RE: PKCS#11

Hallo Bob,

always about PKCS#11:

When calling CSM_Pkcs11::CreateInstances, one starts looping over all the 
certificate found on the card, in order to create an instance for each of 
them. Everytime a certificate with the corresponding private key is found, 
CSM_Pkcs11::CreateInstances calls CSM_Pkcs11::SetPin (line 318 of 
sfl\SMIME\alg_libs\sm_pkcs11\sm_pkcs11.cpp). CSM_Pkcs11::SetPin calls 
CSM_Pkcs11::CreateObject, who in turns calls sfl_c_createObject to write a 
new object on the card. This object should be labeled "Data object for Pin" 
(line 534 of sfl\SMIME\alg_libs\sm_pkcs11\sm_pkcs11.cpp).

This means that, for every execution of CSM_Pkcs11::CreateInstances, "n" new 
objects are created on the card (where "n" is the number of private keys). 
Is that normal?

After a few executions of CSM_Pkcs11::CreateInstances, certain private keys 
are not found anymore by CSM_Pkcs11::CreateInstances on the card, and it 
becomes impossible to sign with the card.

Moreover, the objects written on the card are labeled "Data" or "Data..." 
(where ... stands for some strange symbols), instead than "Data object for 
Pin".

Do you have any idea/suggestion about this point?

Thanks,

Marco Scarsi

PS: I am still using SFL Version 1.9. Hence, line numbers refer to that 
version. Are there significant changes in 1.10 concerning sm_pkcs11Free3DLL 
or sm_pkcs11DLL?





>From: "Colestock, Robert" <[email protected]>
>To: 'Marco Scarsi' <[email protected]>, "Colestock, Robert"  
><[email protected]>
>CC: "'[email protected]'" <[email protected]>
>Subject: RE: PKCS#11
>Date: Thu, 17 May 2001 15:40:55 -0400
>MIME-Version: 1.0
>Received: from [206.137.100.2] by hotmail.com (3.2) with ESMTP id 
>MHotMailBCCD7378008640043252CE89640280300; Thu May 17 12:37:32 2001
>Received: by wfhqex05.gfgsi.com with Internet Mail Service (5.5.2653.19)id 
><KZJ94QRH>; Thu, 17 May 2001 15:40:56 -0400
>From [email protected] Thu May 17 12:39:24 2001
>Message-ID: <[email protected]>
>X-Mailer: Internet Mail Service (5.5.2653.19)
>
>Marco:
>
>Glad to hear it.  The certificate file extensions you mention are all 
>binary
>ASN.1 encoded formats I believe; they should be fine.  The extension does
>not matter to the SFL, but it must be a binary ASN.1 encoded format.
>
>If you are using our test utilities for your verification, we report 
>success
>even if the signatures fail; you have to check the output reports very
>carefully to see the message like "SignerInfo number 1 WAS VERIFIED" before
>the test can be considered a success.  If you are using the SFL API 
>classes,
>then you must check the individual SignerInfo classes for the verified flag
>(demonstrated in the client level class, CL_MsgToVerify::Report()).  You
>could also simply breakpoint in your CTIL/lib to check results.
>
>Please be careful to check results; the "sm_pkcs11Free3DLLd" project is
>quite new, and relatively untested (powerful).  Please let me know if you
>have any updates to this specific project/sources to support your project.
>
>Bob Colestock
>VDA.
_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.