{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/libp11/issues/160","repository_url":"https://api.github.com/repos/OpenSC/libp11","labels_url":"https://api.github.com/repos/OpenSC/libp11/issues/160/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/libp11/issues/160/comments","events_url":"https://api.github.com/repos/OpenSC/libp11/issues/160/events","html_url":"https://github.com/OpenSC/libp11/issues/160","id":229177756,"number":160,"title":"Issue with CKU_CONTEXT_SPECIFIC on Safenet HSM module","user":{"login":"mirozitnansky","id":22233613,"avatar_url":"https://avatars1.githubusercontent.com/u/22233613?v=3","gravatar_id":"","url":"https://api.github.com/users/mirozitnansky","html_url":"https://github.com/mirozitnansky","followers_url":"https://api.github.com/users/mirozitnansky/followers","following_url":"https://api.github.com/users/mirozitnansky/following{/other_user}","gists_url":"https://api.github.com/users/mirozitnansky/gists{/gist_id}","starred_url":"https://api.github.com/users/mirozitnansky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mirozitnansky/subscriptions","organizations_url":"https://api.github.com/users/mirozitnansky/orgs","repos_url":"https://api.github.com/users/mirozitnansky/repos","events_url":"https://api.github.com/users/mirozitnansky/events{/privacy}","received_events_url":"https://api.github.com/users/mirozitnansky/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":23,"created_at":"2017-05-16T21:42:49Z","updated_at":"2017-05-23T08:00:56Z","closed_at":null,"body":"First of all, you are doing great job guys, many thanks for time and energy you are putting into this project.\r\n\r\nI am pretty noob with pkcs11 stuff, so please have patience with me.\r\nI spent quite some time trying to implement OpenSSL certification authority based on [Sefenet HSM module](https://safenet.gemalto.com/data-encryption/hardware-security-modules-hsms/protectserver-security-module/) which should store CA private keys. CA key is than used for singing client/server certificates.\r\nUsing libp11 as OpenSSL engine, configured with pkcs11 lib supplied with HSM, I was able to make OpenSSL work correctly... on some conditions.\r\nOur HSM can work in few modes. Safenet's default (we are currently using this mode), FIPS-140 and others.\r\nWe are planning to switch our device from current, default mode, into FIPS-140 mode. This means, among other things, device will be switched to _No Public Crypto_ mode – user have to be always logged into token, if he is going to use key for crypto operation. \r\nIn current mode, there no need to be logged in token to do the sign operation in OpenSSL.\r\nOn the other hand, object in token can be public or private (I am not reffering to RSA pulic/private key). Private objects are only accessible after loggin in. \r\n\r\nFirst problem I encountered lied on having private object while disabled _No Public Crypto_ flag. Then even if I try to set pin for token, engine won’t log in and simply says there is no such object (because it was set private).\r\n\r\nI have pkcs11 communication logged so [pc_private_list.txt](https://github.com/OpenSC/libp11/files/1005857/pc_private_list.txt) is list using safenet utility.\r\n\r\n```\r\n[root@mzcentos ~]# ctkmu l -s 0\r\nProtectToolkit C Key Management Utility 5.2.0\r\nCopyright (c) Safenet, Inc. 2009-2016\r\n\r\nlogger: s_ctData->ft = 0x0x1dd5360\r\nlogger: s_ctData->ft->C_Initialize = 0x0x7f97d9acae20\r\nDo you wish to view private (user) objects [y/N]: y\r\n\r\nPlease enter User's PIN for the token in slot 0: \r\n\r\nManufacturer      = SafeNet Inc.\r\nLabel             = OPENSSL                         \r\nFlags             = 0x649 (RNG USER-PIN-INIT CLOCK TOKEN-INIT DUAL-CRYPTO)\r\n\r\nPublic and Private Objects:\r\nCA                               - PUBLIC_KEY      RSA         \r\nCA                               - PRIVATE_KEY     RSA         \r\n\r\n```\r\nand [pc_private_sign.txt](https://github.com/OpenSC/libp11/files/1005861/pc_private_sign.txt) is OpenSSL sign attempt which end up failed:\r\n```\r\n[root@mzcentos ca_ptk]# openssl req -config openssl.cnf -key \"pkcs11:model=0000;manufacturer=SafeNet%20Inc.;serial=0000%3a84324;token=OPENSSL;id=%42%19%72%91%10%73%e4%b1%e0%7f%67%fe%2f%31%a8%6c%e6%5c%ca%66;object=CA;object-type=private?pin-value=1111\" -keyform engine -engine pkcs11 -new -x509 -days 7300 -sha256 -extensions v3_ca -out certs/ca.cert.pem\r\nlogger: s_ctData->ft = 0x0x21241a0\r\nlogger: s_ctData->ft->C_Initialize = 0x0x7f9fb5b44e20\r\nengine \"pkcs11\" set.\r\nNo private keys found.\r\nNo private keys found.\r\nPKCS11_get_private_key returned NULL\r\ncannot load Private Key from engine\r\n140323973031840:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126:\r\nunable to load Private Key\r\n```\r\nIn this case, I assume, if OpenSSL logged into token, sing operation would worked fine.\r\nSo I set No public crypto flag to true, OpenSSL logs in correctly, finds private key and do the sing operation. [Npc_private_sign.txt](https://github.com/OpenSC/libp11/files/1005869/Npc_private_sign.txt)\r\n\r\nSecond thing, it seems to me, is some lack of implementation on side of Safenet. It looks like, they have not implemented CKU_CONTEXT_SPECIFIC user type in pkcs11 at all. When I have set _No public crypto_ true, but my object is Public, OpenSSL finds it, then request pin (ignoring pin in URL), but then sing fails on \r\n```\r\n[root@mzcentos ca_ptk]# openssl req -config openssl.cnf -key \"pkcs11:model=0000;manufacturer=SafeNet%20Inc.;serial=0000%3a84324;token=OPENSSL;id=%42%19%72%91%10%73%e4%b1%e0%7f%67%fe%2f%31%a8%6c%e6%5c%ca%66;object=CA;object-type=private?pin-value=1111\" -keyform engine -engine pkcs11 -new -x509 -days 7300 -sha256 -extensions v3_ca -out certs/ca.cert.pem\r\nlogger: s_ctData->ft = 0x0xd571a0\r\nlogger: s_ctData->ft->C_Initialize = 0x0x7f80d2c5be20\r\nengine \"pkcs11\" set.\r\nMissing CKA_ALWAYS_AUTHENTICATE attribute\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [SK]:\r\nState or Province Name [Bratislavsky kraj]:\r\nLocality Name [Bratislava]:\r\nOrganization Name [company]:\r\nOrganizational Unit Name [IKT]:\r\nCommon Name []:\r\nEmail Address [ikt@company.eu]:\r\nEnter PKCS#11 key PIN for CA:\r\n140191316727712:error:80009103:Vendor defined:PKCS11_rsa_encrypt:User type invalid:p11_rsa.c:120:\r\n140191316727712:error:0D0DC006:asn1 encoding routines:ASN1_item_sign_ctx:EVP lib:a_sign.c:314:\r\n```\r\n\r\nThis seems to be a problem in pkcs11 log [Npc_publicobj_sign.txt](https://github.com/OpenSC/libp11/files/1005875/Npc_publicobj_sign.txt): \r\n```\r\npid(14918) tid(139744935835712) time(16/05/2017,23:02:12.252) \t> C_Login hSession=0x00000002 userType=2{?} pPin=0x0x7ffd53d62830 pinLen=4\r\n    pin: (4Bytes)\r\n    31 31 31 31 \r\n\r\npid(14918) tid(139744935835712) time(16/05/2017,23:02:12.252) \t<< C_Login rv=0x00000103{user type invalid}\r\n```\r\n\r\nAs I mentioned before, we plan to switch mode of our device to FIPS (with _No public crypto_ flag), and we have public objects in token, so after switch we won’t be able to use them, because sing will  fail as in previous case. If I am able to force login into token as standard user, crypto operations shoud work correctly even after mode switch.\r\nI noticed _Missing CKA_ALWAYS_AUTHENTICATE attribute_ message in OpenSSL operations, but I am not sure if this has something to do with my situation.\r\n\r\nAll tests I am doing, are done on software HSM emulation, but hardware HSM works the same.\r\nDo you think, if is there any way to overcome this _user type invalid_ issue?\r\n\r\nThanks in advance.\r\nIf there is any test/log I can provide, I'll be happy to.\r\n"},"comment":{"url":"https://api.github.com/repos/OpenSC/libp11/issues/comments/303320276","html_url":"https://github.com/OpenSC/libp11/issues/160#issuecomment-303320276","issue_url":"https://api.github.com/repos/OpenSC/libp11/issues/160","id":303320276,"user":{"login":"mtrojnar","id":13538198,"avatar_url":"https://avatars0.githubusercontent.com/u/13538198?v=3","gravatar_id":"","url":"https://api.github.com/users/mtrojnar","html_url":"https://github.com/mtrojnar","followers_url":"https://api.github.com/users/mtrojnar/followers","following_url":"https://api.github.com/users/mtrojnar/following{/other_user}","gists_url":"https://api.github.com/users/mtrojnar/gists{/gist_id}","starred_url":"https://api.github.com/users/mtrojnar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtrojnar/subscriptions","organizations_url":"https://api.github.com/users/mtrojnar/orgs","repos_url":"https://api.github.com/users/mtrojnar/repos","events_url":"https://api.github.com/users/mtrojnar/events{/privacy}","received_events_url":"https://api.github.com/users/mtrojnar/received_events","type":"User","site_admin":false},"created_at":"2017-05-23T08:00:56Z","updated_at":"2017-05-23T08:00:56Z","body":"PKCS#11 v2.20 says:\r\n\r\n> CKF_LOGIN_REQUIRED 0x00000004 True if there are **some** cryptographic functions that a user must be logged in to perform\r\n\r\nCKF_LOGIN_REQUIRED never meant that **all** cryptographic functions of the device require the user to be logged in."}}
{"actor":{"display_login":"mtrojnar"}}