opencryptoki-users — Discuss usage of the PKCS#11 API and App development

[opencryptoki-users] Trouble with tpmtoken_init

[Thomas R. <Tho...@ko...>]

Hi,

I try to create a datastore with an other user than root.
I succeed to create my datastore, import keys and certificates and use it with root.
But with other users I get this error :
tpmtoken_init
PKCS#11 TPM Token is not present

The other users can't find the corresponding slot and token, but I don't know why. (They are in pkcs11 group)
pkcsconf -s -t
Token #3 Info:
        Label: IBM OS PKCS#11
        Manufacturer: IBM Corp.
        Model: IBM SoftTok
        Serial Number: 123
        Flags: 0x980045 (RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_TO_BE_CHANGED|SO_PIN_COUNT_LOW|SO_PIN_TO_BE_CHANGED)
        Sessions: 0/4294967294
        R/W Sessions: 4294967295/4294967294
        PIN Length: 4-8
        Public Memory: 0xFFFFFFFF/0xFFFFFFFF
        Private Memory: 0xFFFFFFFF/0xFFFFFFFF
        Hardware Version: 1.0
        Firmware Version: 1.0
        Time: 15:26:16
Slot #3 Info
        Description: Linux
        Manufacturer: IBM
        Flags: 0x1 (TOKEN_PRESENT)
        Hardware Version: 0.0
        Firmware Version: 0.0


Any idea ??
Thanks,

Thomas,

Re: [opencryptoki-users] why TPM TOKEN is not found

[Farrag, O. <Osa...@jh...>]

A follow up; now that I choose to have well known secret. I am able to see that opencryptoki recognizes the TPM token #0


pkcsconf -t

Token #0 Info:

Label: IBM PKCS#11 TPM Token

Manufacturer: IBM Corp.

Model: TPM v1.1 Token

Serial Number: 123

Flags: 0x890045 (RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_COUNT_LOW|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED)

Sessions: 0/18446744073709551614

R/W Sessions: 18446744073709551615/18446744073709551614

PIN Length: 4-8

Public Memory: 0xFFFFFFFFFFFFFFFF/0xFFFFFFFFFFFFFFFF

Private Memory: 0xFFFFFFFFFFFFFFFF/0xFFFFFFFFFFFFFFFF

Hardware Version: 1.0

Firmware Version: 1.0

Time: 20:47:11

Token #3 Info:

Label: IBM OS PKCS#11

Manufacturer: IBM Corp.

Model: IBM SoftTok

Serial Number: 123

Flags: 0x880045 (RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED)

Sessions: 0/18446744073709551614

R/W Sessions: 18446744073709551615/18446744073709551614

PIN Length: 4-8

Public Memory: 0xFFFFFFFFFFFFFFFF/0xFFFFFFFFFFFFFFFF

Private Memory: 0xFFFFFFFFFFFFFFFF/0xFFFFFFFFFFFFFFFF

Hardware Version: 1.0

Firmware Version: 1.0

Time: 20:47:11

My TPM is Version 1.2, but opencryptoki says it is 1.1. The opencryptoki.cnf file is minimal, so only the path to the .so - no version or other information


version opencryptoki-3.1


# The following defaults are defined:

#       hwversion = 0.0

#       firmwareversion = 0.0

#       description = Linux

#       manufacturer = IBM

#

# The slot definitions below may be overriden and/or customized.

# For example:

#       slot 0

#       {

#          stdll = libpkcs11_cca.so

#          description = "OCK CCA Token"

#          manufacturer = "MyCompany Inc."

#          hwversion = 2.32

#          firmwareversion = 1.0

#       }

#

# See man(5) opencryptoki.conf for further information.

#

slot 0

{

stdll = /usr/local/lib/opencryptoki/stdll/libpkcs11_tpm.so

}


slot 1

{

stdll = libpkcs11_ica.so

}


slot 2

{

stdll = libpkcs11_cca.so

}


slot 3

{

stdll = libpkcs11_sw.so

}


slot 4

{

stdll = libpkcs11_ep11.so

confname = ep11tok.conf

}


When I try to do


pkcsconf -I -c 0

Enter the SO PIN:

Enter a unique token label: tpm

Incorrect PIN Entered.

I copied the all zeros secret from here, but it is not accepted. I tried also empty PIN <cr> but it does not work. Is the SO PIN supposed to be something else?

Thank you again
O. farrag

From: Osama Farrag <Osa...@jh...<mailto:Osa...@jh...>>
Date: Wednesday, May 11, 2016 at 8:38 PM
To: Vineetha Pisharath hari pai <vp...@us...<mailto:vp...@us...>>
Cc: "ope...@li...<mailto:ope...@li...>" <ope...@li...<mailto:ope...@li...>>
Subject: Re: [opencryptoki-users] why TPM TOKEN is not found

Thanks for your help;

I choose method 2; my TPM has been setup with the 20 zeros secret; several other software tools that I experiment with now require/assume it is set that way. I have two slots 0 & 3.

Thank you again
Osama Farrag


From: Vineetha Pisharath hari pai <vp...@us...<mailto:vp...@us...>>
Date: Friday, May 6, 2016 at 10:23 AM
To: Osama Farrag <Osa...@jh...<mailto:Osa...@jh...>>
Cc: "ope...@li...<mailto:ope...@li...>" <ope...@li...<mailto:ope...@li...>>
Subject: Re: [opencryptoki-users] why TPM TOKEN is not found


Hello Farrag,

Is TPM enabled in BIOS? If not, you would need to enable it in BIOS settings.

Make sure 'tpm_setpresence' command works.

By default, tpm sets its owner and SRK passwords to a secret that is 20 bytes of zeros. But opencryptoki hardcodes the tpm's owner and SRK secret to be the empty string.

The empty string is NOT the same as 20 bytes of zeros. So we need to sync these up.
There are 2 ways to do this; we can either change tpm's passwords or tell opencryptoki tpm's correct passwords.

1. I think easiest to change tpm's passwords to empty string.

a. when you take ownership, set SRK and owner password to empty string to match opencryptoki.

- Take ownership of the tpm
# tpm_takeownership

when prompted for owner and SRK password, hit enter.
thus setting it to empty string which opencryptoki has hardcoded.

b. If you have already taken ownership, then you can use
tpm_changeownerauth to set the password to the empty string for opencryptoki.


2. Instead of changing tpm, change opencryptoki to match tpm

- Take ownership of the tpm
# tpm_takeownership -z -y

Now change it to tpm's well known secret in opencryptoki,
export OCK_SRK_SECRET="0000000000000000000000000000000000000000"
export OCK_SRK_MODE=TSS_SECRET_MODE_SHA1


You either do 1 or 2, not both. Good luck.

Thanks,
Vineetha Pai
Linux Security Development, LTC
notes - vp...@us...<mailto:vp...@us...>

[Inactive hide details for "Farrag, Osama" ---05/06/2016 03:28:52 AM---I am trying to use opencryptoki with TPM, but after confi]"Farrag, Osama" ---05/06/2016 03:28:52 AM---I am trying to use opencryptoki with TPM, but after configuring and buildling opencryptoki on system

From: "Farrag, Osama" <Osa...@jh...<mailto:Osa...@jh...>>
To: "ope...@li...<mailto:ope...@li...>" <ope...@li...<mailto:ope...@li...>>
Date: 05/06/2016 03:28 AM
Subject: [opencryptoki-users] why TPM TOKEN is not found

________________________________




I am trying to use opencryptoki with TPM, but after configuring and
buildling opencryptoki on system with trousers running and TPM ownership
is setup and SRK is created I am not able to have my TPM token recognized?

Here is what I did

1- I configured and make opencryoki on my centos7 machine using

>> sh bootstrap.sh



>> ./configure --enable-debug --enable-testcases
--enable-tpmtok --disable-ccatok



:
:

Enabled features:
Debug build: yes
Testcases: yes
Daemon build: yes
Library build: yes
Systemd service: no


Enabled token types:
ICA token: no
CCA token: no
Software token: yes
EP11 token: no
TPM token: yes
ICSF token: no


Token-specific features:
pkcsep11migrate build: no


CFLAGS=-g -O2 -gdwarf-2 -g3 -O0 -DDEBUG   -DPKCS64 -D_XOPEN_SOURCE=600
-Wall -Wno-pointer-sign
-DCONFIG_PATH=\"$(localstatedir)/lib/opencryptoki\"
-DSBIN_PATH=\"$(sbindir)\" -DLIB_PATH=\"$(libdir)\"
-DLOCKDIR_PATH=\"$(lockdir)\" -DOCK_CONFDIR=\"$(sysconfdir)/opencryptoki\"
-DOCK_LOGDIR=\"$(logdir)\"







First I verified  trousers is running

>> ps -A | grep tcsd
13582 ?        00:00:00 tcsd


I also ran

tpm_version
 TPM 1.2 Version Info:
 Chip Version:        1.2.5.81
 Spec Level:          2
 Errata Revision:     3
 TPM Vendor ID:       WEC
 Vendor Specific data: 0000
 TPM Version:         01010000
 Manufacturer Info:   57454300


I have successfully taken ownership of TPM and SRK is already setup in the
TPM hardware


I checked the contents of the openCryptoKi configuration file;

vi /etc/opencryptoki/opencryptoki.conf


slot 0
{
stdll = libpkcs11_tpm.so
}


slot 1
{
stdll = libpkcs11_ica.so
}


slot 2
{
stdll = libpkcs11_cca.so
}


slot 3
{
stdll = libpkcs11_sw.so
}


slot 4
{
stdll = libpkcs11_ep11.so
confname = ep11tok.conf
}




But when I used pkcsconf -s to verify that TPM token is present




sudo pkcsconf -sŠ

Slot #3 Info
Description: Linux
Manufacturer: IBM
Flags: 0x1 (TOKEN_PRESENT)
Hardware Version: 0.0
Firmware Version: 0.0


Only libpkcs11_sw is present?

What is missing: does the package default build does not include the TPM?
Or is the configuration file is not correct?



[attachment "default[3].xml" deleted by Vineetha Pisharath hari pai/Poughkeepsie/IBM] [attachment "default[4].xml" deleted by Vineetha Pisharath hari pai/Poughkeepsie/IBM] ------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z_______________________________________________
opencryptoki-users mailing list
ope...@li...<mailto:ope...@li...>
https://lists.sourceforge.net/lists/listinfo/opencryptoki-users

Re: [opencryptoki-users] why TPM TOKEN is not found

[Farrag, O. <Osa...@jh...>]

Thanks for your help;

I choose method 2; my TPM has been setup with the 20 zeros secret; several other software tools that I experiment with now require/assume it is set that way. I have two slots 0 & 3.

Thank you again
Osama Farrag


From: Vineetha Pisharath hari pai <vp...@us...<mailto:vp...@us...>>
Date: Friday, May 6, 2016 at 10:23 AM
To: Osama Farrag <Osa...@jh...<mailto:Osa...@jh...>>
Cc: "ope...@li...<mailto:ope...@li...>" <ope...@li...<mailto:ope...@li...>>
Subject: Re: [opencryptoki-users] why TPM TOKEN is not found


Hello Farrag,

Is TPM enabled in BIOS? If not, you would need to enable it in BIOS settings.

Make sure 'tpm_setpresence' command works.

By default, tpm sets its owner and SRK passwords to a secret that is 20 bytes of zeros. But opencryptoki hardcodes the tpm's owner and SRK secret to be the empty string.

The empty string is NOT the same as 20 bytes of zeros. So we need to sync these up.
There are 2 ways to do this; we can either change tpm's passwords or tell opencryptoki tpm's correct passwords.

1. I think easiest to change tpm's passwords to empty string.

a. when you take ownership, set SRK and owner password to empty string to match opencryptoki.

- Take ownership of the tpm
# tpm_takeownership

when prompted for owner and SRK password, hit enter.
thus setting it to empty string which opencryptoki has hardcoded.

b. If you have already taken ownership, then you can use
tpm_changeownerauth to set the password to the empty string for opencryptoki.


2. Instead of changing tpm, change opencryptoki to match tpm

- Take ownership of the tpm
# tpm_takeownership -z -y

Now change it to tpm's well known secret in opencryptoki,
export OCK_SRK_SECRET="0000000000000000000000000000000000000000"
export OCK_SRK_MODE=TSS_SECRET_MODE_SHA1


You either do 1 or 2, not both. Good luck.

Thanks,
Vineetha Pai
Linux Security Development, LTC
notes - vp...@us...<mailto:vp...@us...>

[Inactive hide details for "Farrag, Osama" ---05/06/2016 03:28:52 AM---I am trying to use opencryptoki with TPM, but after confi]"Farrag, Osama" ---05/06/2016 03:28:52 AM---I am trying to use opencryptoki with TPM, but after configuring and buildling opencryptoki on system

From: "Farrag, Osama" <Osa...@jh...<mailto:Osa...@jh...>>
To: "ope...@li...<mailto:ope...@li...>" <ope...@li...<mailto:ope...@li...>>
Date: 05/06/2016 03:28 AM
Subject: [opencryptoki-users] why TPM TOKEN is not found

________________________________




I am trying to use opencryptoki with TPM, but after configuring and
buildling opencryptoki on system with trousers running and TPM ownership
is setup and SRK is created I am not able to have my TPM token recognized?

Here is what I did

1- I configured and make opencryoki on my centos7 machine using

>> sh bootstrap.sh



>> ./configure --enable-debug --enable-testcases
--enable-tpmtok --disable-ccatok



:
:

Enabled features:
Debug build: yes
Testcases: yes
Daemon build: yes
Library build: yes
Systemd service: no


Enabled token types:
ICA token: no
CCA token: no
Software token: yes
EP11 token: no
TPM token: yes
ICSF token: no


Token-specific features:
pkcsep11migrate build: no


CFLAGS=-g -O2 -gdwarf-2 -g3 -O0 -DDEBUG   -DPKCS64 -D_XOPEN_SOURCE=600
-Wall -Wno-pointer-sign
-DCONFIG_PATH=\"$(localstatedir)/lib/opencryptoki\"
-DSBIN_PATH=\"$(sbindir)\" -DLIB_PATH=\"$(libdir)\"
-DLOCKDIR_PATH=\"$(lockdir)\" -DOCK_CONFDIR=\"$(sysconfdir)/opencryptoki\"
-DOCK_LOGDIR=\"$(logdir)\"







First I verified  trousers is running

>> ps -A | grep tcsd
13582 ?        00:00:00 tcsd


I also ran

tpm_version
 TPM 1.2 Version Info:
 Chip Version:        1.2.5.81
 Spec Level:          2
 Errata Revision:     3
 TPM Vendor ID:       WEC
 Vendor Specific data: 0000
 TPM Version:         01010000
 Manufacturer Info:   57454300


I have successfully taken ownership of TPM and SRK is already setup in the
TPM hardware


I checked the contents of the openCryptoKi configuration file;

vi /etc/opencryptoki/opencryptoki.conf


slot 0
{
stdll = libpkcs11_tpm.so
}


slot 1
{
stdll = libpkcs11_ica.so
}


slot 2
{
stdll = libpkcs11_cca.so
}


slot 3
{
stdll = libpkcs11_sw.so
}


slot 4
{
stdll = libpkcs11_ep11.so
confname = ep11tok.conf
}




But when I used pkcsconf -s to verify that TPM token is present




sudo pkcsconf -sŠ

Slot #3 Info
Description: Linux
Manufacturer: IBM
Flags: 0x1 (TOKEN_PRESENT)
Hardware Version: 0.0
Firmware Version: 0.0


Only libpkcs11_sw is present?

What is missing: does the package default build does not include the TPM?
Or is the configuration file is not correct?



[attachment "default[3].xml" deleted by Vineetha Pisharath hari pai/Poughkeepsie/IBM] [attachment "default[4].xml" deleted by Vineetha Pisharath hari pai/Poughkeepsie/IBM] ------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z_______________________________________________
opencryptoki-users mailing list
ope...@li...<mailto:ope...@li...>
https://lists.sourceforge.net/lists/listinfo/opencryptoki-users

Re: [opencryptoki-users] why TPM TOKEN is not found

[Vineetha P. h. p. <vp...@us...>]

Hello Farrag,

Is TPM enabled in BIOS? If not, you would need to enable it in BIOS
settings.

Make sure 'tpm_setpresence' command works.

By default, tpm sets its owner and SRK passwords to a secret that is 20
bytes of zeros.  But opencryptoki hardcodes the tpm's owner and SRK secret
to be the empty string.

 The empty string is NOT the same as 20 bytes of zeros. So we need to sync
these up.
 There are 2 ways to do this; we can either change tpm's passwords or tell
opencryptoki tpm's correct passwords.

1.  I think easiest to change tpm's passwords to empty string.

    a. when you take ownership, set SRK and owner password to empty string
to match opencryptoki.

       - Take ownership of the tpm
	# tpm_takeownership

	when prompted for owner and SRK password, hit enter.
	thus setting it to empty string which opencryptoki has hardcoded.

   b. If you have already taken ownership, then you can use
      tpm_changeownerauth to set the password to the empty string for
opencryptoki.


2. Instead of changing tpm, change opencryptoki to match tpm

- Take ownership of the tpm
	# tpm_takeownership -z -y

Now change it to tpm's well known secret in opencryptoki,
export OCK_SRK_SECRET="0000000000000000000000000000000000000000"
export OCK_SRK_MODE=TSS_SECRET_MODE_SHA1


You either do 1 or 2, not both. Good luck.

Thanks,
Vineetha Pai
Linux Security Development, LTC
notes - vp...@us...



From:	"Farrag, Osama" <Osa...@jh...>
To:	"ope...@li..."
            <ope...@li...>
Date:	05/06/2016 03:28 AM
Subject:	[opencryptoki-users] why TPM TOKEN is not found




I am trying to use opencryptoki with TPM, but after configuring and
buildling opencryptoki on system with trousers running and TPM ownership
is setup and SRK is created I am not able to have my TPM token recognized?

Here is what I did

1- I configured and make opencryoki on my centos7 machine using

>> sh bootstrap.sh



>> ./configure --enable-debug --enable-testcases
--enable-tpmtok --disable-ccatok



:
:

Enabled features:
		 Debug build:		 		 yes
		 Testcases:		 		 yes
		 Daemon build:		 		 yes
		 Library build:		 		 yes
		 Systemd service:		 no


Enabled token types:
		 ICA token:		 		 no
		 CCA token:		 		 no
		 Software token:		 		 yes
		 EP11 token:		 		 no
		 TPM token:		 		 yes
		 ICSF token:		 		 no


Token-specific features:
		 pkcsep11migrate build:		 no


CFLAGS=-g -O2 -gdwarf-2 -g3 -O0 -DDEBUG   -DPKCS64 -D_XOPEN_SOURCE=600
-Wall -Wno-pointer-sign
-DCONFIG_PATH=\"$(localstatedir)/lib/opencryptoki\"
-DSBIN_PATH=\"$(sbindir)\" -DLIB_PATH=\"$(libdir)\"
-DLOCKDIR_PATH=\"$(lockdir)\" -DOCK_CONFDIR=\"$(sysconfdir)/opencryptoki\"
-DOCK_LOGDIR=\"$(logdir)\"







First I verified  trousers is running

>> ps -A | grep tcsd
 13582 ?        00:00:00 tcsd


I also ran

tpm_version
  TPM 1.2 Version Info:
  Chip Version:        1.2.5.81
  Spec Level:          2
  Errata Revision:     3
  TPM Vendor ID:       WEC
  Vendor Specific data: 0000
  TPM Version:         01010000
  Manufacturer Info:   57454300


I have successfully taken ownership of TPM and SRK is already setup in the
TPM hardware


I checked the contents of the openCryptoKi configuration file;

vi /etc/opencryptoki/opencryptoki.conf


slot 0
{
stdll = libpkcs11_tpm.so
}


slot 1
{
stdll = libpkcs11_ica.so
}


slot 2
{
stdll = libpkcs11_cca.so
}


slot 3
{
stdll = libpkcs11_sw.so
}


slot 4
{
stdll = libpkcs11_ep11.so
confname = ep11tok.conf
}




But when I used pkcsconf -s to verify that TPM token is present



sudo pkcsconf -s
Š

Slot #3 Info
		 Description: Linux
		 Manufacturer: IBM
		 Flags: 0x1 (TOKEN_PRESENT)
		 Hardware Version: 0.0
		 Firmware Version: 0.0


Only libpkcs11_sw is present?

What is missing: does the package default build does not include the TPM?
Or is the configuration file is not correct?



[attachment "default[3].xml" deleted by Vineetha Pisharath hari
pai/Poughkeepsie/IBM] [attachment "default[4].xml" deleted by Vineetha
Pisharath hari pai/Poughkeepsie/IBM]
------------------------------------------------------------------------------

Find and fix application performance issues faster with Applications
Manager
Applications Manager provides deep performance insights into multiple tiers
of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
opencryptoki-users mailing list
ope...@li...
https://lists.sourceforge.net/lists/listinfo/opencryptoki-users

[opencryptoki-users] Why I am not able to get TPM Token "Slot 0" working

[Farrag, O. <Osa...@jh...>]

Hello; sorry for the previous confusing email, it was sent unintentionally:

I am trying to use opencryptoki with TPM, but after configuring and
building opencryptoki-3.5 with TrouSers running on my linux Centos7
machine; I was not able to have my TPM token (slot 0) recognized?

Here is what I did



1- First I verified  trousers is running, and TPM hardware is OK. I have
prior initialized and  set the TPM ownership.
>>ps -A | grep tcsd
13582 ?        00:00:00 tcsd


I also ran 

>> tpm_version 
  TPM 1.2 Version Info:
  Chip Version:        1.2.5.81
  Spec Level:          2
  Errata Revision:     3
  TPM Vendor ID:       WEC
  Vendor Specific data: 0000
  TPM Version:         01010000
  Manufacturer Info:   57454300


I have successfully taken ownership of TPM and SRK is already setup in the
TPM hardware

2-  I configured and make opencryoki on my centos7 machine using, the
following commands

A) 
>>sh bootstrap.sh

:
:

There was no erros

>>./configure --enable-debug --enable-testcases
--enable-tpmtok --disable-ccatok



:
:

Enabled features:
Debug build:	yes
Testcases:	yes
Daemon build:	yes
Library build:	yes
Systemd service:	no


Enabled token types:
ICA token:	no
CCA token:	no
Software token:	yes
EP11 token:	no
TPM token:	yes
ICSF token:	no


Token-specific features:
pkcsep11migrate build:	no


CFLAGS=-g -O2 -gdwarf-2 -g3 -O0 -DDEBUG -DPKCS64 -D_XOPEN_SOURCE=600
-Wall -Wno-pointer-sign
-DCONFIG_PATH=\"$(localstatedir)/lib/opencryptoki\"
-DSBIN_PATH=\"$(sbindir)\" -DLIB_PATH=\"$(libdir)\"
-DLOCKDIR_PATH=\"$(lockdir)\" -DOCK_CONFDIR=\"$(sysconfdir)/opencryptoki\"
-DOCK_LOGDIR=\"$(logdir)\"

B)

>> make clean

C)

>> make

D)

>> sudo make install


3- I checked the contents of the openCryptoKi configuration file; there
are two locations where I find this file

>> vi /usr/local/etc/opencryptoki/opencryptoki.conf

And 

>> vi /etc/opencryptoki/opencryptoki.conf

Both files have the same contents


version opencryptoki-3.1


# The following defaults are defined:
#       hwversion = 0.0
#       firmwareversion = 0.0
#       description = Linux
#       manufacturer = IBM
#
# The slot definitions below may be overriden and/or customized.
# For example:
#       slot 0
#       {
#          stdll = libpkcs11_cca.so
#          description = "OCK CCA Token"
#          manufacturer = "MyCompany Inc."
#          hwversion = 2.32
#          firmwareversion = 1.0
#       }
#
# See man(5) opencryptoki.conf for further information.
#


slot 0
{
stdll = libpkcs11_tpm.so
}


slot 1
{
stdll = libpkcs11_ica.so
}


slot 2
{
stdll = libpkcs11_cca.so
}


slot 3
{
stdll = libpkcs11_sw.so
}


slot 4
{
stdll = libpkcs11_ep11.so
confname = ep11tok.conf
}


The build generated the TPM library, because I am able to see these

/usr/local/lib/opencryptoki/stdll/libpkcs11_tpm.so.0.0.0
/usr/local/lib/opencryptoki/stdll/libpkcs11_tpm.so.0
/usr/local/lib/opencryptoki/stdll/libpkcs11_tpm.so

4- I started the deamon

>> sudo pkcsslotd start


5- Verified it is running

>> ps -A | grep pkcsslotd

  3500 ?        00:00:00 pkcsslotd



 

6- But when I used pkcsconf -t & pkcsconf -s to verify that TPM token is
present


>> sudo pkcsconf -t

Token #3 Info:
	Label: IBM OS PKCS#11
	Manufacturer: IBM Corp.
	Model: IBM SoftTok
	Serial Number: 123
	Flags: 0x880045 
(RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHAN
GED)
	Sessions: 0/-2
	R/W Sessions: -1/-2
	PIN Length: 4-8
	Public Memory: 0xFFFFFFFF/0xFFFFFFFF
	Private Memory: 0xFFFFFFFF/0xFFFFFFFF
	Hardware Version: 1.0
	Firmware Version: 1.0
	Time: 23:41:05





>> sudo pkcsconf -s

Slot #3 Info
	Description: Linux
	Manufacturer: IBM
	Flags: 0x1 (TOKEN_PRESENT)
	Hardware Version: 0.0
	Firmware Version: 0.0



Only libpkcs11_sw token#3 is present? Why TPM is TOKEN is not recognized.


I appreciate any help

O. farrag

[opencryptoki-users] why TPM TOKEN is not found

[Farrag, O. <Osa...@jh...>]

I am trying to use opencryptoki with TPM, but after configuring and
buildling opencryptoki on system with trousers running and TPM ownership
is setup and SRK is created I am not able to have my TPM token recognized?

