Skip to main content
6 votes
Accepted

How can CKA_TRUSTED be set to true?

In general an application - a program that uses the token for cryptographic operations - is supposed to use CKU_USER, not CKU_SO....
Maarten Bodewes's user avatar
  • 93.2k
6 votes

What is the purpose of implementing cryptographic algorithms in a token?

In practice, “secrets do not leave the token” is not beneficial. Ouch, I think I would rather like to know where my keys are. This is about the same as saying that you don't care if your house keys ...
Maarten Bodewes's user avatar
  • 93.2k
5 votes
Accepted

Why is data signed with SHA256-RSA-PKCS and digest signed with RSA-PKCS different?

TLDR: it's the DigestInfo The hash-and-RSA-PKCS schemes defined in Current Mechanisms 2.1.14 do the full scheme of RSASSA-PKCS1-v1_5 which is now defined in RFC8017 primarily in 9.2 as a combination ...
dave_thompson_085's user avatar
5 votes

What is the purpose of implementing cryptographic algorithms in a token?

At least one benefit of tokens is that even if the token is temporarily abused because "the UI device is breached", the key itself does not leak. Therefore, in some applications like server ...
fgrieu's user avatar
  • 142k
4 votes
Accepted

Basic question on interaction with HSM using PKCS11

No, the operations on the key itself are not standardized and not supported by the PKCS#11 standard. There are some key derivation mechanisms, but even the NIST specified ones have hardly any support (...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
Accepted

How is PKCS a syntax to digitally sign, digest, authenticate, or encrypt arbitrary message content

PKCS stands for Public Key Cryptography Standards. The name was part of RSA Laboratories that managed to create and publish a very long list of standards, including: PKCS#1 : RSA with various schemes ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

What is the purpose of implementing cryptographic algorithms in a token?

In practice, “secrets do not leave the token” is not benefitial. In order to use a secret, a user needs to upload that secret to a program with a user interface (UI). What actually happens is that ...
SAI Peregrinus's user avatar
3 votes

PKCS11: CKA_VALUE_LEN attribute and Unwrap key

Yes, I think that's sufficiently unclear to ask for clarification of the authors of the document, and it probably needs fixing. However, what I do know is that the key size is definitely clear from ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
Accepted

Question on PKCS11 2.40 spec and AES_CBC wrap

if any key has NULL bytes (or zeros) at the end, how the unwrap knows how many padded bytes are added? PKCS#11 doesn't unpad unless you indicate PKCS#7 padding using ...
Maarten Bodewes's user avatar
  • 93.2k
2 votes
Accepted

Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD

The PKCS#11 technical committee is currently working on standard version 3.0. You can find the latest working draft here: https://www.oasis-open.org/committees/download.php/64968/pkcs11-curr-v3.0-wd09....
dannyM's user avatar
  • 46
2 votes

HMAC computation using AES key

I see no way. Typed keys are typed to prevent them from being used for another task than being the key to the designated algorithm. What you maybe could do is use the key to derive another, and use ...
fgrieu's user avatar
  • 142k
2 votes
Accepted

Using PKCS #11 Certificate Objects for Verification

Quoting the PKCS#11 specification: Certificate objects (object class CKO_CERTIFICATE) hold public-key or attribute certificates. Other than providing access to certificate objects, Cryptoki does ...
Gilles 'SO- stop being evil''s user avatar
2 votes
Accepted

OID for Ed25519

I'm not sure about what you need, but 06 09 2B 06 01 04 01 DA 47 0F 01 is the DER encoding of OID 1.3.6.1.4.1.11591.15.1 meaning curve Ed25519, not the OID 1.3.101....
fgrieu's user avatar
  • 142k
2 votes
Accepted

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

You're fine. There are several different padding methods listed in PKCS v1.5. The method that has active attacks is actually a padding used during public key encryption - that is, it's used to ...
poncho's user avatar
  • 148k
2 votes

Wrong key length for EC public key

The EC_POINT must be a ASN.1-encoded octet string, and the ePass2003 result does not seem to be valid ASN.1 (compare the Safenet 5110 value and the ePass2003 value) (Due to a fun coincidence, the ...
Conrado's user avatar
  • 6,474
1 vote
Accepted

In PKCS#11, can I set a custom base point for a secp256r1 ECDSA signature?

ECDSA signing with a standard curve but using custom base point is theoretically allowed by some standards, but it is not common practice and I don't know of any API that supports it. It is not ...
Gilles 'SO- stop being evil''s user avatar
1 vote

Generation of RSA key pair and storage of only private key PKCS#11

Your approach can only be applied to RSA and only if you are using keys generated according to PKCS#11 version >= 2.40. The PKCS#11 standard defines (section 2.1.3 "RSA private key objects&...
dannyM's user avatar
  • 46
1 vote

Generation of RSA key pair and storage of only private key PKCS#11

The most obvious: performance. I know SPHINCS+ being an example where generating public key from the private key is especially costly, there may be other schemes where this is true, but I'm not aware ...
DannyNiu's user avatar
  • 9,421
1 vote
Accepted

Wrong key length for EC public key

Yes, it was a bug in PKCS11 library of token. Vendor resolved the problem and after getting a new library I can read 67 byte EC_POINT from token. So it is impossible to get 61 byte for EC256 bit ...
Uzeyir's user avatar
  • 11
1 vote

TDES (Triple DES) DUKPT decryption

I solved the problem. So for people who are hunting for the answer, you need to consider what mechs your HSM supports. Every logic I had in the code was correct. The only problem was the mechanism ...
onesick1's user avatar
1 vote
Accepted

PKCS#11 Sessions

Sessions in PKCS#11 are always specific to the current process, so it is no big surprise that you cannot see the session from a different one.
mat's user avatar
  • 2,528
1 vote

Source for PKCS#11 Header Files

These headers now appear on the oasis github: https://github.com/oasis-tcs/pkcs11/tree/master/published , which as of the time of writing includes the latest released files (3.01)
Tyzoid's user avatar
  • 111
1 vote
Accepted

How should short term keys (keys stored in RAM or volatile memory) be described by PKCS#11?

Is the proper way to distinguish between keys that are more temporary/stored in volatile memory and those stored in non-volatile memory to label them "session objects" or "token objects" using the ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
Accepted

RSA hybrid decryption via PKCS#11 - unwrap or decrypt?

The AES is just used to protect the data. And although keeping the AES key in the HSM is more secure, you need to remember that there is little reason to protect it any better than the data itself. ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote

PKCS #11 – Deriving a Key where MSB perform encryption and LSB perform CMAC operation?

OK so your problem is the following: You have a secure key and want to / can use it only for AES-ECB. You want to extend the security of this key to derived keying material which deterministically ...
SEJPM's user avatar
  • 46.1k
1 vote

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

Yes, you're still secure. The current RSA PKCS#1 v1.5 signature scheme is still thought to be secure. So the following information in RFC 3447 section 8.2, describing PKCS#1 v2.1 still applies: ...
Maarten Bodewes's user avatar
  • 93.2k

Only top scored, non community-wiki answers of a minimum length are eligible