Cannot perform signing when multiple keys are present

Hi,
Is it possible to work with libp11 and OpenSSL if there are multiple tokens
inserted? I cannot make it work.

I use Yubikey for performing signatures with OpenSSL. It works perfect if
there is just Yubikey inserted into machine. But I have a problem when
there is another token also inserted. OpenSSL always tells me it cannot
find object or that token is empty.

Normally I sign with such command:

openssl.exe smime -sign -engine pkcs11 -keyform engine -inkey
"pkcs11:object=SIGN%20key;type=private;pin-value=XXXXXX" -in test.msg  -out
test.smime -signer yubi-l1.pem


It works perfectly when there is just Yubikey. Now I have a machine, where
there is also another token inserted (SafeNet). Then the command ends with
output like this:

openssl.exe smime -sign -engine pkcs11 -keyform engine -inkey
"pkcs11:object=SIGN%20key;type=private;pin-value=XXXXXX" -in test.msg  -out
test.smime -signer yubi-l1.pem
Specified object not found
PKCS11_get_private_key returned NULL
engine "pkcs11" set.
cannot load signing key file from engine
1568:error:26096080:engine routines:ENGINE_load_private_key:failed loading
private key:.\crypto\engine\eng_pkey.c:124:
unable to load signing key file


Here is the list of tokens:

> opensc-tool.exe -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             AKS ifdh 0
1    Yes             AKS ifdh 1
2    Yes             AKS VR 0
3    Yes             Rainbow Technologies iKeyVirtualReader 0
4    Yes             Rainbow Technologies iKeyVirtualReader 1
5    Yes             Yubico Yubikey 4 OTP+U2F+CCID 0



I tried various forms of key, like eg:

   -
   pkcs11:manufacturer=Yubico;object=SIGN%20key;type=private;pin-value=$pin
   -
   pkcs11:model=Yubico%20Yubikey%204%20OTP%2BU2F%2BCCID;object=SIGN%20key;type=private;pin-value=XXXXX
   -
   pkcs11:model=Yubikey%204%20OTP%2BU2F%2BCCID;object=SIGN%20key;type=private;pin-value=XXXXX
   -
   pkcs11:serial=BB6465375E5505273760A874579A76FB;object=SIGN%20key;type=private;pin-value=XXXXX
   -
   pkcs11:serial=BB:64:65:37:5E:55:05:27:37:60:A8:74:57:9A:76:FB;object=SIGN%20key;type=private;pin-value=XXXXX

With the same result. I also tried slot_0-id_2, but then it says "Found
empty token".

Some other outputs:

> opensc-tool.exe -r 5 --serial
BB 64 65 37 5E 55 05 27 37 60 A8 74 57 9A 76 FB .de7^U.'7`.tW.v.

> pkcs15-tool.exe --reader 5 -k
Private EC Key [SIGN key]
        Object Flags   : [0x1], private
        Usage          : [0x204], sign, nonRepudiation
        Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract,
local

        FieldLength    : 384
        Key ref        : 156 (0x9C)
        Native         : yes
        Auth ID        : 01
        ID             : 02
        MD:guid        :
0x'3032363436353337356535353035323733373630613837343537
3961373666620000000000000000'

Thank you for help!
Marcin Okraszewski

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel