in some tokens.
Pkcs11X509Certificate.GetRSAPrivateKey() yields null. Then, when I run SignedXml.ComputeSignature(), I get the following error:
...
0
votes
0
answers
139
views
Generating XAdES from USB Token in c#
I’m trying to sign XML files via a USB Token in the XAdES format.
Documentation on System.Security.Cryptography.Xml is scarce. I can only find how to sign an XML with basic/default options (https://...
1
vote
0
answers
319
views
Find a private key object in PKCS #11
I have the following work sequence using the PKCS 11 API against SoftHSM:
Generate a number of RSA keys.
Keep the key pairs in the key store.
Later on, retrieve the a RSA key pair of a given modulus ...
0
votes
0
answers
102
views
Using signtool with Common Criteria (CC) token (Thales 5110CC)
I need to sign some jar files using CC token. The token has password and signature PIN defined; however I can't find option to either pass the PIN to jarsigner, or to make it ask for it.
This is the ...
0
votes
2
answers
125
views
PKCS#11: Encryption of multiple plaintext
I want to encrypt a large number of plaintext using PKCS#11 and SafeNet HSM devices. It will take a long time when I encrypt each plaintext one by one.
So It came to my mind if there are any methods ...
0
votes
0
answers
45
views
How to get the plaintext of a Secret Key Entry in Mozilla NSSDB PKCS11?
I have a mozilla NSSDB PKCS11, it includes one of three things. Certificates, keys, and SecretKeyEntry. I would like to know the content of a SecretKeyEntry with the alias "StoreXKey". ...
0
votes
1
answer
278
views
How to generate key in HSM with IAIK PKCS11 library
I am using the IAIK wrapper to send pkcs11 requests to my Bull HSM. My objective is to generate a consistent key (token = true). The problem is that I always have this error code:
Exception in thread &...
0
votes
0
answers
63
views
Why I cannot debug java process with loaded my pkcs11 library on MacOS?
I work with MacOS 11.4, Visual Code 1.60.2 with Microsoft Extension "C/C++ IntelliSense, debugging, and code browsing" for debugging. Build uses clang compiler.
My Pkcs11 library is created ...
0
votes
0
answers
52
views
Using Chrome SignerDigital Browser Extension to sign XML
I tried to sign XML string using signXML method described at the stack overflow example Accessing ePass2003 Auto token through browser without a success. First, it seams that xmlDoc must be a base64 ...
2
votes
0
answers
178
views
PKCS#11 Why i call C_GetSlotList return no slot with token presented for MacOS Application, and return one slot for Command Line Tool?
I face some troubles about PKCS#11 library.
I create 2 projects:
Project 1: macOS Application (GUI - with Objective-C)
Project 2: Command line tool (Console - with C++)
unsigned long GetTokenInfos(...
1
vote
1
answer
149
views
could not initialize BCCSP Factories: Could not find default `PKCS11` BCCSP
I am running Hyperledger Fabric v2.2.3 from github release, in Oracle Linux 8.4
https://github.com/hyperledger/fabric/releases/download/v2.3.3/hyperledger-fabric-linux-amd64-2.3.3.tar.gz
I am running ...
1
vote
2
answers
76
views
Embedded systems : data size management (64bits host sending data to a 32bits device)
I'm building a 32 bits embedded device that an external actor can communicate with through a PKCS#11 interface.
Basically there are 3 components :
Our embedded device (only supports 32 bits)
The host ...
0
votes
0
answers
48
views
Webpack Configuration for .Node files
I'm Using webpack for my React app and I have a module that has a .node file but it seems like webpack can't bundle that file to an understandable format for browsers and consequently browsers can't ...
1
vote
0
answers
67
views
How to perform ECDH with IAIK PKCS#11 Wrapper
I am trying to use IAIK PKCS#11 wrapper to perform ECDH key agreement. I can see that there is a class of the parameters: EcDH1KeyDerivationParameters. But I don't see any classes of the keys for ECDH:...
0
votes
0
answers
117
views
Make get request from python with certificate from usb stick ssl
I have a usb stick with a certificate and I have to use this certificate to make a get request for a page. I want to do this from python and get the json response from the page in cmd. This is the ...
0
votes
1
answer
160
views
Sign any file using PKCS#11 and smartcard
There are some file format (PDF, XML, ZIP) that natively support PKCS#11 signing from a certificate that's on a smartcard. For such formats, there are editors that themselves support signing and ...
0
votes
0
answers
65
views
Importing npm pkcs11js in react fails, why?
I'm new to react and I'm trying to use an npm library and I have a test of it which works fine however when I try to use it in React I can't even import it.
I make my react app like this:
npx create-...
1
vote
0
answers
288
views
Problem with cURL in PKCS11 with USB TOKEN
I am trying to run a cURL on ubuntu on a usb authentication token to an URL.
I can see the private key when I run the command ''pkcs11-tool -l --pin -O", while if I run the command on p11tool ...
0
votes
1
answer
91
views
Generating/Coping KeyPair on USB Token using NodeJS and PKCS11js library
I have no problem with doing that in java; however, I can't do the same thing in this library.
In java, I give these attributes (plus my session) to the C_CreateObject method for creating (copying) ...
0
votes
0
answers
55
views
Client-side Code signing technical explanation
Question: Is there a technical explanation how client side code-signing can be used in enterprise enviroments with open source tools like signtool or openssl?
In my usecase, I want to create a hash of ...
3
votes
0
answers
573
views
IntelliJ is unable to detect jdk.crypto.cryptoki package
I'm trying to use jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11 in IntelliJ, but for some reason it keeps throwing errors. It seems like it's unable to detect this package. One of the ...
1
vote
0
answers
82
views
How to make a HSM key "PRIVATE" after enabling its "EXPORT" attribute using SO user?
As you may know, Thales has introduced two attributes named CKA_EXPORT and CKA_EXPORTABLE to make the key backup procedures more secure.
Based on the documentation, only Security Officer (SO) can ...
3
votes
1
answer
233
views
Pkcs11 ECDSA signing returning CKR_DATA_INVALID
I am using a piv on a Yubikey loaded with trusted certificates to do mutual tls with a server. I am using this golang pkcs11 library
which is a wrapper over opensc-pkcs11.so
I am implementing a signer ...