Hot answers tagged

6

Creating a certificate is NOT signing the CSR, or even the CSR body. You need to create a cert body containing data that is partly the same as the CSR and partly different, and sign that. First, do you have a CA cert (root or otherwise) matching the key in your HSM? If not, any cert(s) you do manage to create with that key won't be useful because software ...


5

From your question it looks like you ask for PKI smart cards only, so I will skip other types of smart cards. Some theory first. Computers talk to all smart cards using APDU commands. They are really low level interface and are mostly different for all cards. There are practical and political reasons for this. Practical reason is that every card can have ...


4

- It's a bit old question, but I managed to found a solution that worked for me. There's available on Github a module that provides PKCS#11 backend for TPM 2.0 chips. Usage: Create TPM Key Create a primary key with hash algorithm sha256 and key algorithm rsa and store the object context in a file (po.ctx). tpm2_createprimary -H o -g sha256 -G rsa -C po....


4

Physical storage characteristics are not part of the definition of PKCS#11. PKCS#11 is an API: it defines the behaviour of the library with regards to function calls, not with regards to actual technology. A purely software PKCS#11 library, with all keys in RAM, is perfectly possible (and that's exactly what the Firefox Web browser is using internally). ...


4

FIPS 140-2 does not explicitly forbid key export; what it says is that the module shall prevent unauthorized disclosure; it furthermore states that when a private key is exported from a module, it shall be done with encryption. The important word is "unauthorized": simply encrypting with an AES key is not enough; that key must also be such that it is known ...


4

Some HSM are configurable enough to allow adding functionality within the HSM. However, this will not be doable through PKCS#11, which is an API meant for invocation of cryptographic algorithm on externally provided data. What PKCS#11 offers and is closest to your problem is C_UnwrapKey() that can take as input an encrypted key (key is encrypted with another ...


4

PKCS#1 only defines two "old-style" paddings (aka "v1.5" because these were the two paddings defined in PKCS#1 v1.5, while more modern versions add other options, known as "OAEP" and "PSS"). These two paddings are the "type 1" and "type 2". There is no defined "type 0" padding; of course, any byte can conceptually have any value in the 0 to 255 range, but ...


3

I have not seen a "encrypt random session key with RSA and use it to AES" operation in PKCS#11, so this expected protection does not exist. Or am I missing something? No, there is no such operation in PKCS#11. If you want to do that, you need to construct it from the basic function calls yourself: Generate a symmetric key (on the HSM to use its entropy ...


3

For those looking on how to make use of the OBKG function on some Gemalto smart cards with SSH, I wrote up my experience here I'm sure someone with more knowledge could automate the process (or knows a better way) but mine did work out in the end.


3

(Crosspost of https://crypto.stackexchange.com/questions/33728/uploading-pkcs12-to-yubikey-piv-slot which is offtopic there.) It is theoretically possible to change the public exponent while keeping n as long as the new e is coprime to p-1 and q-1, and for F4 you have a good chance of this. But this is much more work than generating a new keypair, plus it ...


3

I would not use that approach. When you mount a USB drive, read a file from it, etc all sorts of copies of that data could end up in OS memory, logs, etc. You'll be fighting an uphill battle to make this secure, especially if the attacker has the ability to take memory dumps of the server, or plant malware on the server. A better approach would be to use ...


2

An alternative TPM2 PKCS#11 implementation is https://github.com/tpm2-software/tpm2-pkcs11. That's part of the TCG's (Trusted Computing Group's) TSS2 (TPM2 Software Stack), which I believe is intended the be the "official" TPM2 software. As such, I guess "you're supposed to" use this rather than the presumably older tpm2-pk11. In fact, I've seen a ...


2

I think that you're asking how to generate a timestamp response as defined in timestamp-protocol: RFC3161, with openssl to generate and sign the response using a PKCS#11 (HSM in your case) as a TSA signer. I think that there is no native way to use PKCS#11with openssl to do this. (maybe with some plugin like: opensc pkcs11 engine for openssl). If you take ...


2

Smartcards and Openssh The point of the smartcard is that you cannot extract the private key for the keypair generated but that the public key is generally accessible. For *nix you should install opensc (github.com/OpenSC) toools. On ubuntu: $ sudo apt-get install opensc $ sudo apt-get install opensc-pkcs11 Additional packages that you may find useful ...


2

Finally I did it with BouncyCastle library. PKCS#7 is a complex format, also called CMS. Sun JCE has no direct support to PKCS#7. This is the code that I used to extract my content: // Loading the file first File f = new File("myFile.p7b"); byte[] buffer = new byte[(int) f.length()]; DataInputStream in = new DataInputStream(new FileInputStream(f))...


2

I think you are confusing things. In the question you refer to a different problem is addressed: not being able to sign the CSR with the proper private key but still creating a certificate based on this CSR. This is possible since the signature of the CSR is only used to verify that the creator of the CSR has actually access to the private key but the ...


2

The whole point of a smart card is that they private key is protected against extraction. There are ways to create the private key outside of the smart card and then import it into it in which case you have a backup. But in your case the requirement is that the key has to be generated on the card itself which means it can only be used with the card. ... ...


2

One possibility would be to use an encrypted partition or container file using luks/cryptsetup. You can store the decryption key in a file on a thumb drive and configure the location in /etc/crypttab. That way, the encrypted partition can only be mounted while the USB drive is available, but it will stay readable until you manually unmount it, even if you ...


2

First of all, the template you are using in EJBCA is kind of strange. I assume that this template is used to generate a key pair for a Certificate Authority. attributes(*, CKO_PUBLIC_KEY, *) = { CKA_TOKEN = false ==> The public key will be generated on the HSM not be stored in the HSM (lost once the session is closed) CKA_ENCRYPT = true . ==> The ...


1

PKCS11 (and also P1363) formats ECDSA signature by concatenating the two numbers r,s encoded as fixed-size unsigned; for P-256 that size is 32 octets giving signature of 64 octets. PKCS10, like X.509/PKIX, formats ECDSA signature as an ASN.1 SEQUENCE of two INTEGERs; each INTEGER in ASN.1 DER is variable-size signed (technically two's complement, but since ...


1

Am I correct that the file will be taken off of the hardware device to be used? The public key will be exported and used by Veracrypt to authenticate the associated private key (key pair) which remains on your YubiKey, thus granting you access to the encrypted Veracrypt volume. Also there should not be by design any way to export the private key nor to ...


1

Yes, object handles can be used across sessions. Your first citation doesn't say anything about it. Its intention is to clarify that handles to the same (token) object can change between different invocations of an application, but as long as the application is running and a session exists it won't change. The third citation clarifies that a handle casted ...


1

Yes, MODULUS_BITS is the key length. 4096 supposed to be good nowadays. PUBLIC_EXPONENT is public and { 0x01, 0x00, 0x01 } = 65537 is widely used value since: it's prime it's not too short it's not too long and contains only two '1' in it's binary representation - that makes binary exponentiation fast (you can encrypt or check signature quicker) ...


1

PKCS (Public-Key Cryptography Standards) is a set of standards by RSA Security. It has many standards and each of those defining set of protocols, here are some of them: RSA private and public keys for encryption, decryption, signing, and signature verification Protocol for a shared key exchange over an insecure channel Certificate request, extensions, etc ...


1

The difference between generating a KeyPair with CKA_TOKEN set as true and false is that when it is set to true, the KeyPair that is generated by the hardware token is persisted (it exists on the token even after you logout of the session). If it is set to false, it is still generated on the hardware and not outside the token, it is just not persisted (it ...


1

In many cases, this problem is solved by having the HSM ask for PIN only at Power-up. Thus a human operator must type the PIN to unlock the HSM. If the server is rebooted, or the HSM module is physically stolen, it will require the PIN again to unlock. The server can also be configured to automatically reboot when a compromise is detected, for example by the ...


1

I'm rather rusty on my Smartcard stuff but I'll have a crack at an answer anyway. Smartcards are small embedded computers in their own right and so they do indeed use a very simplified OS. The 2 you mention are the standard ones. They all have some standard capabilities that are not especially dependent on the OS. The ability to present a certificate, ...


Only top voted, non community-wiki answers of a minimum length are eligible