Help needed in finding the correct object in token
Muziket via Opensc-devel <[email protected]> Thu, 9 Sep 2021 12:20:57 +0000 (UTC)
| Newsgroups | gmane.comp.encryption.opensc.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============0502425741254096234== Content-Type: multipart/alternative; boundary="----=_Part_3375802_57959570.1631190057929" Content-Length: 5508 ------=_Part_3375802_57959570.1631190057929 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, I've been fiddling the codes of pkcs11-tool to understand opensc pkcs11 mod= ule. I installed a RSA and ECC key onto my token. My ECC key is identified with = ID: 03 and using pkcs11-tool.exe:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0pkcs11-tool.= exe -l -derive --input-file my_ecc_ephemeral_pubkey.der -d 03And I could ge= t my token to derive a shared secret. I then tried to write a sample application by reusing some of the snippets = in pkcs11-tool.c with the opensc-libpkcs11.dll.It replied:=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0C_DeriveKey failed: rv =3D CKR_FUNCTION_NOT_SUPPORTED (0x54) I dived into the logs produced by pkcs11-spy and noticed that the CKA_ID is= different from when I used the pkcs11-tool.exe:=C2=A0=C2=A0=C2=A0=C2=A044:= C_FindObjectsInit=C2=A0=C2=A0=C2=A0=C2=A02021-09-09 19:57:08.162=C2=A0=C2= =A0=C2=A0=C2=A0[in] hSession =3D 0x12c7bf0=C2=A0=C2=A0=C2=A0=C2=A0[in] pTem= plate[2]:=C2=A0=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0CKA_CLASS=C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0CKO_PRIVATE_KEY=C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0CKA_ID=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 00000000004a6080 / 1=C2=A0 =C2=A0 =C2=A0=C2=A0= =C2=A0=C2=A000000000=C2=A0 03=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Returned:=C2=A0 0 CK= R_OK In my sample application, instead of using getopt, I chose to hardcode the = id to opt_object_id[0], which essentially, gives the same value as when pkc= s11-tool.exe was used by looking at the pkcs11-tool.c codes.Hence, I'm not = sure what translations are required to identify the correct ECC object for = the shared secret derivation. Any insight is appreciated. Thank you.Muziket ------=_Part_3375802_57959570.1631190057929 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div class=3D"yahoo-style-wrap" style=3D"font-fami= ly:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir= =3D"ltr" data-setdir=3D"false">Hi,</div><div dir=3D"ltr" data-setdir=3D"fal= se"><br></div><div dir=3D"ltr" data-setdir=3D"false">I've been fiddling the= codes of pkcs11-tool to understand opensc pkcs11 module.</div><div dir=3D"= ltr" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=3D"false"= >I installed a RSA and ECC key onto my token. My ECC key is identified with= ID: 03 and using pkcs11-tool.exe:</div><div dir=3D"ltr" data-setdir=3D"fal= se"> pkcs11-tool.exe -l -derive --input-file m= y_ecc_ephemeral_pubkey.der -d 03</div><div dir=3D"ltr" data-setdir=3D"false= ">And I could get my token to derive a shared secret.</div><div dir=3D"ltr"= data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=3D"false">I t= hen tried to write a sample application by reusing some of the snippets in = pkcs11-tool.c with the opensc-libpkcs11.dll.</div><div dir=3D"ltr" data-set= dir=3D"false">It replied:</div><div dir=3D"ltr" data-setdir=3D"false"><span= > C_DeriveKey failed: rv =3D CKR_FUNCTION_NOT_= SUPPORTED (0x54)</span><br></div><div dir=3D"ltr" data-setdir=3D"false"><sp= an><br></span></div><div dir=3D"ltr" data-setdir=3D"false"><span>I dived in= to the logs produced by pkcs11-spy and noticed that the CKA_ID is different= from when I used the pkcs11-tool.exe:</span></div><div dir=3D"ltr" data-se= tdir=3D"false"><div><div> 44: C_FindObjectsInit</div= ><div> 2021-09-09 19:57:08.162</div><div>  = ; [in] hSession =3D 0x12c7bf0</div><div> = [in] pTemplate[2]: </div><div> CK= A_CLASS CKO_PRIVATE_KEY = ; </div><div> CKA_I= D <b>00000000004a608= 0 </b>/ 1</div><div> 00000000 03=  = ; &nb= sp; . </= div><div> Returned: 0 CKR_OK</div></div><div><= br></div></div><div dir=3D"ltr" data-setdir=3D"false">In my sample applicat= ion, instead of using getopt, I chose to hardcode the id to opt_object_id[0= ], which essentially, gives the same value as when pkcs11-tool.exe was used= by looking at the pkcs11-tool.c codes.</div><div dir=3D"ltr" data-setdir= =3D"false">Hence, I'm not sure what translations are required to identify t= he correct ECC object for the shared secret derivation.</div><div dir=3D"lt= r" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=3D"false">A= ny insight is appreciated.</div><div dir=3D"ltr" data-setdir=3D"false"><br>= </div><div dir=3D"ltr" data-setdir=3D"false">Thank you.</div><div dir=3D"lt= r" data-setdir=3D"false">Muziket</div><div dir=3D"ltr" data-setdir=3D"false= "><br></div><div dir=3D"ltr" data-setdir=3D"false"><br></div></div></body><= /html> ------=_Part_3375802_57959570.1631190057929-- --===============0502425741254096234== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0502425741254096234== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Opensc-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/opensc-devel --===============0502425741254096234==--