Protected Authentication Path enabled when using the opensc-pkcs11 driver #81

New Issue

2025-03-11T01:03:24+08:00

tpatrascu commented

2025-03-11 01:03:24 +08:00

(Migrated from https://github.com/polhenarejos/pico-hsm)

Hello,

PicoHSM: 5.4
OS: Windows 11, Ubuntu 24.04
OpenSC: 0.25.0~rc1-1build2 on Ubuntu, 0.23.0.0 on Windows

When using the opensc-pkcs11 driver, it detects that the token has Protected Authentication Path enabled, so a lot of applications do not ask for the PIN.

pkcs11-tool --module 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' -L
Available slots:
Slot 0 (0x0): ACS CryptoMate EVO 0
  (token not recognized)
Slot 1 (0x4): Pol Henarejos Pico Key CCID OTP FIDO Interfac 0
  token label        : Pico-HSM (UserPIN)
  token manufacturer : Pol Henarejos
  token model        : PKCS#15 emulated
  token flags        : login required, PIN pad present, rng, token initialized, PIN initialized
  hardware version   : 24.13
  firmware version   : 5.4
  serial num         : ESPICOHSMTR
  pin min/max        : 6/15

pkcs11-tool --module 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' --login --test
Using slot 0 with a present token (0x0)
error: PKCS11 function C_Login failed: rv = CKR_PIN_INCORRECT (0xa0)
Aborting.

When using ssh -I -v I see that the opensc library thinks I should use the hardware pinpad and doesn't ask for the pin:

Deferring PIN entry to reader keypad.
PKCS#11 login failed: PIN incorrect
login failed
pkcs11_get_key failed
debug1: identity_sign: sshkey_sign: error in libcrypto
sign_and_send_pubkey: signing failed for ECDSA "Certificate": error in libcrypto

I also tried to disable the pinpad in opensc-pkcs11 driver config but it doesn't seem to work for me.

opensc.conf:

        reader_driver pcsc {
		enable_pinpad = false;
	}

Amazingly, the putty-cac pageant actually correctly loads the key and asks for the pin when using this opensc-pkcs11.dll driver, whereas when using the CardContact driver it crashes when it tries to load the driver. So some applications might still correctly work with it.

The CardContact driver https://github.com/CardContact/sc-hsm-embedded detects that the token doesn't have Protected Authentication Path enabled so it works correctly.

pkcs11-tool --module C:\Windows\System32\sc-hsm-pkcs11.dll -L
Available slots:
Slot 0 (0x1): ACS CryptoMate EVO 0
  (empty)
Slot 1 (0x5): Pol Henarejos Pico Key CCID OTP FIDO Interfac 0
  token label        : Pico-HSM
  token manufacturer : CardContact (www.cardcontact.de)
  token model        : SmartCard-HSM
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 255.0
  firmware version   : 5.4
  serial num         : ESPICOHSMTR
  pin min/max        : 6/16

pkcs11-tool --module C:\Windows\System32\sc-hsm-pkcs11.dll --login --test
Using slot 1 with a present token (0x5)
Logging in to "Pico-HSM".
Please enter User PIN: C_SeedRandom() and C_GenerateRandom():
  seeding (C_SeedRandom) not supported
  seems to be OK
Digests:
  all 4 digest functions seem to work
  SHA-1: OK
  SHA256: OK
Signatures (currently only for RSA)
  testing key 0 (Certificate)  -- non-RSA, skipping
Signatures: no private key found in this slot
Verify (currently only for RSA)
  testing key 0 (Certificate) -- non-RSA, skipping
Decryption (currently only for RSA)
  testing key 0 (Certificate) -- non-RSA, skipping
No errors

Thanks,
Tiberiu

Hello, PicoHSM: 5.4 OS: Windows 11, Ubuntu 24.04 OpenSC: 0.25.0~rc1-1build2 on Ubuntu, 0.23.0.0 on Windows When using the opensc-pkcs11 driver, it detects that the token has Protected Authentication Path enabled, so a lot of applications do not ask for the PIN. ``` pkcs11-tool --module 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' -L Available slots: Slot 0 (0x0): ACS CryptoMate EVO 0 (token not recognized) Slot 1 (0x4): Pol Henarejos Pico Key CCID OTP FIDO Interfac 0 token label : Pico-HSM (UserPIN) token manufacturer : Pol Henarejos token model : PKCS#15 emulated token flags : login required, PIN pad present, rng, token initialized, PIN initialized hardware version : 24.13 firmware version : 5.4 serial num : ESPICOHSMTR pin min/max : 6/15 pkcs11-tool --module 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' --login --test Using slot 0 with a present token (0x0) error: PKCS11 function C_Login failed: rv = CKR_PIN_INCORRECT (0xa0) Aborting. ``` When using ssh -I -v I see that the opensc library thinks I should use the hardware pinpad and doesn't ask for the pin: ``` Deferring PIN entry to reader keypad. PKCS#11 login failed: PIN incorrect login failed pkcs11_get_key failed debug1: identity_sign: sshkey_sign: error in libcrypto sign_and_send_pubkey: signing failed for ECDSA "Certificate": error in libcrypto ``` I also tried to disable the pinpad in opensc-pkcs11 driver config but it doesn't seem to work for me. opensc.conf: ``` reader_driver pcsc { enable_pinpad = false; } ``` Amazingly, the putty-cac pageant actually correctly loads the key and asks for the pin when using this opensc-pkcs11.dll driver, whereas when using the CardContact driver it crashes when it tries to load the driver. So some applications might still correctly work with it. The CardContact driver https://github.com/CardContact/sc-hsm-embedded detects that the token doesn't have Protected Authentication Path enabled so it works correctly. ``` pkcs11-tool --module C:\Windows\System32\sc-hsm-pkcs11.dll -L Available slots: Slot 0 (0x1): ACS CryptoMate EVO 0 (empty) Slot 1 (0x5): Pol Henarejos Pico Key CCID OTP FIDO Interfac 0 token label : Pico-HSM token manufacturer : CardContact (www.cardcontact.de) token model : SmartCard-HSM token flags : login required, rng, token initialized, PIN initialized hardware version : 255.0 firmware version : 5.4 serial num : ESPICOHSMTR pin min/max : 6/16 pkcs11-tool --module C:\Windows\System32\sc-hsm-pkcs11.dll --login --test Using slot 1 with a present token (0x5) Logging in to "Pico-HSM". Please enter User PIN: C_SeedRandom() and C_GenerateRandom(): seeding (C_SeedRandom) not supported seems to be OK Digests: all 4 digest functions seem to work SHA-1: OK SHA256: OK Signatures (currently only for RSA) testing key 0 (Certificate) -- non-RSA, skipping Signatures: no private key found in this slot Verify (currently only for RSA) testing key 0 (Certificate) -- non-RSA, skipping Decryption (currently only for RSA) testing key 0 (Certificate) -- non-RSA, skipping No errors ``` Thanks, Tiberiu

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/pico-hsm#81