6
votes
Accepted
Do PKCS #11 keyfiles on a yubikey actually improve security for Veracrypt?
This question is indeed a very good one. I'm no expert but since nobody is jumping in (I guess because questions that already have at least one answer are less attractive).
An old answer to this ...
- 196
6
votes
TPM 2.0 PKCS#11 on Windows and Linux
- It's a bit old question, but I managed to found a solution that worked for me.
There's available on Github a module that provides PKCS#11 backend for TPM 2.0 chips.
Usage:
Create TPM Key
Create ...
- 572
6
votes
Accepted
How can I use my HSM to turn a CSR into a certificate?
Creating a certificate is NOT signing the CSR, or even the CSR body. You need to create a cert body containing data that is partly the same as the CSR and partly different, and sign that.
First, do ...
- 10.6k
5
votes
Accepted
What is the state of smart card/computer interoperability
From your question it looks like you ask for PKI smart cards only, so I will skip other types of smart cards.
Some theory first. Computers talk to all smart cards using APDU commands. They are really ...
- 121
5
votes
Key based encryption for files with the key stored on a USB drive?
I would not use that approach. When you mount a USB drive, read a file from it, etc all sorts of copies of that data could end up in OS memory, logs, etc. You'll be fighting an uphill battle to make ...
- 58.8k
4
votes
Accepted
PKCS#11 session object security
Physical storage characteristics are not part of the definition of PKCS#11. PKCS#11 is an API: it defines the behaviour of the library with regards to function calls, not with regards to actual ...
- 325k
4
votes
RSA insensitive and extractable private key export from SoftHSM 2
First of all, the template you are using in EJBCA is kind of strange. I assume that this template is used to generate a key pair for a Certificate Authority.
attributes(*, CKO_PUBLIC_KEY, *) = {
...
3
votes
When generating PKI key pair with a smart card, who decides if the key is exportable?
The whole point of a smart card is that they private key is protected against extraction. There are ways to create the private key outside of the smart card and then import it into it in which case ...
- 198k
3
votes
Offloading hashing and symmetric encryption to HSM
I have not seen a "encrypt random session key with RSA and use it to AES" operation in PKCS#11, so this expected protection does not
exist. Or am I missing something?
No, there is no such operation ...
- 1,272
3
votes
TPM 2.0 PKCS#11 on Windows and Linux
An alternative TPM2 PKCS#11 implementation is https://github.com/tpm2-software/tpm2-pkcs11. That's part of the TCG's (Trusted Computing Group's) TSS2 (TPM2 Software Stack), which I believe is intended ...
- 246
3
votes
OBKG on smartcard with PKCS#11
For those looking on how to make use of the OBKG function on some Gemalto smart cards with SSH, I wrote up my experience here I'm sure someone with more knowledge could automate the process (or ...
- 261
3
votes
uploading pkcs12 to yubikey piv slot
(Crosspost of https://crypto.stackexchange.com/questions/33728/uploading-pkcs12-to-yubikey-piv-slot which is offtopic there.) It is theoretically possible to change the public exponent while keeping n ...
- 10.6k
2
votes
Use HSPD-12 (PIV) Keys for SSH
Smartcards and Openssh
The point of the smartcard is that you cannot extract the private key for the keypair generated but that the public key is generally accessible.
For *nix you should install ...
- 211
2
votes
Key based encryption for files with the key stored on a USB drive?
One possibility would be to use an encrypted partition or container file using luks/cryptsetup. You can store the decryption key in a file on a thumb drive and configure the location in /etc/crypttab. ...
- 1,272
2
votes
pkcs11 with remote HSM
As you correctly state the PKCS#11 standard defines an API called Cryptoki. OpenSSL allows to use an engine that connects to a DLL/SO implementing this API ("Cryptoki library"). It's the ...
- 41
2
votes
Why does it take so much time to create a secret key on a HSM?
One reason can be that the random generator is waiting for sufficient entropy.
- 12.2k
2
votes
Accepted
SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication
Findings:
I found documentation from another company/vendor on these devices which indicate the x840 based cards (like the 5110 CC) and x940 based cards (like the 5110+ CC) do not support on-board ...
- 36
2
votes
Create certificate without private key or using USB eToken
I think you are confusing things. In the question you refer to a different problem is addressed: not being able to sign the CSR with the proper private key but still creating a certificate based on ...
- 198k
1
vote
How to create, use and backup android signing keys without trusting the computer?
No, and frankly the question is nonsense in my opinion.
If you don't trust the computer, you can't trust what you sign. You could be signing malware.
Set up a computer you trust. You will need it ...
- 15.4k
1
vote
Is Binance API Key part of RSA key pair?
This answer pertains not only to this question, but also to your earlier question at Using two different random numbers instead of RSA Keys.
The api key and the secret key are not an asymmetric key ...
- 22.7k
1
vote
Accepted
How do I get my server HSM working while connected via RDP? (Win 2019)
For now, I use an alternative solution to logging into the server. TeamViewer, AnyDesk, VNC, an IP KVM, or using your server's BMC will circumvent the problem.
Robert commented to my question and it ...
- 403
1
vote
pkcs11 with remote HSM
I installed and configured the pkcs11 forwarding mechanism cited ion the link in the initial answer. It works as expected. A couple of minor issues with packages and versions that contained the ...
- 41
1
vote
Signing CSR using an ECC keypair
PKCS11 (and also P1363) formats ECDSA signature by concatenating the two numbers r,s encoded as fixed-size unsigned; for P-256 that size is 32 octets giving signature of 64 octets.
PKCS10, like X.509/...
- 10.6k
1
vote
Accepted
RSA insensitive and extractable private key export from SoftHSM 2
I've managed to do it by using python-pkcs11 and asn1crypto
First, I've implemented a function that encode an RSA private key into PKCS#1 DER-encoded format, it gets the attributes (PRIVATE_EXPONENT, ...
- 213
1
vote
Can PKCS #11 object handles be used across sessions?
Yes, object handles can be used across sessions.
Your first citation doesn't say anything about it. Its intention is to clarify that handles to the same (token) object can change between different ...
- 41
1
vote
PKCS11 key pair generation - attributes MODULUS_BITS and PUBLIC_EXPONENT
Yes, MODULUS_BITS is the key length. 4096 supposed to be good nowadays.
PUBLIC_EXPONENT is public and { 0x01, 0x00, 0x01 } = 65537 is widely used value since:
it's prime
it's not too short
it's not ...
- 86
1
vote
Why is PKCS used?
PKCS (Public-Key Cryptography Standards) is a set of standards by RSA Security.
It has many standards and each of those defining set of protocols, here are some of them:
RSA private and public keys ...
- 541
1
vote
Extract smartcard certificate for server to server authentication
You are missing the point of how SSLVerifyClient (and SSLVerifyDepth) works.
What these 2 configurations does is to trigger TLS Client Authentication, which requests for a public certificate and ...
- 448
Only top scored, non community-wiki answers of a minimum length are eligible