Here is what I did 

1- I configured and make opencryoki on my centos7 machine using

>> sh bootstrap.sh



>> ./configure --enable-debug --enable-testcases
--enable-tpmtok --disable-ccatok



:
:

Enabled features:
	Debug build:		yes
	Testcases:		yes
	Daemon build:		yes
	Library build:		yes
	Systemd service:	no


Enabled token types:
	ICA token:		no
	CCA token:		no
	Software token:		yes
	EP11 token:		no
	TPM token:		yes
	ICSF token:		no


Token-specific features:
	pkcsep11migrate build:	no


CFLAGS=-g -O2 -gdwarf-2 -g3 -O0 -DDEBUG   -DPKCS64 -D_XOPEN_SOURCE=600
-Wall -Wno-pointer-sign
-DCONFIG_PATH=\"$(localstatedir)/lib/opencryptoki\"
-DSBIN_PATH=\"$(sbindir)\" -DLIB_PATH=\"$(libdir)\"
-DLOCKDIR_PATH=\"$(lockdir)\" -DOCK_CONFDIR=\"$(sysconfdir)/opencryptoki\"
-DOCK_LOGDIR=\"$(logdir)\"







First I verified  trousers is running

>> ps -A | grep tcsd
 13582 ?        00:00:00 tcsd


I also ran 

tpm_version 
  TPM 1.2 Version Info:
  Chip Version:        1.2.5.81
  Spec Level:          2
  Errata Revision:     3
  TPM Vendor ID:       WEC
  Vendor Specific data: 0000
  TPM Version:         01010000
  Manufacturer Info:   57454300


I have successfully taken ownership of TPM and SRK is already setup in the
TPM hardware

 
I checked the contents of the openCryptoKi configuration file;

vi /etc/opencryptoki/opencryptoki.conf


slot 0
{
stdll = libpkcs11_tpm.so
}


slot 1
{
stdll = libpkcs11_ica.so
}


slot 2
{
stdll = libpkcs11_cca.so
}


slot 3
{
stdll = libpkcs11_sw.so
}


slot 4
{
stdll = libpkcs11_ep11.so
confname = ep11tok.conf
}




But when I used pkcsconf -s to verify that TPM token is present



sudo pkcsconf -s
Š

Slot #3 Info
	Description: Linux
	Manufacturer: IBM
	Flags: 0x1 (TOKEN_PRESENT)
	Hardware Version: 0.0
	Firmware Version: 0.0


Only libpkcs11_sw is present?

What is missing: does the package default build does not include the TPM?
Or is the configuration file is not correct?

[opencryptoki-users] Opencryptoki and Java JCA

[Zbynek N. - G. s.r.o. <zby...@go...>]

Hi Gideon,

did you solve access from Java to AES key stored in the HSM (opencryptoki)?

We have similar issue. If we create AES key using keytool, then we can 
not access it from java.

We get followinf exception: java.security.ProviderException: 
sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID

Thanks,
Zbynek

[opencryptoki-users] sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID

[Craig L. <CL...@fo...>]

Hello,

I am trying to log in with a smart card.  I keep getting the exception sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID.  I have tried several smart cards, and have gotten the same error every time.

My system is Windows 7 64-bit and my java version is 1.7.0_45.

Code:

                    try {
                        File acpkcs64bit = new File("C:\\Progra~2\\ActivIdentity\\ActivClient\\acpkcs211.dll");
                        File pkcsProperties = null;
                        if (acpkcs64bit.exists())
                        {
                            pkcsProperties = new File("L:\\dev\\fullerene\\c60\\miami\\ui\\eas\\suite\\pkcs11.properties");
                        }

                        if (pkcsProperties != null && pkcsProperties.exists()) {
                            Security.addProvider(new sun.security.pkcs11.SunPKCS11(pkcsProperties.getPath()));
                        }
                    } catch (Exception e) {
                        System.out.println("Exception: " + e.getMessage());
                    }

                    try {
                        KeyStore keyStore = KeyStore.getInstance("PKCS11");
                        keyStore.load(null, null);
                    }
                    catch (Exception e) {
                        System.out.println("Failed attempt to login using PKI: " + (e.getMessage()!=null?e.getMessage():""));
                    }

output:

detailMessage: java.io.IOException: load failed
cause: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID

My contents of pkcs11.properties are as follows:

name = ActivClient
library = C:\Progra~2\ActivIdentity\ActivClient\acpkcs211.dll

When I run my IntelliJ configuration with the VM option -Djava.security.debug=sunpkcs11, I get the following output:

SunPKCS11 loading L:\dev\fullerene\c60\miami\ui\eas\suite\pkcs11.properties
Information for provider SunPKCS11-ActivClient
Library info:
  cryptokiVersion: 2.20
  manufacturerID: ActivIdentity
flags: 0
libraryDescription: ActivIdentity Cryptoki
libraryVersion: 1.00
All slots: 0
Slots with tokens: 0
Slot info for slot 0:
  slotDescription: SCM Microsystems Inc. SCR3310 USB Smart Card Reader 0
manufacturerID: Unknown
flags: CKF_TOKEN_PRESENT | CKF_REMOVABLE_DEVICE | CKF_HW_SLOT
hardwareVersion: 1.01
firmwareVersion: 1.01
Token info for token in slot 0:
label: ActivIdentity ActivClient 0
 manufacturerID: unknown manufacturer
model: unknown card
serialNumber: 3430303131443236
flags: CKF_RNG | CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_PROTECTED_AUTHENTICATION_PATH | CKF_TOKEN_INITIALIZED
ulMaxSessionCount: CK_EFFECTIVELY_INFINITE
ulSessionCount: 0
ulMaxRwSessionCount: CK_EFFECTIVELY_INFINITE
ulRwSessionCount: 0
ulMaxPinLen: 8
  ulMinPinLen: 6
ulTotalPublicMemory: CK_UNAVAILABLE_INFORMATION
ulFreePublicMemory: CK_UNAVAILABLE_INFORMATION
ulTotalPrivateMemory: CK_UNAVAILABLE_INFORMATION
ulFreePrivateMemory: CK_UNAVAILABLE_INFORMATION
hardwareVersion: 1.01
firmwareVersion: 1.01
utcTime:
Mechanism CKM_RSA_PKCS:
ulMinKeySize: 512
ulMaxKeySize: 2048
flags: 2817 = CKF_HW | CKF_ENCRYPT | CKF_DECRYPT | CKF_SIGN
Mechanism CKM_RSA_X_509:
ulMinKeySize: 512
ulMaxKeySize: 2048
flags: 2817 = CKF_HW | CKF_ENCRYPT | CKF_DECRYPT | CKF_SIGN
Mechanism CKM_SHA_1:
ulMinKeySize: 4294967295
ulMaxKeySize: 4294967295
flags: 1024 = CKF_DIGEST
Mechanism CKM_SHA256:
ulMinKeySize: 4294967295
ulMaxKeySize: 4294967295
flags: 1024 = CKF_DIGEST
Mechanism Unknown 0x00000000000002A0:
ulMinKeySize: 4294967295
ulMaxKeySize: 4294967295
flags: 2048 = CKF_SIGN

If anyone can help me with this error, I would appreciate it!  I have google’d this error numerous times, and haven’t found an answer that helps.

Thank you!

Craig Larson

Re: [opencryptoki-users] Problems with TrouSerS PKCS#11 interface

[Eduardo M. <ep...@ci...>]

Ok, thanks for the help


2013/8/8 Joy M. Latten <jml...@li...>

> Ok, I will take a look...
>
> regards,
> Joy
>
> On Thu, 2013-08-08 at 08:37 -0300, Eduardo Peixoto Macedo wrote:
> > I'm trying to import it into Firefox's "Your Certificates" tab (Edit
> > -> Preferences -> Encryption tab -> View Certificates -> Your
> > Certificates tab -> Import)
> >
> >
> >
> > 2013/8/7 Eduardo Peixoto Macedo <ep...@ci...>
> >         I'm trying to import it into Firefox's "Your Certificates" tab
> >         (Edit -> Preferences -> Encryption tab -> View Certificates ->
> >         Your Certificates tab -> Import)
> >
> >
> >         2013/8/6 Joy M. Latten <jml...@li...>
> >
> >                 Hi,
> >
> >                 On Thu, 2013-08-01 at 10:16 -0300, Eduardo Peixoto
> >                 Macedo wrote:
> >                 > Hi,
> >                 >
> >                 > I'm trying to import a certificate signed using the
> >                 tpm engine
> >                 > (openssl-tpm-engine) into Firefox on Ubuntu 12.04.
> >                 >
> >                 > I'm using Infineon TPM and I have already configured
> >                 the tpm token
> >                 > with 'tpmtoken_init'. The PKCS#11 module
> >                 (libopencryptoki.so) was
> >                 > successfully imported on Firefox. But when I try to
> >                 import a
> >                 > certificate I get the following alert:
> >                 >
> >                 > "Failed to decode the file.  Either it is not in
> >                 PKCS #12 format, has
> >                 > been corrupted, or the password you entered was
> >                 incorrect."
> >                 >
> >
> >
> >                 So you are generating and signing the certificate in
> >                 openssl-tpm-engine...
> >                 How are you importing the certificate into tpm-token
> >                 in opencryptoki?
> >
> >                 > Here is the command that I am using to generate the
> >                 certificate:
> >                 >
> >                 > "openssl req -keyform engine
> >                 > -engine /usr/local/lib/openssl/engines/libtpm.so
> >                 -key Authroity.key
> >                 > -x509 -out Authority.crt"
> >                 >
> >                 > I tried to create another certificate using:
> >                 >
> >                 > "openssl req -keyform engine
> >                 > -engine /usr/local/lib/openssl/engines/libtpm.so
> >                 -key Client.key -new
> >                 > -out Client.csr"
> >                 > and:
> >                 > "openssl x509 -req -in Client.csr -CA Authority.crt
> >                 -CAkey
> >                 > Authority.key -CAkeyform engine
> >                 > -engine /usr/local/lib/openssl/engines/libtpm.so
> >                 -CAcreateserial -out
> >                 > Client.crt"
> >                 >
> >                 > The keys "Authority.key" and "Client.key" were
> >                 generated using
> >                 > "create_tpm_key".
> >                 >
> >                 >
> >                 >
> >                 >
> >                 >
> >                 > But I get the alert when I try to import any of
> >                 them.
> >                 > Am I doing something wrong?
> >
> >                 >
> >
> ------------------------------------------------------------------------------
> >                 > Get your SQL database under version control now!
> >                 > Version control is standard for application code,
> >                 but databases havent
> >                 > caught up. So what steps can you take to put your
> >                 SQL databases under
> >                 > version control? Why should you start doing it? Read
> >                 more to find out.
> >                 >
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
> >                 > _______________________________________________
> >                 opencryptoki-users mailing list
> >                 ope...@li...
> >
> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
> >
> >
> >
> >
> >
> >
>
>
>

Re: [opencryptoki-users] Problems with TrouSerS PKCS#11 interface

[Joy M. L. <jml...@li...>]

Ok, I will take a look...

regards,
Joy

On Thu, 2013-08-08 at 08:37 -0300, Eduardo Peixoto Macedo wrote:
> I'm trying to import it into Firefox's "Your Certificates" tab (Edit
> -> Preferences -> Encryption tab -> View Certificates -> Your
> Certificates tab -> Import)
> 
> 
> 
> 2013/8/7 Eduardo Peixoto Macedo <ep...@ci...>
>         I'm trying to import it into Firefox's "Your Certificates" tab
>         (Edit -> Preferences -> Encryption tab -> View Certificates ->
>         Your Certificates tab -> Import)
>         
>         
>         2013/8/6 Joy M. Latten <jml...@li...>
>         
>                 Hi,
>                 
>                 On Thu, 2013-08-01 at 10:16 -0300, Eduardo Peixoto
>                 Macedo wrote:
>                 > Hi,
>                 >
>                 > I'm trying to import a certificate signed using the
>                 tpm engine
>                 > (openssl-tpm-engine) into Firefox on Ubuntu 12.04.
>                 >
>                 > I'm using Infineon TPM and I have already configured
>                 the tpm token
>                 > with 'tpmtoken_init'. The PKCS#11 module
>                 (libopencryptoki.so) was
>                 > successfully imported on Firefox. But when I try to
>                 import a
>                 > certificate I get the following alert:
>                 >
>                 > "Failed to decode the file.  Either it is not in
>                 PKCS #12 format, has
>                 > been corrupted, or the password you entered was
>                 incorrect."
>                 >
>                 
>                 
>                 So you are generating and signing the certificate in
>                 openssl-tpm-engine...
>                 How are you importing the certificate into tpm-token
>                 in opencryptoki?
>                 
>                 > Here is the command that I am using to generate the
>                 certificate:
>                 >
>                 > "openssl req -keyform engine
>                 > -engine /usr/local/lib/openssl/engines/libtpm.so
>                 -key Authroity.key
>                 > -x509 -out Authority.crt"
>                 >
>                 > I tried to create another certificate using:
>                 >
>                 > "openssl req -keyform engine
>                 > -engine /usr/local/lib/openssl/engines/libtpm.so
>                 -key Client.key -new
>                 > -out Client.csr"
>                 > and:
>                 > "openssl x509 -req -in Client.csr -CA Authority.crt
>                 -CAkey
>                 > Authority.key -CAkeyform engine
>                 > -engine /usr/local/lib/openssl/engines/libtpm.so
>                 -CAcreateserial -out
>                 > Client.crt"
>                 >
>                 > The keys "Authority.key" and "Client.key" were
>                 generated using
>                 > "create_tpm_key".
>                 >
>                 >
>                 >
>                 >
>                 >
>                 > But I get the alert when I try to import any of
>                 them.
>                 > Am I doing something wrong?
>                 
>                 >
>                 ------------------------------------------------------------------------------
>                 > Get your SQL database under version control now!
>                 > Version control is standard for application code,
>                 but databases havent
>                 > caught up. So what steps can you take to put your
>                 SQL databases under
>                 > version control? Why should you start doing it? Read
>                 more to find out.
>                 >
>                 http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
>                 > _______________________________________________
>                 opencryptoki-users mailing list
>                 ope...@li...
>                 https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>                 
>                 
>         
>         
> 
> 

Re: [opencryptoki-users] Problems with TrouSerS PKCS#11 interface

[Eduardo P. M. <ep...@ci...>]

I'm trying to import it into Firefox's "Your Certificates" tab (Edit ->
Preferences -> Encryption tab -> View Certificates -> Your Certificates tab
-> Import)


2013/8/7 Eduardo Peixoto Macedo <ep...@ci...>

> I'm trying to import it into Firefox's "Your Certificates" tab (Edit ->
> Preferences -> Encryption tab -> View Certificates -> Your Certificates tab
> -> Import)
>
>
> 2013/8/6 Joy M. Latten <jml...@li...>
>
> Hi,
>>
>> On Thu, 2013-08-01 at 10:16 -0300, Eduardo Peixoto Macedo wrote:
>> > Hi,
>> >
>> > I'm trying to import a certificate signed using the tpm engine
>> > (openssl-tpm-engine) into Firefox on Ubuntu 12.04.
>> >
>> > I'm using Infineon TPM and I have already configured the tpm token
>> > with 'tpmtoken_init'. The PKCS#11 module (libopencryptoki.so) was
>> > successfully imported on Firefox. But when I try to import a
>> > certificate I get the following alert:
>> >
>> > "Failed to decode the file.  Either it is not in PKCS #12 format, has
>> > been corrupted, or the password you entered was incorrect."
>> >
>>
>> So you are generating and signing the certificate in
>> openssl-tpm-engine...
>> How are you importing the certificate into tpm-token in opencryptoki?
>>
>> > Here is the command that I am using to generate the certificate:
>> >
>> > "openssl req -keyform engine
>> > -engine /usr/local/lib/openssl/engines/libtpm.so -key Authroity.key
>> > -x509 -out Authority.crt"
>> >
>> > I tried to create another certificate using:
>> >
>> > "openssl req -keyform engine
>> > -engine /usr/local/lib/openssl/engines/libtpm.so -key Client.key -new
>> > -out Client.csr"
>> > and:
>> > "openssl x509 -req -in Client.csr -CA Authority.crt -CAkey
>> > Authority.key -CAkeyform engine
>> > -engine /usr/local/lib/openssl/engines/libtpm.so -CAcreateserial -out
>> > Client.crt"
>> >
>> > The keys "Authority.key" and "Client.key" were generated using
>> > "create_tpm_key".
>> >
>> >
>> >
>> >
>> >
>> > But I get the alert when I try to import any of them.
>> > Am I doing something wrong?
>> >
>> ------------------------------------------------------------------------------
>> > Get your SQL database under version control now!
>> > Version control is standard for application code, but databases havent
>> > caught up. So what steps can you take to put your SQL databases under
>> > version control? Why should you start doing it? Read more to find out.
>> >
>> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
>> > _______________________________________________ opencryptoki-users
>> mailing list ope...@li...
>> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>>
>>
>>
>

Re: [opencryptoki-users] Problems with TrouSerS PKCS#11 interface

[Eduardo P. M. <ep...@ci...>]

I'm trying to import it into Firefox's "Your Certificates" tab (Edit ->
Preferences -> Encryption tab -> View Certificates -> Your Certificates tab
-> Import)


2013/8/6 Joy M. Latten <jml...@li...>

> Hi,
>
> On Thu, 2013-08-01 at 10:16 -0300, Eduardo Peixoto Macedo wrote:
> > Hi,
> >
> > I'm trying to import a certificate signed using the tpm engine
> > (openssl-tpm-engine) into Firefox on Ubuntu 12.04.
> >
> > I'm using Infineon TPM and I have already configured the tpm token
> > with 'tpmtoken_init'. The PKCS#11 module (libopencryptoki.so) was
> > successfully imported on Firefox. But when I try to import a
> > certificate I get the following alert:
> >
> > "Failed to decode the file.  Either it is not in PKCS #12 format, has
> > been corrupted, or the password you entered was incorrect."
> >
>
> So you are generating and signing the certificate in
> openssl-tpm-engine...
> How are you importing the certificate into tpm-token in opencryptoki?
>
> > Here is the command that I am using to generate the certificate:
> >
> > "openssl req -keyform engine
> > -engine /usr/local/lib/openssl/engines/libtpm.so -key Authroity.key
> > -x509 -out Authority.crt"
> >
> > I tried to create another certificate using:
> >
> > "openssl req -keyform engine
> > -engine /usr/local/lib/openssl/engines/libtpm.so -key Client.key -new
> > -out Client.csr"
> > and:
> > "openssl x509 -req -in Client.csr -CA Authority.crt -CAkey
> > Authority.key -CAkeyform engine
> > -engine /usr/local/lib/openssl/engines/libtpm.so -CAcreateserial -out
> > Client.crt"
> >
> > The keys "Authority.key" and "Client.key" were generated using
> > "create_tpm_key".
> >
> >
> >
> >
> >
> > But I get the alert when I try to import any of them.
> > Am I doing something wrong?
> >
> ------------------------------------------------------------------------------
> > Get your SQL database under version control now!
> > Version control is standard for application code, but databases havent
> > caught up. So what steps can you take to put your SQL databases under
> > version control? Why should you start doing it? Read more to find out.
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
> > _______________________________________________ opencryptoki-users
> mailing list ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>
>
>

Re: [opencryptoki-users] Problems with TrouSerS PKCS#11 interface

[Joy M. L. <jml...@li...>]

Hi, 

On Thu, 2013-08-01 at 10:16 -0300, Eduardo Peixoto Macedo wrote:
> Hi,
> 
> I'm trying to import a certificate signed using the tpm engine
> (openssl-tpm-engine) into Firefox on Ubuntu 12.04.
> 
> I'm using Infineon TPM and I have already configured the tpm token
> with 'tpmtoken_init'. The PKCS#11 module (libopencryptoki.so) was
> successfully imported on Firefox. But when I try to import a
> certificate I get the following alert:
> 
> "Failed to decode the file.  Either it is not in PKCS #12 format, has
> been corrupted, or the password you entered was incorrect."
> 

So you are generating and signing the certificate in
openssl-tpm-engine...
How are you importing the certificate into tpm-token in opencryptoki?

> Here is the command that I am using to generate the certificate:
> 
> "openssl req -keyform engine
> -engine /usr/local/lib/openssl/engines/libtpm.so -key Authroity.key
> -x509 -out Authority.crt"
> 
> I tried to create another certificate using:
> 
> "openssl req -keyform engine
> -engine /usr/local/lib/openssl/engines/libtpm.so -key Client.key -new
> -out Client.csr"
> and:
> "openssl x509 -req -in Client.csr -CA Authority.crt -CAkey
> Authority.key -CAkeyform engine
> -engine /usr/local/lib/openssl/engines/libtpm.so -CAcreateserial -out
> Client.crt"
> 
> The keys "Authority.key" and "Client.key" were generated using
> "create_tpm_key".
> 
> 
> 
> 
> 
> But I get the alert when I try to import any of them.
> Am I doing something wrong?
> ------------------------------------------------------------------------------
> Get your SQL database under version control now!
> Version control is standard for application code, but databases havent 
> caught up. So what steps can you take to put your SQL databases under 
> version control? Why should you start doing it? Read more to find out.
> http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
> _______________________________________________ opencryptoki-users mailing list ope...@li... https://lists.sourceforge.net/lists/listinfo/opencryptoki-users

[opencryptoki-users] Problems with TrouSerS PKCS#11 interface

[Eduardo P. M. <ep...@ci...>]

Hi,

I'm trying to import a certificate signed using the tpm engine
(openssl-tpm-engine) into Firefox on Ubuntu 12.04.

I'm using Infineon TPM and I have already configured the tpm token with
'tpmtoken_init'. The PKCS#11 module (libopencryptoki.so) was successfully
imported on Firefox. But when I try to import a certificate I get the
following alert:

"Failed to decode the file.  Either it is not in PKCS #12 format, has been
corrupted, or the password you entered was incorrect."

Here is the command that I am using to generate the certificate:

"openssl req -keyform engine -engine
/usr/local/lib/openssl/engines/libtpm.so -key Authroity.key -x509 -out
Authority.crt"

I tried to create another certificate using:

"openssl req -keyform engine -engine
/usr/local/lib/openssl/engines/libtpm.so -key Client.key -new -out
Client.csr"
and:
"openssl x509 -req -in Client.csr -CA Authority.crt -CAkey Authority.key
-CAkeyform engine -engine /usr/local/lib/openssl/engines/libtpm.so
-CAcreateserial -out Client.crt"

The keys "Authority.key" and "Client.key" were generated using
"create_tpm_key".


But I get the alert when I try to import any of them.
Am I doing something wrong?

[opencryptoki-users] opencryptoki broken on ubuntu 12.04?

[JMC <mls...@gm...>]

Hi List,
I have been trying for quite a while to get my tpm chip to work with
opencryptoki on ubuntu 12.04 x64.
All packages have been install from the official ubuntu repository
(trousers, tpm-tools, opencryptoki).

Trousers seem to be working fine:

tpm_version
  TPM 1.2 Version Info:
  Chip Version:        1.2.8.32
  Spec Level:          2
  Errata Revision:     3
  TPM Vendor ID:       STM
  TPM Version:         01010000
  Manufacturer Info:   53544d20

I took ownership of the chip and it worked fine.

The PIN for the SRK is set to null by just pressing enter after running:

tpm_changeownerauth -s -z -l debug
Tspi_Context_Create success
Tspi_Context_Connect success
Tspi_Context_GetTpmObject success
Tspi_GetPolicyObject success
Tspi_Policy_SetSecret success
Changing password for: SRK.
Enter new SRK password: <enter>
Confirm password: <enter>
Tspi_Context_CreateObject success
Tspi_Policy_SetSecret success
Tspi_Context_LoadKeyByUUID success
Tspi_ChangeAuth success
Change of SRK password successful.
Tspi_Context_FreeMemory success
Tspi_Context_Close success

However tpmtoken_init just fails:
tpmtoken_init -l debug
C_GetFunctionList success
C_Initialize success
C_GetSlotList success
Slots present: 2
C_GetSlotList success
Retrieving slot information for SlotID 0
C_GetSlotInfo success
Slot description: Linux 3.2.0-33-generic Linux (TPM)
Slot manufacturer: Linux 3.2.0-33-generic
Token is present
Retrieving token information for SlotID 0
C_GetTokenInfo success
Token Label: IBM PKCS#11 TPM Token
Token manufacturer: IBM Corp.
Token model: TPM v1.1 Token
Token is not initialized
C_InitToken success
C_OpenSession success
C_Login success
A new TPM security officer password is needed. The password must be
between 4 and 8 characters in length.
Enter new password:
Confirm password:
C_SetPIN success
C_CloseSession success
C_OpenSession success
C_Login failed: 0x00000102 (258)
C_CloseSession success
C_Finalize success
tpmtoken_init failed

I never managed to set the user password (I man not even prompted for
one). The necessary files under
/var/lib/opencryptoki/tpm/<user>/TOK_OBJ/ are not created (this
directory is empty).

I am running out of ideas, any help much appreciated!

/JM

Re: [opencryptoki-users] [TrouSerS-users] Trouble with tpmtoken_init

[rick <sl...@xt...>]

Kent Yoder <shpedoikal <at> gmail.com> writes:

> 
> > Hi Kent.  Thank  you for the reply.
> >
> > As you can see I do rm -rf the tpm dir, run pkcs11_startup and restart 
pkcsslotd
> > often with the same unfortunate result.
> >
> > Is there any other place that TPM stuff is "remembered"?
> 
>   Nope - what version of opencryptoki are you using?
> 
> Kent
> 

2.3.1  from apt-get on Ubuntu 12.04.1 server (whats up there now).

-Rick

Re: [opencryptoki-users] [TrouSerS-users] Trouble with tpmtoken_init

[rick <sl...@xt...>]

Tom Lendacky <toml <at> us.ibm.com> writes:
...
> > > > 6. tpm_restrictsrk -a
> > > >
> > > > 7. tpmtoken_init -l debug
...
> > > > Confirm password:123456
> > > > C_SetPIN success
> > > > C_CloseSession success
> > > > C_OpenSession success
> > > > C_Login failed: 0x00000102 (258)
> > > 
> > >   This fails because the load of the Public root key failed - and that
> > > failed because it was wrapped by the *old* SRK.  To get rid of the old
> > > public root key, you can just blow away /var/lib/opencryptoki/tpm.
> > > 
> > > Kent
...
> > > > Sure, I do rm -rf /var/lib/opencryptoki/tpm
> > > >    pkcs11_startup
> > > >    /etc/init.d/opencryptoki restart
> > > > and try again but no go for most systems.
> > > >
> > 
> > Hi Kent.  Thank  you for the reply.
> > 
> > As you can see I do rm -rf the tpm dir, run pkcs11_startup and 
> > restart pkcsslotd
> > often with the same unfortunate result.You might want to check the ownership 
and/or permissions of the tpm dir.I seem to recall there were sometimes issues 
in this area. Kent can probablypost what the proper ownership and permissions 
should look like for thedirectory and files.Tom
> > 
> > Is there any other place that TPM stuff is "remembered"?
> > 

Thank you Tom. This makes sense but I have tried different combinations to no 
avail.  Maybe the problem is that I am doing everything as root?

