Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pkcs11]

The tag has no usage guidance.

1
vote
1answer
39 views

Can PKCS #11 object handles be used across sessions?

The PKCS #11 2.40 spec is a little ambiguous in its description of whether an object handle retrieved using session A can be used in session B to the same token. The main spec states (all emphasis ...
0
votes
0answers
10 views

Import PKCS11 public key in BouncyCastle [migrated]

I'm using a HSM to generate a pair of public/private elliptic key using PKCS11 commands, but I need to use the public key in BouncyCastle. I can read the attribute EC_POINT in DER format, but I can ...
0
votes
0answers
15 views

Convert python-pkcs11.types.PrivateKey to PrivateKeyInfo or PrivateKey

I'm building a CertificateListBuilder but it requires the python-pkcs11.types.PrivateKey to be an instance of asn1crypto.keys.PrivateKeyInfo or oscrypto.asymmetric.PrivateKey. How to do it? Is it ...
0
votes
1answer
29 views

PKCS11 key pair generation - attributes MODULUS_BITS and PUBLIC_EXPONENT

We're using a rather low-level PKCS#11 interface and are trying to generate a key-pair for RSA with it. We're using the mechanism RSA_PKCS_KEY_PAIR_GEN (0x00). Among others we have copied the ...
0
votes
1answer
240 views

Why is PKCS used? [closed]

Can anybody help me in understanding why PKCS is used? My confusion is that whether PKCS is used to transfer key in between client and server OR it is a standard to encrypt and decrypt the payload. I ...
3
votes
1answer
394 views

Create certificate without private key or using USB eToken

Considering this thread: Create certificate without private key with OpenSSL I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's ...
1
vote
1answer
193 views

When generating PKI key pair with a smart card, who decides if the key is exportable?

I'm in the process of obtaining a code signing certificate from a CA that requires the use of a smart card for the generation of the PKI key pair. However, I would like to be in the possession of the ...
2
votes
1answer
425 views

Offloading hashing and symmetric encryption to HSM

When using a (PKCS#11) based HSM (for S/Mime or PGP) the public key operations for signing or decryption is done by the HSM so that the key has to never leave the protected environment. The bulk part ...
0
votes
2answers
469 views

Extract smartcard certificate for server to server authentication

I want to get data from a server that accept only client authentication via smartcard and save them to my server. Since they are a lot of data, I want to create a connection between my server and this ...
4
votes
2answers
547 views

Key based encryption for files with the key stored on a USB drive?

We're a small startup running a server inside the clients premises and certain files needs to be kept encrypted on that server. We want the decryption to be only possible when we plug in a particular ...
1
vote
1answer
233 views

Yubikey for signing efi images, could not find token

I am trying to sign an efi image with a Yubikey 4 I configured Yubikey with the following: yubico-piv-tool -k $key -a import-key -s 9c < test-key.rsa yubico-piv-tool -k $key -a import-certificate ...
1
vote
0answers
697 views

Is it possible to use Bouncy Castle crypto library with PKCS#11 HSMs?

Is it possible to use Bouncy Castle crypto library with PKCS #11 HSMs?
6
votes
1answer
640 views

TPM 2.0 PKCS#11 on Windows and Linux

The new Skylake processors have integrated TPM 2.0 inside. Is there any way how to use the TPM 2.0 as a PKCS#11 token on Windows and Linux for symmetric and asymmetric keys? TPM 1.2 has a PKCS#11 ...
4
votes
1answer
1k views

PKCS#11 session object security

The CKA_TOKEN attribute identifies whether the object is a token object or a session object. We can believe that when the PKCS#11 object has CKA_TOKEN attribute set to true, then it is securely ...
5
votes
1answer
2k views

uploading pkcs12 to yubikey piv slot

i have a id_rsa (private key which is used by me to authentication and encryption together with cert on yubikey piv smardcart provider on slot 9a) now i wish to use this key to create a pkcs12 ...
1
vote
1answer
631 views

Use HSPD-12 (PIV) Keys for SSH

Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?
3
votes
1answer
1k views

What is the state of smart card/computer interoperability

Smart cards are the only really secure device that can be used for, among other things, electronic identification. However, there are usability concerns stemming from the lack of standartization. ...
4
votes
1answer
3k views

How can I use my HSM to turn a CSR into a certificate?

I create a CSR using OpenSSL, so I have public and private keys. Now I want to sign this CSR and convert it into an X.509 certificate. The only problem is, my signer is a custom HSM. I can send bytes ...
3
votes
1answer
839 views

Key derivation inside secure container of HSM

I have to implement custom key derivation function which basically works as follows: I have encryption key K in secure container of HSM. K can't be exported and the only way how to use it is through ...
3
votes
1answer
12k views

Extract the content of PKCS7 file in Java

I have a PKCS#7 signature that have the content‐type signed data and it embeds an XML document, and I have to extract the xml document from this PKCS7 file. Anyone know how to do that in java ??
2
votes
2answers
2k views

PKCS#1-1.5 encoding - is there a reason to use 00 in block type?

For encryption block looking like this: EB = 00 || BT || PS || 00 || Data where BT - block type and PS - padding string, I've read that we use three types of BT - 00, 01, 02. Now, since 00 and 01 are ...
3
votes
1answer
589 views

OBKG on smartcard with PKCS#11

I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
2
votes
3answers
4k views

Is it possible to wrap and export RSA private key in FIPS 140-2 Level 3 compliant hardware?

I would like to do the following on FIPS 140-3 Level 3 certified cryptographic token using PKCS#11: Generate RSA key pair on token Import AES key from multiple components Wrap and export RSA private ...
0
votes
1answer
465 views

PCI compliant RSA key generation and getting value of private exponent

Is it possible to generate RSA key and get its private exponent in clear and to be compliant with the following PCI requirement?: Keys must be generated so that it is not feasible to determine that ...
1
vote
1answer
202 views

Safenet iKey 4000 RSA key pair generation in FIPS 140-2 compliant mode

I need to generate RSA key pair and show the public and private key on screen (in a secured room). The algorithm must be FIPS approved. So I would like to use iKey 4000 which is FIPS 140-2 level 3 ...
1
vote
0answers
305 views

Through signing process with HSM Luna, What device perform the signing?

I'v succesfully configure and test character String signin usign Java and HSM Luna SA through PKCS11. My question is, In wich processor cryptographic operations are perform? In wich way HSM Luna ...
0
votes
1answer
826 views

PKCS11 PIN security

Hardware security modules are tamper-resistant and PKCS11 PIN is required to use keys. if a software application wants to perform some cryptographic functions, it should know the PIN. but the ...
3
votes
1answer
481 views

Smartcard - main differences between .NET and Java smartcard?

My question focuses on the differences regarding PKCS11 implementation between a .Net and a Java smartcard. More generally, do smartcard use a specific "OS" (or firmware) and only differ in the ...
1
vote
1answer
818 views

OpenTSA and PKCS11

We are planning to implement the time-stamping service (RFC 3161) using OpenTSA and we wanted to know: Does OpenTSA support PKCS #11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or ...