Re: pkinit integration with smart card

[malexander@kcp.com]

I ran the hxtool (thanks for adding
that), but didn't see the results as in Love's output.  I'll give
it the old college try to see if I can debug more with the ActivIdentity
P11 module. 

$ hxtool print --info PKCS11:/usr/local/acgold/lib/libpkcs11.so
hxtool: hx509_certs_init: Failed to get session PKCS11
slot 0

In the output from pkcstool listing
the objects I lots of warnings, and other unknown output:

$ pkcs11-tool --module=/usr/local/acgold/lib/libpkcs11.so
--list-objects
warning: PKCS11 function C_GetAttributeValue(KEY_TYPE)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

Public Key Object; unknown key algorithm 3221222308
warning: PKCS11 function C_GetAttributeValue(LABEL)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

  ID:         01
warning: PKCS11 function C_GetAttributeValue(ENCRYPT)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

warning: PKCS11 function C_GetAttributeValue(VERIFY)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

warning: PKCS11 function C_GetAttributeValue(WRAP)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

  Usage:      encrypt, verify,
wrap
Certificate Object, type = X.509 cert
  label:      Certificate2
  ID:         01
warning: PKCS11 function C_GetAttributeValue(KEY_TYPE)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

Public Key Object; unknown key algorithm 3221222308
warning: PKCS11 function C_GetAttributeValue(LABEL)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

  ID:         00
warning: PKCS11 function C_GetAttributeValue(ENCRYPT)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

warning: PKCS11 function C_GetAttributeValue(VERIFY)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

warning: PKCS11 function C_GetAttributeValue(WRAP)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

  Usage:      encrypt, verify,
wrap
Certificate Object, type = X.509 cert
  label:      Certificate1
  ID:         00
Private Key Object; RSA
warning: PKCS11 function C_GetAttributeValue(LABEL)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

  ID:         01
  Usage:      decrypt, sign, unwrap
Private Key Object; RSA
warning: PKCS11 function C_GetAttributeValue(LABEL)
failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

  ID:         00
  Usage:      decrypt, sign, unwrap

Love Hörnquist Åstrand <lha@kth.se>

09/04/2006 03:34 AM

To	Love Hörnquist Åstrand <lha@kth.se>
cc	malexander@kcp.com, "Douglas E. Engert" <deengert@anl.gov>, heimdal-discuss@sics.se
Subject	Re: pkinit integration with smart card

> 31 aug 2006 kl. 23.12 skrev malexander@kcp.com:
>
>> Thanks for the response.  Complely new to these low level
points  
>> with the Smart Card so I've been looking up some terms, I  
>> appreciate the advice.
>>
>> I looked at the PKCS11-tool output first:
>> pkcs11-tool --module /usr/local/acgold/lib/libpkcs11.so  -M
  
>> Supported mechanisms:
>>   RSA-PKCS, wrap, unwrap, other flags=0x20000
>>   SHA1-RSA-PKCS, sign, verify, wrap, unwrap, encrypt, decrypt,
 
>> keypairgen, other flags=0x2d000
>
> This part is very strange.
>
> The SHA1-RSA-PKCS mechaism can only support sign and verify.
> Either the pkcs11 tool is broken and prints the wrong thing or the
 
> card is pulling your leg.


So if you use hxtool from the snapshot that will be generated tonight  
you can see what heimdal thinks
about the pkcs11 module.

Love

$ hxtool print --info PKCS11:/Users/lha/pkcs11/lib/soft-pkcs11.so
pkcs11 driver with 1 slot
slot 0: id: 1 name: SoftToken (slot) flags: 00000004
number of supported mechanisms: 3
   rsa-x-509(3) flags: (0x00062b01) unwrap, wrap, verify, sign,  
decrypt, encrypt, hw
   rsa-pkcs(1) flags: (0x00062b01) unwrap, wrap, verify, sign,  
decrypt, encrypt, hw
   sha1-rsa-pkcs(6) flags: (0x00002801) verify, sign, hw
cert: 0 (have private key)
     issuer:  "CN=Stockholm University CA,O=Stockholms
universitet,C=SE"
     subject: "UID=lha,CN=Love Hornquist Astrand,O=Stockholm
 
universitet,C=SE"
cert: 1
     issuer:  "CN=SwUPKI Policy CA,2.5.4.11=SwUPKI-PCA,O=Umea
 
University,C=SE"
     subject: "CN=Stockholm University CA,O=Stockholms universitet,C=SE"
cert: 2
     issuer:  "CN=SwUPKI Policy CA,2.5.4.11=SwUPKI-PCA,O=Umea
 
University,C=SE"
     subject: "CN=SwUPKI Policy CA,2.5.4.11=SwUPKI-PCA,O=Umea
 
University,C=SE"