Re: Cannot perform signing when multiple keys are present

David, Douglas,
Thank you for answers. It seems then there is some other problem there.
Listing tokens with p11tool returns an empty list on that computer (while
the other tools show 5 readers). I run the tool like this:

p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll

It provides no output, there. So, it looks like the p11 doesn't see the
token at all (while other tools does). Removing the other token doesn't
help too.

So the other token might be completely unrelated. Do you maybe have any
idea why it happens so?

Best regards,
Marcin Okraszewski


On Thu, Dec 15, 2016 at 4:48 AM, Douglas E Engert <[email protected]>
wrote:

>
>
> On 12/14/2016 2:22 PM, David Woodhouse wrote:
> > On Wed, 2016-12-14 at 20:11 +0100, Marcin Okraszewski wrote:
> >>
> >> I tried various forms of key, like eg:
> >> pkcs11:manufacturer=Yubico;object=SIGN%20key;type=
> private;pin-value=$pin
> >> pkcs11:model=Yubico%20Yubikey%204%20OTP%2BU2F%2BCCID;object=
> SIGN%20key;type=private;pin-value=XXXXX
> >> pkcs11:model=Yubikey%204%20OTP%2BU2F%2BCCID;object=
> SIGN%20key;type=private;pin-value=XXXXX
> >> pkcs11:serial=BB6465375E5505273760A874579A76FB;object=SIGN%20key;type=
> private;pin-value=XXXXX
> >> pkcs11:serial=BB:64:65:37:5E:55:05:27:37:60:A8:74:57:9A:76:
> FB;object=SIGN%20key;type=private;pin-value=XXXXX
> >
> > $ p11tool --list-token-urls | grep piv
> > pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_
> II;serial=108421384210c3f5;token=PIV_II%20%28PIV%20Card%20Holder%20pin%29
> >
> > I usually use 'pkcs11:manufacturer=piv_II;…' as it's easy to type. Not
> > entirely sure why the serial number variant didn't work; perhaps that's
> > not precisely how OpenSC exposes it? Or could it be case sensitive?
>
>
> With regards to the serial number.  NIST 800-73 (PIV) does not define a
> serial number. It defines a set of objects on a card
> and allows for multiple manufactures who may or may not provide a serial
> number or a way to write a serial number.
> So to simulate a serial number the CHUID object is read from the card.
> Offical PIV cards have a CHUID.
> Yubico provides a tool to write a CHUID to their tokens.
> Note: the Microsoft PIV driver requires a CHUID too.
>
> If the CHUID is present and (FASCN has agency code = 9999 or FASCN not
> present)  and the CHUID has a GUID, the GUID 1s used as the serial number
> (16 bytes).
> Otherwise if the FASCN if present it is used as serial number (25 bytes)
> If the CHUID is not present the serial returned is 00000000.
> The above is printed but opensc-tool --serial.
>
> See opensc:
>   src/libopensc/card-piv.c piv_get_serial_nr_from_CHUI
>
> But for PKCS#11 the serial number is 16 bytes or less See:
>   src/pkcs11/framework-pkcs11.c piv_get_serial_nr_from_CHUI  takes the
> last 16 bytes. (The FASCN was 25.)
>
>
> >
> >
> >
> > ------------------------------------------------------------
> ------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> >
> >
> >
> > _______________________________________________
> > Opensc-devel mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/opensc-devel
> >
>
> --
>
>   Douglas E. Engert  <[email protected]>
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Opensc-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel