Re: Cannot perform signing when multiple keys are present

On 12/14/2016 1:11 PM, Marcin Okraszewski wrote:
> Hi,
> Is it possible to work with libp11 and OpenSSL if there are multiple tokens inserted? I cannot make it work.
>
> I use Yubikey for performing signatures with OpenSSL. It works perfect if there is just Yubikey inserted into machine. But I have a problem when there is another token also inserted. OpenSSL always
> tells me it cannot find object or that token is empty.
>
> Normally I sign with such command:
>
>     openssl.exe smime -sign -engine pkcs11 -keyform engine -inkey "pkcs11:object=SIGN%20key;type=private;pin-value=XXXXXX" -in test.msg  -out test.smime -signer yubi-l1.pem
>

It looks like the pkcs#11 will use the P11-kit, which can load multiple PKCS#11 modules, and and tries to find all objects that match "object=SIGN%20key;type=private"
If there is more then one card that can match the pattern, then it will fail as it is expecting the URI to select only a single object. (private key in this case)
p11-kit may load both the Yubico PIV PKCS#11 module and the OpenSC module that supports the PIV.

Safenet has a PIV application on the card and it could that the Yubico PKCS#11 or the OpenSC PKCS#11 is finding both cards, which then match object=SIGN%20key;type=private.
As both have a object=SIGN%20key;type=private.

>
> It works perfectly when there is just Yubikey. Now I have a machine, where there is also another token inserted (SafeNet). Then the command ends with output like this:
>
>     openssl.exe smime -sign -engine pkcs11 -keyform engine -inkey "pkcs11:object=SIGN%20key;type=private;pin-value=XXXXXX" -in test.msg  -out test.smime -signer yubi-l1.pem
>     Specified object not found
>     PKCS11_get_private_key returned NULL
>     engine "pkcs11" set.
>     cannot load signing key file from engine
>     1568:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:.\crypto\engine\eng_pkey.c:124:
>     unable to load signing key file
>
>
> Here is the list of tokens:
>
>     > opensc-tool.exe -l
>     # Detected readers (pcsc)
>     Nr.  Card  Features  Name
>     0    Yes             AKS ifdh 0
>     1    Yes             AKS ifdh 1
>     2    Yes             AKS VR 0
>     3    Yes             Rainbow Technologies iKeyVirtualReader 0
>     4    Yes             Rainbow Technologies iKeyVirtualReader 1
>     5    Yes             Yubico Yubikey 4 OTP+U2F+CCID 0
>

opensc-tool does not use p11-kit or the OpenSC PKCS#11 either.

>
>
> I tried various forms of key, like eg:
>
>   * pkcs11:manufacturer=Yubico;object=SIGN%20key;type=private;pin-value=$pin
>   * pkcs11:model=Yubico%20Yubikey%204%20OTP%2BU2F%2BCCID;object=SIGN%20key;type=private;pin-value=XXXXX
>   * pkcs11:model=Yubikey%204%20OTP%2BU2F%2BCCID;object=SIGN%20key;type=private;pin-value=XXXXX

This looks like you are trying to use the YUBICO PKCS#11 module?

>   * pkcs11:serial=BB6465375E5505273760A874579A76FB;object=SIGN%20key;type=private;pin-value=XXXXX
>   * pkcs11:serial=BB:64:65:37:5E:55:05:27:37:60:A8:74:57:9A:76:FB;object=SIGN%20key;type=private;pin-value=XXXXX
>
> With the same result. I also tried slot_0-id_2, but then it says "Found empty token".
>
> Some other outputs:
>
>> opensc-tool.exe -r 5 --serial
> BB 64 65 37 5E 55 05 27 37 60 A8 74 57 9A 76 FB .de7^U.'7`.tW.v.
>
>> pkcs15-tool.exe --reader 5 -k
> Private EC Key [SIGN key]
>         Object Flags   : [0x1], private
>         Usage          : [0x204], sign, nonRepudiation
>         Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
>
>         FieldLength    : 384
>         Key ref        : 156 (0x9C)
>         Native         : yes
>         Auth ID        : 01
>         ID             : 02
>         MD:guid        : 0x'3032363436353337356535353035323733373630613837343537
> 3961373666620000000000000000'

pkcs15-tool also does not use PKCS#11 module either.

pkcs11-tool can be used with the --module to load p11-kit or a specific PKCS#11 module such as opensc-pkcs11.so
and slots can be listed and the tokens in the slots can be listed. This can be helpful to see
what the the "token manufacturer" is (as defined by the PKCS#11 module) to use with the p11-kit manufacturer= parameter.
With the the OpenSC PKCS#11 and a Yubico or PIV card, it would be manufacturer=piv_II The OpenSC tries to treat the Yubico as a PIV.

With the pkcs11-tool -O -l this will list the objects, and you will see:

Private Key Object; RSA
   label:      SIGN key
   ID:         02
   Usage:      decrypt, sign, non-repudiation
   Access:     always authenticate

The label is used by p11-kit for object=SIGN%20key;type=private comes from.

I do not use p11-kit, but wrote the OpenSC PIV driver.
I will leave it up to others to explain the p11-kit use of the URI.

Also see:
https://tools.ietf.org/html/rfc7512

>
> Thank you for help!
> Marcin Okraszewski
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>
>
>
> _______________________________________________
> Opensc-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>

-- 

  Douglas E. Engert  <[email protected]>


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot