New answers tagged

0

While I agree that this code sample lacks quality and more information would be helpful it mainly seems that mainly the templates are wrong: Mechanism CKM_EC_KEY_PAIR_GEN only needs the curve OID in CKA_EC_PARAMS (the commmented part is right, the actual code is wrong) in the public key template only. CKA_CLASS and CKA_KEY_TYPE are set automatically for both ...


1

Yes, it was a bug in PKCS11 library of token. Vendor resolved the problem and after getting a new library I can read 67 byte EC_POINT from token. So it is impossible to get 61 byte for EC256 bit public keys:) Thanks to you guys!


2

The EC_POINT must be a ASN.1-encoded octet string, and the ePass2003 result does not seem to be valid ASN.1 (compare the Safenet 5110 value and the ePass2003 value) (Due to a fun coincidence, the octet string ASN.1 prefix is also 04, so the byte that identifies that it's an uncompressed point is actually the second 04 in the third byte, in the Safenet 5110 ...


6

In practice, “secrets do not leave the token” is not beneficial. Ouch, I think I would rather like to know where my keys are. This is about the same as saying that you don't care if your house keys got copied or not. For example, a banking application. This program is not able to execute on a token since tokens have insufficient UI. Hence this program will ...


5

At least one benefit of tokens is that even if the token is temporarily abused because "the UI device is breached", the key itself does not leak. Therefore, in some applications like server authentication, it's enough to restore the integrity of the breached machine to be back and running without changing the key. That capability is necessary in ...


3

In practice, “secrets do not leave the token” is not benefitial. In order to use a secret, a user needs to upload that secret to a program with a user interface (UI). What actually happens is that PKCS#11 provides a way for the UI to send data to the token to be signed using a private key or encrypted using a secret key. The token itself has the ability to ...


Top 50 recent answers are included