Questions tagged [pkcs#11]
PKCS#11 is a standard that defines the Cryptoki API for accessing and operating cryptographic tokens such as smartcards and HSM.
756
questions
-2
votes
0
answers
28
views
EInvoice Electronic signiture
hi everyone I use Pkcs11 to generate signatures from the token
I wrote the code below:
List<ObjectAttribute> searchTemplate = new List<ObjectAttribute>();
searchTemplate.Add(new ...
0
votes
1
answer
55
views
osslsigncode Sign with Hardware Token issue (Failed to set 'dynamic' engine)
I'm trying to sign EXE files with osslsigncode, my cert and key are on a Safenet Hardware token which the system is able to read :
:~# pkcs11-tool --module /usr/lib/pkcs11/libeToken.so --login --list-...
1
vote
0
answers
35
views
What is the pkcs11 equivalent of NCryptSecretAgreement and NCryptDeriveKey functions
I have an application running on Linux which needs to generate derived key with ECDH. I get ephemeral public key and KDF parameter and need to return derived key data.
This will be matched against ...
0
votes
0
answers
21
views
USB Token certificate details Botan and pkcs11 c++
I am trying to read the USB token certificate details like the day stated, the day end and subject, and other details from the certificate on the USB token I am using Botan 2.19 library and PKCS11 I ...
1
vote
1
answer
30
views
Can't get greengrass to work with TPM privkey and cert
I'm trying to get greengrass working with a SLB9670 tpm, and can't seem to get it working no matter what I try. All documentation online seems incorrect or deprecated in relation to this process. This ...
0
votes
0
answers
30
views
IAIK PKCS11 wrapper support for Virtual Slot (HA)
Session logic implemented with IAIK seems to be on top of token, but in case of Virtual Slot (like Luna HSM High Availability) where there is no token present how to obtain a session via the IAIK Java ...
0
votes
0
answers
55
views
Is a CSPN certified Yubikey 5 NFC (Firmware version 5.4.2) supposed to support OpenPGP?
I have been using a CSPN certified YubiKey 5 NFC running Firmware Version 5.4.2 for some time now. The only thing I haven't been able to properly set up are my OpenPGP keys.
At first I assumed that ...
1
vote
0
answers
142
views
Where is engine_pkcs11.so?
I'm trying to run openssl in combination with a PKCS#11 hardware security module (currently trying with Yubikey 5). All documentation and tutorials I find tell me that I have to use OpenSC as "...
0
votes
0
answers
10
views
yubikey dongle : generate key through pkcs11 failed
I don't manage to generate rsa private key on yubikey (4 series) with pkcs11 module.
command:
#pkcs11-tool -v --module /usr/local/lib64/libykcs11.so --login --login-type so --keypairgen --id 5 --key-...
0
votes
0
answers
42
views
rsa padding error on opensssl 3.0 and libp11 with an eToken
TLS 1.2 (RSA mode: ex AES256-GCM-SHA384 ) does't work on red hat 9 (openssl 3.0.7-16.el9_2 ) with libp11 (version 0.4.7 and 0.4.8 and 0.4.11 and 0.4.12).
I use an eToken (5110) to store the private ...
0
votes
0
answers
45
views
Importing pfx/p12 file into smartcard using swift/Objective C
Is there any way to import PFX/p12 file to smartcard programmatically using swift/Objective C?
Actually, I am able to extract the certificate from certificate chain(.p7b). Then instead of saving the ...
1
vote
1
answer
79
views
How to extract objects from SoftHSM with a JNA interface?
I am using SoftHSM and I have to develop a Java application to extract objects of it.
I have a "Data" object of label "MY_DATA" and I have successfully opened the session on the ...
0
votes
1
answer
37
views
cryptoki C_GenerateRandom fails
moved to v2 of cryptoki (CK_VERSION 204. File is 4.4.0.0). This code worked before but now doesn't:
// key is BYTE[32]
RV rv;
CK_FLAGS flags = CKF_SERIAL_SESSION | CKF_RW_SESSION;
CK_SESION_HANDLE ...
0
votes
0
answers
23
views
Signature verification returns C0(CKR_SIGNATURE_INVALID)
I am trying to generate key pair using safenet sdk. Then I tried to sign the certificate informations with private key and verify using public key. But, the verification says signature is invalid. I ...
0
votes
0
answers
29
views
how do i create a my own inplementation of pkcs11.h
I have a smart card that i want to use later such that, i can retrieve the certificate inside and use that to sign a PDFs or what not with digital signature.
so i was trying to use opensc for that, ...
1
vote
1
answer
72
views
Importing private key in Safenet dongle 5110
I am trying to import a base64 representation of private key into safenet dongle.
Example Private key:
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEA3VLpIpck/...
0
votes
0
answers
14
views
I can’t install the libp11 library on Windows
I followed the installation of the library on the github:
"https://github.com/OpenSC/libp11/blob/master/INSTALL.md" by testing with many methods (CYGWIN,MINGW).
But every time I try to ...
0
votes
0
answers
42
views
Which approach i should follow to save private key in USB dongle(Safenet Dongle)
My goal is to store private key in USB Dongle and then sign csr using this private key.
I can follow 2 ways:
Firstly, i can generate key pair and store them in mac's keychain. Then I will export the ...
1
vote
0
answers
31
views
Interfacing with C++ code in XCode (Swift) Project causing Linker error [duplicate]
I have a swift project and I am trying to call C++ libraries from it. I have several .h files that I have included in project (added them in Project > Build Settings > Header Search Paths). Then ...
0
votes
0
answers
125
views
Caused by: iaik.pkcs.pkcs11.wrapper.PKCS11Exception: CKR_FUNCTION_FAILED
I'm having problems with my application that generates xml signed on windows. I am using the ESYA API library in .net core project.
iaik.pkcs.pkcs11.wrapper.PKCS11Exception: CKR_FUNCTION_FAILED
at ...
0
votes
0
answers
134
views
Unable to load the PKCS11_MODULE *.dll library using pkcs11
I'm facing a problem when running the following script:
import pkcs11
import os
# Initialise our PKCS#11 library
lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
The last line raises an error saying :
...
1
vote
1
answer
87
views
Document altered/corrupted while attaching IAIK PKCS11 signing Hash
I have a base64 encoded message digest (signing bytes of a pdf), which I want to sign and return PKCS7. Previously, I was using SUNPKCS11 and was able to attach the same to the pdf.
I have started ...
0
votes
0
answers
108
views
Sign generated PDF from user smartCard or token Angular / NodeJS
I have an angular front End and NodeJS back end App.
I can generate some PDFs.
Before to be able to save the PDF, i would love to have a pop up window asking the user to sign it with its own ...
0
votes
1
answer
100
views
Add C header files to Swift project for PKCS11 interfacing with Safenet 5110
I have a Safenet 5110 dongle. I am using MacOS ventura 13.2.1 (with Swift 5.7 and Xcode 14.2). I have downloaded the driver to authenticate with the dongle (Safenet Authentication Token - SAC). There, ...
0
votes
0
answers
73
views
Automate parsing yubikey pin in pkcs11
I'm working on infrastructure that requires me to load a smartcard prior to getting access to the bastions. This is done using a Yubikey based pkcs11.so The code looks like :
`
Generate-ssh() {
ssh-...
1
vote
0
answers
63
views
How to perform AES gcm encryption using Python PYKCS11
I am trying to simulate an AES-GCM encryption using soft-HSM and Python PyKCS11 library.
according to Oasis documentation. C_EncryptFinal needs to be called after C_Encrypt step to get Ciphertext and ...
0
votes
0
answers
26
views
C_Initialize() is failed when CKTEEC_LOGIN_TYPE is group not user
C_Initialize() is alright when CKTEEC_LOGIN_TYPE is user.
But C_Initialize() is failed when CKTEEC_LOGIN_TYPE is group.
This results in "TEE_IOC_OPEN_SESSION failed".
What makes this error?...
0
votes
1
answer
164
views
Signing XML (XML-DSig) using HSM and PKCS11 token in .Net Core 7.0
I have X509 certificate which contains public key only in my database. The corresponding private key is store inside HSM. I found out that SignedXml class in .NET does not support signing XML in HSM.
...
0
votes
1
answer
178
views
How to get private key from HSM to sign XML doc
How to get private key from HSM to sign XML doc
I want to sign a XML document used HSM.
I loaded keystore, login and get certificate, but don't know how to get privateKey to use in sign function. So ...
0
votes
0
answers
175
views
KeyError: 'PKCS11_MODULE'
I am trying to work with the PKCS11 Python Module. I am following the procedure defined here: https://python-pkcs11.readthedocs.io/en/latest/
I am using python 3.10.6 on an Ubuntu 22.04 virtual ...
0
votes
0
answers
100
views
Deploy java springboot to Docker has error invalid ELF header
My code java has a config to call dll file.
After deploy used Docker, I also push this file to container.
But when run, Docker has error without everything ok in local.
Caused by: java.io.IOException: ...
1
vote
0
answers
245
views
How to use a pkcs11-tool generated elliptic key with openssl
I have managed to generate a RSA keypair in softHSM with pkcs11-tool, and do verification og signed data with that using openssl.
pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so -l --token-label ...
0
votes
1
answer
363
views
Extract public key from PKCS11 keystore to do signature verification
I'm generating a keypair in a softHSM keystore, and uses it to sign a software.
Now I need to extract the public key and move it to my target.
I can sign and verify with pkcs11-tool, but I have not ...
0
votes
1
answer
189
views
Error in pkcs11_generate:1355: PKCS #11 user error
I'm trying to generate a public/private keypair in softHSM, for this I have installed a provider in openssl.
Using these commands I end up in a "user error"
+ softhsm2-util --init-token --...
0
votes
1
answer
114
views
How to parse certifcate/privateKey pair by using Crypto11
I have a pkcs11 token that only contains the private key object. I want to use crypto11 package to retrieve the private key. When I try to parse the x509 key pair by inputting the certificate file and ...
0
votes
1
answer
218
views
Wrap AES key with RSA public key - CKM_RSA_PKCS_OAEP
I am using iaik pkcs11 java trying to wrap an AES key with RSA public key.
Can someone please help me what is the issue with above params/code?
I am trying to wrap an AES key with RSA public key. ...
0
votes
1
answer
208
views
Establish SSL/TLS Connection using Certificate present in Thales Luna HSM
I am trying to setup a Netty Server with HTTPS enabled. In order to establish the SSL/TLS connections, I need to fetch the certificiate from Safenet Luna Network HSM and pass that Cert to Netty's SSL ...
2
votes
1
answer
367
views
Correct way to conduct private key operation from PKCS11 for mTLS connection in Go
I have successfully imported the private key into the PKCS11 token. The token object looks like this:
Private Key Object; RSA
label: #####
ID: #####
Usage: decrypt, sign, ...
0
votes
0
answers
80
views
Running aws-iot-device-sdk-python-v2 with PKCS11 Received error: Feature not supported on this platform
I created a thing on AWS MQTT. And I use softhsm to import private key into a token. The token looks like this:
Private Key Object; RSA
label: #####
ID: #####
Usage: decrypt, ...
0
votes
0
answers
120
views
Decrpyting using pkcs#11 tool
I'm trying too encrypt and decrypt using pkcs#11-tool
echo 'Hello word !' | openssl pkeyutl -encrypt -pubin \
-inkey pub.pem \
...
0
votes
1
answer
72
views
Java code Executed Successfully but not terminated [closed]
I have a java code that executed successfully but JVM doesn't exit even after adding system.exit(0);
class GetSignatureNew {
public static void main (String args[])
{
String pwd = &...
1
vote
1
answer
153
views
Error while execute java procedure from Oracle Database
I have java code to read certificate from USB token. The code is working properly as stand alone Java class.
After importing Java class into Oracle Database (19c), with loadjava utility, the Java ...
0
votes
2
answers
186
views
Connect from c# to THALES payshield to validate PIN Bank card
We have a develop to make some things with bank cards.
One og them is validate the PIN (we have PAN, PIN, Pinlenght and PINBLOCK); and we have a HSM THALES to validate the PIN.
But, how do we connect ...
1
vote
1
answer
342
views
PKCS11 does not recognize new slot created in softhsm in runtime
I have a piece of code to import key and certificate into hsm using java. The problem is that when I run the java back-end to execute that api, it is ok when using the slots which were created before. ...
0
votes
0
answers
277
views
I use CopyWithPrivateKey I get error 'The provided key does not match the public key for this certificate. Parameter name: privateKey'
X509Certificate2 _HsmserverCertificate = null;
string pkcs11LibraryPath = "C:\\Program Files (x86)\\nCipher\\nfast\\toolkits\\pkcs11\\cknfast-64.dll";
Pkcs11InteropFactories factories = ...
2
votes
1
answer
221
views
How to use SHA512 hashing algorithm with elliptic curve to sign, in PKCS11Interop?
In am using PKCS11Interop in C#, i got CKR_MECHANISM_INVALID error while trying to use method Sign. The key object i am using is of mechanism type CKM_EC_KEY_PAIR_GEN . but at signing time, i use ...
1
vote
1
answer
149
views
HSM RSA OAEP Encryption with Asymmetric hashes fails
I am using the PKCS11Interop library to Encrypt and Decrypt data with the parameters below.
CK_RSA_PKCS_OAEP_PARAMS p = new CK_RSA_PKCS_OAEP_PARAMS();
p.HashAlg = (uint)CKM.CKM_SHA256;
p.Mgf = (uint)...
1
vote
1
answer
280
views
How to AuthenticateAsServer when Certificate is in HSM and privateKey is not embeded in Certificate and PrivateKey is not extractable from HSM
I want to ask a qusetion according to my code, My code is as bellow:
in AuthenticateAsServer I get "The server mode SSL must use a certificate with the associated private key" error cause ...
1
vote
1
answer
55
views
smartcard + configfile: how to avoid error "File name too long"?
I am trying to change my openconnect usage from command line to configfile.
I need to use a smartcard (StarSign CUT S, from Giesecke & Devrient GmbH) in order to access my VPN.
My current command ...
0
votes
1
answer
53
views
Can I decrypt a string encrypted using the pkcs11 AES 128-CTR library with the python Cryptodome module?
I want to decrypt binary what is encrypted by pkcs11 AES 128-CTR library.
Server gives me key, iv and data which is encrypted with pkcs11.
I don't know the server encrypts data how.
from Cryptodome....