Re: Cannot perform signing when multiple keys are present
Douglas E Engert <[email protected]>
| Newsgroups | gmane.comp.encryption.opensc.devel |
|---|---|
| Message-ID | <[email protected]> |
On 12/14/2016 2:22 PM, David Woodhouse wrote: > On Wed, 2016-12-14 at 20:11 +0100, Marcin Okraszewski wrote: >> >> I tried various forms of key, like eg: >> pkcs11:manufacturer=Yubico;object=SIGN%20key;type=private;pin-value=$pin >> pkcs11:model=Yubico%20Yubikey%204%20OTP%2BU2F%2BCCID;object=SIGN%20key;type=private;pin-value=XXXXX >> pkcs11:model=Yubikey%204%20OTP%2BU2F%2BCCID;object=SIGN%20key;type=private;pin-value=XXXXX >> pkcs11:serial=BB6465375E5505273760A874579A76FB;object=SIGN%20key;type=private;pin-value=XXXXX >> pkcs11:serial=BB:64:65:37:5E:55:05:27:37:60:A8:74:57:9A:76:FB;object=SIGN%20key;type=private;pin-value=XXXXX > > $ p11tool --list-token-urls | grep piv > pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29 > > I usually use 'pkcs11:manufacturer=piv_II;…' as it's easy to type. Not > entirely sure why the serial number variant didn't work; perhaps that's > not precisely how OpenSC exposes it? Or could it be case sensitive? With regards to the serial number. NIST 800-73 (PIV) does not define a serial number. It defines a set of objects on a card and allows for multiple manufactures who may or may not provide a serial number or a way to write a serial number. So to simulate a serial number the CHUID object is read from the card. Offical PIV cards have a CHUID. Yubico provides a tool to write a CHUID to their tokens. Note: the Microsoft PIV driver requires a CHUID too. If the CHUID is present and (FASCN has agency code = 9999 or FASCN not present) and the CHUID has a GUID, the GUID 1s used as the serial number (16 bytes). Otherwise if the FASCN if present it is used as serial number (25 bytes) If the CHUID is not present the serial returned is 00000000. The above is printed but opensc-tool --serial. See opensc: src/libopensc/card-piv.c piv_get_serial_nr_from_CHUI But for PKCS#11 the serial number is 16 bytes or less See: src/pkcs11/framework-pkcs11.c piv_get_serial_nr_from_CHUI takes the last 16 bytes. (The FASCN was 25.) > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, SlashDot.org! http://sdm.link/slashdot > > > > _______________________________________________ > Opensc-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/opensc-devel > -- Douglas E. Engert <[email protected]> ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Opensc-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/opensc-devel