Re: Cannot perform signing when multiple keys are present

Your thank you note is more then enough. Glad I could help.


On 12/20/2016 3:25 PM, Marcin Okraszewski wrote:
> Douglas,
> That was it!!! I just uncommented the line "max_virtual_slots = 32;" and it works as charm!!! Everything - signing with openssl, listing tokens & objects by p11tool, the  pkcs11-tool -O -l. Everything
> just works! Christmas is coming!
>
> I would have never found it myself. I really don't know how to thank you! Any wish? Of course, beer when you come to Gdansk/Poland is on me.
>
> Thank you!
> Marcin Okraszewski
>
>
> On Tue, Dec 20, 2016 at 8:44 PM, Douglas E Engert <[email protected] <mailto:[email protected]>> wrote:
>
>     The debug trace shows you have reach the default limits on readers and slots.
>     You have all those drivers that define their own readers which most people don't have.
>     I should have spotted that earlier.
>
>     opensc.conf has default limits on how many readers and slots per reader.
>     I think you have reached the limits, try changing them.
>
>     see the opensc.conf file in app opensc-pkcs11 section.
>
>      # (max_virtual_slots/slots_per_card) limits the number of readers
>      # that can be used on the system. Default is then 16/4=4 readers.
>
>     The libopensc can see the readers but the pkcs#11 can not see the slots.
>
>
>     On 12/20/2016 8:08 AM, Marcin Okraszewski wrote:
>
>         Hi Douglas,
>         Thank you for your patience. I've tried with another Yubikey and now it shows proper name in Device Manager, but the problem persists, so it is not the root cause :( Further answers inline.
>
>                 But I'm not able even to list tokens with p11tool. Note, I don't specify any configuration. I just install OpenSC and run
>                 "gnutls-3.4.9\bin\p11tool.exe --provider c:\Windows\System32\opensc-pkcs11.dll  --list-tokens". I run it as administrator.
>
>
>             I can not speak to how p11tool should work.
>             Is there some 32 bit opensc-pkcs11.dll with 64 bit p11tool?
>             You are running in a cmd window?
>
>
>         I install everything in 64bit version. I first install OpenSC 0.16. The p11tool was mentioned here by David, as well as libp11 wiki
>         (https://github.com/OpenSC/libp11#using-the-engine-from-the-command-line-tool <https://github.com/OpenSC/libp11#using-the-engine-from-the-command-line-tool>
>         <https://github.com/OpenSC/libp11#using-the-engine-from-the-command-line-tool <https://github.com/OpenSC/libp11#using-the-engine-from-the-command-line-tool>>).
>
>         Should I switch to 32bit?
>
>
>             What does the OpenSC pkcs11-tool.exe -O -l show?
>
>
>         C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool.exe -O -l
>         No slot with a token was found.
>
>         Output with OPENSC_DEBUG=9 is available here: http://pastebin.com/3D9qfgDp
>
>         The output of the PKCS11-Spy available here: http://pastebin.com/hJpyyhNG . From what I see, it doesn't see the Yubikey in the PKCS11 Spy output, while it is visible in debug output of the
>         same command.
>
>
>                 When it comes to Device Manager, the card is not being recognized even if I regenerate CHUID, unplug and plug token again or even reboot Windows (2012 R2). The CHUID is being set and I
>         can see the
>                 value being changed by status action.
>
>
>             When you regenerated the CHUID, did it tell you what it did?
>             There was a bug in in how Yubico created a CHUID It was fixed in 2014. Are you using an old version?
>             https://github.com/Yubico/yubico-piv-tool/issues/9 <https://github.com/Yubico/yubico-piv-tool/issues/9> <https://github.com/Yubico/yubico-piv-tool/issues/9
>         <https://github.com/Yubico/yubico-piv-tool/issues/9>>
>
>             I believe there is a verbose option for yubico-piv-tool to list the chuid, or list it while it is created.
>
>
>         I'm using latest version, 1.4.2 from August 12, 2016.
>
>         "yubico-piv-tool.exe -a set-chuid" returns "Successfully set new CHUID."
>
>         Verbose output from set-chuid and status available here: http://pastebin.com/x8gTtm43
>
>         I have also found error entries in System Event log. It appears for all readers (not only Yubikey) every time I use those PKCS#11 tools:
>
>         Log Name:      System
>
>         Source:        Microsoft-Windows-Smartcard-Server
>
>         Date:          19.12.2016 14:57:48
>
>         Description:
>
>         Smart Card Reader 'Yubico Yubikey 4 OTP+U2F+CCID 0' rejected IOCTL 0x313520: Incorrect function.  If this error persists, your smart card or reader may not be functioning correctly.
>
>
>         Does it give any clue? I'm frankly completely lost!
>
>         Thank you!
>         Marcin Okraszewski
>
>
>
>
>     --
>
>      Douglas E. Engert  <[email protected] <mailto:[email protected]>>
>
>

-- 

  Douglas E. Engert  <[email protected]>


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/intel