Re: Cannot perform signing when multiple keys are present

On 12/16/2016 8:54 AM, Marcin Okraszewski wrote:
> I think I have the root cause, which lies completely elsewhere. Apparently Yubikey driver doesn't install properly on this machine. Normally you Yubikey is visible in Device Manager under Smart cards
> section as "Identity Device (NIST SP 800-73 [PIV])".
> On that machine I see "Unknown Smart Card" (see attached screenshots). I don't know yet why is it so, but this is out of scope for this group I
> guess.

Microsoft has its own PIV smart card driver used with its CAPI and minidrivers.
Google for: microsoft PIV and for:microsoft minidriver

So for PIV cards at least, unless you need PKCS#11 you don't need third party software.
What I think you are seeing in device manager is the fact the Microsoft recognizes its a PIV card.
But the Microsoft code requires a CHUID on the card to recognize it as a PIV. The NIST 800-73 says the CHUID is a mandatory.
Yubico may or may not provide their own driver, but as I understand it, the reason for Yubico to present a PIV
interface is to not require additional software.

OpenSC and other vendors provide software that interfaces with smart cards at the PCSC level just like on the Linux.
so all that is needed is access the readers.
OpenSC and other vendors also provides a minidriver that can access any smartcard OpenSC supports, so one can get
CAPI access to card. But this also requires registry changes to list the ATRs of the cards supported.


> Sorry, I was so mislead with the fact there are two tokens and that other tools does see Yubikey that I didn't even thought of checking it. Only the empty list from p11tool and together with
> Douglas pointing other tools are not use PKCS#11 module triggered finally the thought check it.
>
> For completeness, here is the debug output from p11tool:
>
>>\gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll  --list-tokens
> (p11-kit:2992) p11_library_init: initializing library
> (p11-kit:2992) p11_kit_module_load: in: c:\Windows\System32\opensc-pkcs11.dll
> (p11-kit:2992) load_module_from_file_inlock: loading module from path: c:\Windows\System32\opensc-pkcs11.dll
> (p11-kit:2992) dlopen_and_get_function_list: opened module: c:\Windows\System32\opensc-pkcs11.dll
> (p11-kit:2992) p11_kit_module_load: out: success
> (p11-kit:2992) p11_kit_module_release: in
> (p11-kit:2992) p11_kit_module_release: out
> (p11-kit:2992) uninit_common: uninitializing library
>
> Thank you,
> Marcin Okraszewski
>
>
> On Thu, Dec 15, 2016 at 9:08 PM, David Woodhouse <[email protected] <mailto:[email protected]>> wrote:
>
>     On Thu, 2016-12-15 at 19:18 +0100, Marcin Okraszewski wrote:
>     >
>     > It provides no output, there. So, it looks like the p11 doesn't see
>     > the token at all (while other tools does). Removing the other token
>     > doesn't help too.
>
>     Sounds like your PKCS#11 provider module is installed without a
>     corresponding p11-kit .module file to let applications know where to
>     find it automatically.
>
>     That is unfortunately the case even on poorly-maintained Linux
>     distributions; it's not surprising that it's the case on Windows.
>     You'll probably have to make the .module file manually.
>
>     https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html <https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html>
>     --
>     dwmw2
>
>

-- 

  Douglas E. Engert  <[email protected]>


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot