RE: PKCS#11

Marco:

You do not need to use the address book at all.  The address book is only
present for alias name lookup of recipient certificates.  For use outside
our UDF test environment, I suggest you simply specify encrypt recipients by
pointing directly to the certificate files, not using the address book
logic.

As to signing, it only uses the address book to get issuer certificates for
DSA, if the params are not present.  If this is the case, you need to load
all issuer certificates into the address book (just some unique alias name,
DN name and a pointer to the file, usually under the "./certs" directory).

For signing from the card, be sure to properly identify the signing SLOT on
your card, that contains a valid signing private key
(CSM_CSInst::SetUseThis() AND CSM_CSInst::SetApplicable()).  Your "" config
file needs a keyword "Login1=" to identify the appropriate signing SLOT on
your card.  Since this is unique to the CTIL, and you are using a new
un-tested PKCS11 (we have had to make modifications to the CTIL in order to
accommodate different PKCS11 libraries, see the readme file(s), yours will
probably not work directly), the ID mechanism may need some work.  Not all
PKCS11 libraries are created equal, none follow the specifications exactly
and the specification is ambiguous in many places (especially when an
application attempts to align certificates with private keys for ID!@#$#$%).
Please read the project readme files in the PKCS11 directories, they may
help debug your PKCS11 library.  As to the IDs we use (All CTILS will accept
the proper DN string, be careful of upper/lower case letters, the other
formats are internal IDs, usually a computer SOCKET and SLOT number):

Login1=mstrpkcs.dll-01-11
Login1=C=US@O=MISSI TEST@OU=MISSI TEST DOD@CN=Test User 1
Login1=pk2priv.dll-00-01   # Login in GemPlus smart Card
Login1=dkck232n.dll-02-01	# Login in DataKey smart Card
Login1=Spex32.dll-02-01	# Login in DataKey smart Card

See the following config files for our examples:

./sm_pkcs11/SignedData/02_SignedGemPlus.cfg
./sm_pkcs11/SignedData/03_SignedDataKey.cfg
./sm_pkcs11/SignedData/01_SignedMaestro.cfg

One final note:  the "sm_pkcs11Free3DLLd" project is quite new, combining
several CTILs, please let me know if you encounter problems, it has been
minimally tested.

Good luck and welcome to the hardest part of this security world.  If you
get too frustrated, we can help, but I will need to get a copy of your
software, the card (properly configured with signer/encyrptor), some
documentation.  If this is a commercial package, we may be able to add it to
our list of supported PKCS11 libraries (no promises on timeliness of our
response, yet).  In any case, we can help.  We have hardware setup and
configured for smart-cards, GemPlus, and PCMCIA which seem to be the most
popular PKCS11 hardware tokens.

Bob Colestock
VDA

-----Original Message-----
From: Marco Scarsi [mailto:[email protected]]
Sent: Wednesday, May 09, 2001 8:14 AM
To: [email protected]
Subject: PKCS#11


Dear all,
I am trying to interface the SFL to a PKCS#11 library via the proper CTIL. 
As a first trial I want to use the auto_hi test program to sign a sample 
text using the private key that is on a cryptocard. Then, I'd like to verify

the signature. In practice, how can I sign a text using the private key on 
my cryptocard? What do I need to do on the address book 
("AddressBook=./certs/mabRecips.dat" in file mylogin.cfg)? How can I create 
a new entry in this file starting from my keys? Do I need to extract the 
private key from the card (format..?) and place it somewhere in the 
certificates' directory?
Below are my configuration scripts
Thanx for help

Marco

***************** myautohi.cfg ************************
[hilevel test]
verify=1
output=1
number_of_runs=1
AddressBook=./certs/mabRecips.dat
Logins=./mylogin.cfg
hi_tests=auto_hi
[auto_hi]
CL_SignMsg::Sign ./hilevel/create/mySignedData.cfg
CL_VerifyMsg::Verify ./hilevel/consume/myVerify.cfg
#

***************** mylogin.cfg ************************
[Logins]
Description=Logins for this execution!
Login1=DLLLoginPKCS11

[DLLLoginPKCS11]
LoginType=DLLLogin
BuildArgs=sm_pkcs11Free3DLLd.dll 0 cryptocard_password ./pkcs11.dll
DLLFile=./sm_pkcs11Free3DLLd
#

***************** mySignedData.cfg ************************
[SignedDataTest]
contentFILE=./hilevel/Create/Datain.d/SignedData.in
contentOID=1.2.3.4.5
EncodedSignDataFILE=./hilevel/Create/mydata/sd
cert_path_issuer=1
MsgCertCrls=CertsSection
PreferredAlgs1=preferredAlgs
[preferredAlgs]
digestOID=1.2.840.113549.2.5
[CertsSection]
CertificateFILE=./certs/signature_cert.cer
Next=NULL
#

***************** myVerify.cfg ************************
[VerifyTest]
EncodedSignDataFILE=./hilevel/Create/mydata/sd
contentFILE=./hilevel/Consume/mydata/content.out
#

_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.