Re: Cannot perform signing when multiple keys are present

Hi Douglas,
Thank you for explanation. So, what I understand here, if only there is
connection to the reader, I should be able to use the token from OpenSSL
via libp11. The token is visible, as I'm able to initialize it, generate
key, import certificate via Yubico's piv-tool. But I'm not able even to
list tokens with p11tool. Note, I don't specify any configuration. I just
install OpenSC and run "gnutls-3.4.9\bin\p11tool.exe --provider
c:\Windows\System32\opensc-pkcs11.dll  --list-tokens". I run it as
administrator.

When it comes to Device Manager, the card is not being recognized even if I
regenerate CHUID, unplug and plug token again or even reboot Windows (2012
R2). The CHUID is being set and I can see the value being changed by status
action.

Thanks,
Marcin

On Fri, Dec 16, 2016 at 5:19 PM, Douglas E Engert <[email protected]>
wrote:

>
>
> On 12/16/2016 8:54 AM, Marcin Okraszewski wrote:
>
>> I think I have the root cause, which lies completely elsewhere.
>> Apparently Yubikey driver doesn't install properly on this machine.
>> Normally you Yubikey is visible in Device Manager under Smart cards
>> section as "Identity Device (NIST SP 800-73 [PIV])".
>> On that machine I see "Unknown Smart Card" (see attached screenshots). I
>> don't know yet why is it so, but this is out of scope for this group I
>> guess.
>>
>
> Microsoft has its own PIV smart card driver used with its CAPI and
> minidrivers.
> Google for: microsoft PIV and for:microsoft minidriver
>
> So for PIV cards at least, unless you need PKCS#11 you don't need third
> party software.
> What I think you are seeing in device manager is the fact the Microsoft
> recognizes its a PIV card.
> But the Microsoft code requires a CHUID on the card to recognize it as a
> PIV. The NIST 800-73 says the CHUID is a mandatory.
> Yubico may or may not provide their own driver, but as I understand it,
> the reason for Yubico to present a PIV
> interface is to not require additional software.
>
> OpenSC and other vendors provide software that interfaces with smart cards
> at the PCSC level just like on the Linux.
> so all that is needed is access the readers.
> OpenSC and other vendors also provides a minidriver that can access any
> smartcard OpenSC supports, so one can get
> CAPI access to card. But this also requires registry changes to list the
> ATRs of the cards supported.
>
>
> Sorry, I was so mislead with the fact there are two tokens and that other
>> tools does see Yubikey that I didn't even thought of checking it. Only the
>> empty list from p11tool and together with
>> Douglas pointing other tools are not use PKCS#11 module triggered finally
>> the thought check it.
>>
>> For completeness, here is the debug output from p11tool:
>>
>> \gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll
>>> --list-tokens
>>>
>> (p11-kit:2992) p11_library_init: initializing library
>> (p11-kit:2992) p11_kit_module_load: in: c:\Windows\System32\opensc-pkc
>> s11.dll
>> (p11-kit:2992) load_module_from_file_inlock: loading module from path:
>> c:\Windows\System32\opensc-pkcs11.dll
>> (p11-kit:2992) dlopen_and_get_function_list: opened module:
>> c:\Windows\System32\opensc-pkcs11.dll
>> (p11-kit:2992) p11_kit_module_load: out: success
>> (p11-kit:2992) p11_kit_module_release: in
>> (p11-kit:2992) p11_kit_module_release: out
>> (p11-kit:2992) uninit_common: uninitializing library
>>
>> Thank you,
>> Marcin Okraszewski
>>
>>
>> On Thu, Dec 15, 2016 at 9:08 PM, David Woodhouse <[email protected]
>> <mailto:[email protected]>> wrote:
>>
>>     On Thu, 2016-12-15 at 19:18 +0100, Marcin Okraszewski wrote:
>>     >
>>     > It provides no output, there. So, it looks like the p11 doesn't see
>>     > the token at all (while other tools does). Removing the other token
>>     > doesn't help too.
>>
>>     Sounds like your PKCS#11 provider module is installed without a
>>     corresponding p11-kit .module file to let applications know where to
>>     find it automatically.
>>
>>     That is unfortunately the case even on poorly-maintained Linux
>>     distributions; it's not surprising that it's the case on Windows.
>>     You'll probably have to make the .module file manually.
>>
>>     https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html <
>> https://p11-glue.freedesktop.org/doc/p11-kit/pkcs11-conf.html>
>>     --
>>     dwmw2
>>
>>
>>
> --
>
>  Douglas E. Engert  <[email protected]>
>
>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel