Re: PKCS11 & cryptlib 3.3.3

Fred <[email protected]> writes:

>Q1 : I am trying to user rebuild cryptlib 333 wit PKCS11 support via opensc
>under Linux, but it seems like if build script does not detect my opensc
>installation.
>Some vars like HAS_PKCS11 seems to be set by tools/.ccopts.sh when pkcs11.h
>is present in some standard directories : /usr/include,
>/usr/include/security, /usr/include/opensc/ or /usr/local/include.

3.3.3 is a really old version, it was EOL'd some time ago, you should really
use the latest version.  cryptlib will detect the presence of PKCS #11 in
standard locations, if it's not in a standard location then you'll need to
either change the build script or move it to a standard location (where's
your PKCS #11 path)?

>Q2 : It seems there is no cryptlib function to enumerate pkcs11 devices.

There's no standard way to do this, you'll have to use the opensc tools to do
it.

>Does strings like token label value returned by pkcs11-tool --module
>/usr/lib/opensc-pkcs11.so
>-L can be passed to cryptDeviceOpen ?

Yes, that should do it.

>Q3 cryptDeviceOpen arguments :
>If I wan to sign cefrt request with a CA certificate and key stored in the
>smartcard,
>
>I suppose cryptUser has to be set to CRYPT_USER_CA
>I suppose deviceType can be set to CRYPT_DEVICE_PKCS11
>I suppose name can be set to token label string returned by pkcs11-tool.

cryptUser is CRYPT_UNUSED, the rest is as you say.

Peter.

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.