/etc/group:
..
pkcs11:x:113:root
tss:x:114:

and before "tpmtoken_init -l debug"

# ls -lat /var/lib/opencryptoki                       total 24
drwxrwxrwx  4 root pkcs11 4096 Sep 11 12:54 .
-rw-r--r--  1 root root      4 Sep 11 12:54 .slotpid
-rw-rwxr--  1 root root    267 Sep 11 12:54 pk_config_data
drwxrwxr-x  3 root pkcs11 4096 Sep 11 12:54 swtok
drwxrwxr-x  2 root pkcs11 4096 Sep 11 12:54 tpm
drwxr-xr-x 38 root root   4096 Sep 10 19:47 ..
# ls -lat /var/lib/opencryptoki/tpm
total 8
drwxrwxrwx 4 root pkcs11 4096 Sep 11 12:54 ..
drwxrwxr-x 2 root pkcs11 4096 Sep 11 12:54 .

after FAILED "tpmtoken_init -l debug"
# tpmtoken_init -l debug
C_GetFunctionList success
C_Initialize success
C_GetSlotList success
Slots present: 2
C_GetSlotList success
Retrieving slot information for SlotID 0
C_GetSlotInfo success
Slot description: Linux 3.2.0-29-generic-pae Linux (TPM)
Slot manufacturer: Linux 3.2.0-29-generic-pae
Token is present
Retrieving token information for SlotID 0
C_GetTokenInfo success
Token Label: IBM PKCS#11 TPM Token
Token manufacturer: IBM Corp.
Token model: TPM v1.1 Token
Token is not initialized
C_InitToken success
C_OpenSession success
C_Login success
A new TPM security officer password is needed. The password must be between 4 
and 8 characters in length.
Enter new password:
Confirm password:
C_SetPIN success
C_CloseSession success
C_OpenSession success
C_Login failed: 0x00000102 (258)
C_CloseSession success
C_Finalize success
tpmtoken_init failed

# ls -latR /var/lib/opencryptoki/tpm

/var/lib/opencryptoki/tpm:
total 20
-rw-rw-r-- 1 root pkcs11   48 Sep 11 12:56 MK_SO
-rw-rw-r-- 1 root pkcs11  232 Sep 11 12:56 NVTOK.DAT
drwxrwxr-x 3 root pkcs11 4096 Sep 11 12:56 .
drwx------ 3 root root   4096 Sep 11 12:56 root
drwxrwxrwx 4 root pkcs11 4096 Sep 11 12:54 ..

/var/lib/opencryptoki/tpm/root:
total 100
drwx------ 3 root root    4096 Sep 11 12:56 .
drwxrwxr-x 3 root pkcs11  4096 Sep 11 12:56 ..
-rw------- 1 root root     232 Sep 11 12:56 NVTOK.DAT
-rwx------ 1 root root   82168 Sep 11 12:56 .stmapfile
drwx------ 2 root root    4096 Sep 11 12:56 TOK_OBJ

/var/lib/opencryptoki/tpm/root/TOK_OBJ:
total 8
drwx------ 2 root root 4096 Sep 11 12:56 .
drwx------ 3 root root 4096 Sep 11 12:56 ..

/usr/sbin/tcsd and /usr/sbin/pkcsslotd are running

Re: [opencryptoki-users] [TrouSerS-users] Trouble with tpmtoken_init

[Kent Y. <shp...@gm...>]

> Hi Kent.  Thank  you for the reply.
>
> As you can see I do rm -rf the tpm dir, run pkcs11_startup and restart pkcsslotd
> often with the same unfortunate result.
>
> Is there any other place that TPM stuff is "remembered"?

  Nope - what version of opencryptoki are you using?

Kent

-- 
IBM LTC Security

Re: [opencryptoki-users] [TrouSerS-users] Trouble with tpmtoken_init

[Tom L. <to...@us...>]

rick <sl...@xt...> wrote on 09/10/2012 10:51:05 PM:

> From: rick <sl...@xt...>
> To: ope...@li...,
> Date: 09/10/2012 11:06 PM
> Subject: Re: [opencryptoki-users] [TrouSerS-users] Trouble with
tpmtoken_init
>
>
> > > 6. tpm_restrictsrk -a
> > >
> > > 7. tpmtoken_init -l debug
> ...
> >
> > > Confirm password:123456
> > > C_SetPIN success
> > > C_CloseSession success
> > > C_OpenSession success
> > > C_Login failed: 0x00000102 (258)
> >
> >   This fails because the load of the Public root key failed - and that
> > failed because it was wrapped by the *old* SRK.  To get rid of the old
> > public root key, you can just blow away /var/lib/opencryptoki/tpm.
> >
> > Kent
> >
> ...
> > >
> > > Sure, I do rm -rf /var/lib/opencryptoki/tpm
> > >    pkcs11_startup
> > >    /etc/init.d/opencryptoki restart
> > > and try again but no go for most systems.
> > >
>
> Hi Kent.  Thank  you for the reply.
>
> As you can see I do rm -rf the tpm dir, run pkcs11_startup and
> restart pkcsslotd
> often with the same unfortunate result.

You might want to check the ownership and/or permissions of the tpm dir.
I seem to recall there were sometimes issues in this area. Kent can
probably
post what the proper ownership and permissions should look like for the
directory and files.

Tom

>
> Is there any other place that TPM stuff is "remembered"?
>
>
>
>
>
>
>
------------------------------------------------------------------------------

> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions

> will include endpoint security, mobile security and the latest in malware

> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> opencryptoki-users mailing list
> ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>

Re: [opencryptoki-users] [TrouSerS-users] Trouble with tpmtoken_init

[rick <sl...@xt...>]

> > 6. tpm_restrictsrk -a
> >
> > 7. tpmtoken_init -l debug
...
> 
> > Confirm password:123456
> > C_SetPIN success
> > C_CloseSession success
> > C_OpenSession success
> > C_Login failed: 0x00000102 (258)
> 
>   This fails because the load of the Public root key failed - and that
> failed because it was wrapped by the *old* SRK.  To get rid of the old
> public root key, you can just blow away /var/lib/opencryptoki/tpm.
> 
> Kent
> 
...
> >
> > Sure, I do rm -rf /var/lib/opencryptoki/tpm
> >    pkcs11_startup
> >    /etc/init.d/opencryptoki restart
> > and try again but no go for most systems.
> >

Hi Kent.  Thank  you for the reply.

As you can see I do rm -rf the tpm dir, run pkcs11_startup and restart pkcsslotd
often with the same unfortunate result.

Is there any other place that TPM stuff is "remembered"?

Re: [opencryptoki-users] [TrouSerS-users] Trouble with tpmtoken_init

[Kent Y. <shp...@gm...>]

Hi Rick,

On Fri, Sep 7, 2012 at 11:37 PM, rick <sl...@xt...> wrote:
> Can anyone help? Here are the steps I take:
>
> 1. Install fresh copy of Ubuntu 12.04 i386 server onto a Dell Optiplex 755 (a
> machine referenced by other TPM examples and known to work).
>
> 2. Go to bios Security->TPM settings and CLEAR and ACKNOWLEDGE and ACTIVATE.
>
> 3. power down the machine.  Power up the machine.  Log in as root.
>
> 4. apt-get install tpm-tools  Which pulls in trousers and opencryptoki and
> successfully starts tcsd.
>
> 5. tpm_takeownership
> Enter owner password:<CR>
> Confirm password:<CR>
> Enter SRK password:<CR>
> Confirm password:<CR>
> ...2 min wait....
>
> 6. tpm_restrictsrk -a
>
> 7. tpmtoken_init -l debug
> C_GetFunctionList success
> C_Initialize success
> C_GetSlotList success
> Slots present: 2
> C_GetSlotList success
> Retrieving slot information for SlotID 0
> C_GetSlotInfo success
> Slot description: Linux 3.2.0-29-generic-pae Linux (TPM)
> Slot manufacturer: Linux 3.2.0-29-generic-pae
> Token is present
> Retrieving token information for SlotID 0
> C_GetTokenInfo success
> Token Label: IBM PKCS#11 TPM Token
> Token manufacturer: IBM Corp.
> Token model: TPM v1.1 Token
> Token is not initialized
> C_InitToken success
> C_OpenSession success
> C_Login success
> A new TPM security officer password is needed. The password must be between 4
> and 8 characters in length.
> Enter new password:123456    (yes: using 87654321 here fails /w pkcs err 0xA1)

  This means that the opencryptoki data on disk is still hanging
around from your last attempt at init.  That will include a key
wrapped by the *previous* SRK.

> Confirm password:123456
> C_SetPIN success
> C_CloseSession success
> C_OpenSession success
> C_Login failed: 0x00000102 (258)

  This fails because the load of the Public root key failed - and that
failed because it was wrapped by the *old* SRK.  To get rid of the old
public root key, you can just blow away /var/lib/opencryptoki/tpm.

Kent

> C_CloseSession success
> C_Finalize success
> tpmtoken_init failed
>
>
> Any clues?
>
> Sure, I do rm -rf /var/lib/opencryptoki/tpm
>    pkcs11_startup
>    /etc/init.d/opencryptoki restart
> and try again but no go for most systems.
>
> My gut says it might be a HSM slot identity problem since opensc tools get
> confused between sw and tpm slots when slot numbers are used to identify them.
> But I am not the expert.
>
> It would really be good if there was a way to get this to work out of the box.
>
> Thank you,
> -Rick
>
> [1] I recently gave up and just built my own MPU board /w a atmel 3204 chip and
> my own pkcs11 library (10 1024rsa/s instead of the 1 rsa/s using opencryptoki).
>
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> TrouSerS-users mailing list
> Tro...@li...
> https://lists.sourceforge.net/lists/listinfo/trousers-users



-- 
IBM LTC Security

Re: [opencryptoki-users] Opencryptoki and Java JCA

[Gideon K. <gid...@go...>]

Hi,

I was wondering if somone has already investigated the problem?

Gideon

2012/6/29 Joy Latten <la...@us...>:
> Ok, I will take a look at this as soon as I can.
>
> Thanks!
>
> regards,
> Joy
>
> Gideon Knocke <gid...@go...> wrote on 06/29/2012 07:37:08 AM:
>
>> Gideon Knocke <gid...@go...>
>> 06/29/2012 07:37 AM
>>
>> To
>>
>> ope...@li...,
>>
>> cc
>>
>> Subject
>>
>> Re: [opencryptoki-users] Opencryptoki and Java JCA
>>
>> Here is what I did to generate the key:
>>
>> /usr/lib/jvm/jdk1.7.0/bin/keytool -genseckey -keystore NONE -storetype
>> PKCS11 -keyalg AES -keysize 256 -alias test
>>
>> I had expected that an error like this would occur while storing the
>> key, not when I try to read the key.
>>
>> I tried to perform the same task in Java:
>>
>>                //Initialize and login
>>                char[] pin = {'1','2','3','4','5','6'};
>>                KeyStore ks = KeyStore.getInstance("PKCS11");
>>                ks.load(null, pin);
>>                //Generate the key
>>                KeyGenerator keygen = KeyGenerator.getInstance("AES");
>>                keygen.init(256);
>>                SecretKey secretKey = keygen.generateKey();
>>                //Write the secret key to the token
>>                KeyStore.SecretKeyEntry keyEntry = new
>>                KeyStore.SecretKeyEntry(secretKey);
>>                ks.setEntry(args[0], keyEntry, new
>>                KeyStore.PasswordProtection(pin));
>>
>> But the problem is still the same.
>>
>> In this case the key is generated with the RNG of the TPM and then
>> stored in the token.
>>
>> Gideon
>>
>> 2012/6/26 Joy Latten <la...@us...>:
>> > Let me make sure I understand.
>> > Are you trying to store an externally generated AES key ?
>> > If so, how are you creating the pkcs#11 secret key object?
>> >
>> > regards,
>> > Joy
>> >
>> > Gideon Knocke <gid...@go...> wrote on 06/25/2012 08:30:40
>> > AM:
>> >
>> >> Gideon Knocke <gid...@go...>
>> >> 06/25/2012 08:30 AM
>> >>
>> >> To
>> >>
>> >> ope...@li...,
>> >>
>> >> cc
>> >>
>> >> Subject
>> >>
>> >> [opencryptoki-users] Opencryptoki and Java JCA
>> >>
>> >> Hi,
>> >>
>> >> I'm trying to use the Sun PKCS#11 provider to manage my TPM token. I
>> >> can use stored symmetric keys within a Java program but I'm not able
>> >> to store an AES key in the token. In fact I can store the key but I am
>> >> not able to read the stored key. The same problem occurs when I use
>> >> keytool to generate and store a secret key. This is the error which
>> >> occurs when I try to read the secret key:
>> >>
>> >> Exception in thread "main" java.security.ProviderException:
>> >> sun.security.pkcs11.wrapper.PKCS11Exception:
>> >> CKR_ATTRIBUTE_TYPE_INVALID
>> >>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:335)
>> >>  at java.security.KeyStore.getKey(KeyStore.java:792)
>> >>  at Java4.main(Java4.java:16)
>> >> Caused by: sun.security.pkcs11.wrapper.PKCS11Exception:
>> >> CKR_ATTRIBUTE_TYPE_INVALID
>> >>  at sun.security.pkcs11.wrapper.PKCS11.C_GetAttributeValue(Native
>> >> Method)
>> >>  at sun.security.pkcs11.P11KeyStore.loadSkey(P11KeyStore.java:1306)
>> >>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:328)
>> >>  ... 2 more
>> >>
>> >> I haven't specified any additional Attibutes. The problem does not
>> >> occur if the key is generated with "tpmtoken_protect".
>> >> The used software is Java 1.7 and Opencryptoki 2.4.2
>> >>
>> >> Thanks!
>> >>
>> >>
>> >>
>>
>> ------------------------------------------------------------------------------
>> >> Live Security Virtual Conference
>> >> Exclusive live event will cover all the ways today's security and
>> >> threat landscape has changed and how IT managers can respond.
>> >> Discussions
>> >> will include endpoint security, mobile security and the latest in
>> >> malware
>> >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> >> _______________________________________________
>> >> opencryptoki-users mailing list
>> >> ope...@li...
>> >> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>> >>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> opencryptoki-users mailing list
>> ope...@li...
>> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users

Re: [opencryptoki-users] Opencryptoki and Java JCA

[Joy L. <la...@us...>]

Ok, I will take a look at this as soon as I can.

Thanks!

regards,
Joy

Gideon Knocke <gid...@go...> wrote on 06/29/2012 07:37:08
AM:

> Gideon Knocke <gid...@go...>
> 06/29/2012 07:37 AM
>
> To
>
> ope...@li...,
>
> cc
>
> Subject
>
> Re: [opencryptoki-users] Opencryptoki and Java JCA
>
> Here is what I did to generate the key:
>
> /usr/lib/jvm/jdk1.7.0/bin/keytool -genseckey -keystore NONE -storetype
> PKCS11 -keyalg AES -keysize 256 -alias test
>
> I had expected that an error like this would occur while storing the
> key, not when I try to read the key.
>
> I tried to perform the same task in Java:
>
>                //Initialize and login
>                char[] pin = {'1','2','3','4','5','6'};
>                KeyStore ks = KeyStore.getInstance("PKCS11");
>                ks.load(null, pin);
>                //Generate the key
>                KeyGenerator keygen = KeyGenerator.getInstance("AES");
>                keygen.init(256);
>                SecretKey secretKey = keygen.generateKey();
>                //Write the secret key to the token
>                KeyStore.SecretKeyEntry keyEntry = new
>                KeyStore.SecretKeyEntry(secretKey);
>                ks.setEntry(args[0], keyEntry, new
>                KeyStore.PasswordProtection(pin));
>
> But the problem is still the same.
>
> In this case the key is generated with the RNG of the TPM and then
> stored in the token.
>
> Gideon
>
> 2012/6/26 Joy Latten <la...@us...>:
> > Let me make sure I understand.
> > Are you trying to store an externally generated AES key ?
> > If so, how are you creating the pkcs#11 secret key object?
> >
> > regards,
> > Joy
> >
> > Gideon Knocke <gid...@go...> wrote on 06/25/2012
08:30:40 AM:
> >
> >> Gideon Knocke <gid...@go...>
> >> 06/25/2012 08:30 AM
> >>
> >> To
> >>
> >> ope...@li...,
> >>
> >> cc
> >>
> >> Subject
> >>
> >> [opencryptoki-users] Opencryptoki and Java JCA
> >>
> >> Hi,
> >>
> >> I'm trying to use the Sun PKCS#11 provider to manage my TPM token. I
> >> can use stored symmetric keys within a Java program but I'm not able
> >> to store an AES key in the token. In fact I can store the key but I am
> >> not able to read the stored key. The same problem occurs when I use
> >> keytool to generate and store a secret key. This is the error which
> >> occurs when I try to read the secret key:
> >>
> >> Exception in thread "main" java.security.ProviderException:
> >> sun.security.pkcs11.wrapper.PKCS11Exception:
> >> CKR_ATTRIBUTE_TYPE_INVALID
> >>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:335)
> >>  at java.security.KeyStore.getKey(KeyStore.java:792)
> >>  at Java4.main(Java4.java:16)
> >> Caused by: sun.security.pkcs11.wrapper.PKCS11Exception:
> >> CKR_ATTRIBUTE_TYPE_INVALID
> >>  at sun.security.pkcs11.wrapper.PKCS11.C_GetAttributeValue(Native
Method)
> >>  at sun.security.pkcs11.P11KeyStore.loadSkey(P11KeyStore.java:1306)
> >>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:328)
> >>  ... 2 more
> >>
> >> I haven't specified any additional Attibutes. The problem does not
> >> occur if the key is generated with "tpmtoken_protect".
> >> The used software is Java 1.7 and Opencryptoki 2.4.2
> >>
> >> Thanks!
> >>
> >>
> >>
>
------------------------------------------------------------------------------

> >> Live Security Virtual Conference
> >> Exclusive live event will cover all the ways today's security and
> >> threat landscape has changed and how IT managers can respond.
Discussions
> >> will include endpoint security, mobile security and the latest in
malware
> >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> >> _______________________________________________
> >> opencryptoki-users mailing list
> >> ope...@li...
> >> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
> >>
>
>
------------------------------------------------------------------------------

> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions

> will include endpoint security, mobile security and the latest in malware

> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> opencryptoki-users mailing list
> ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users

Re: [opencryptoki-users] Opencryptoki and Java JCA

[Gideon K. <gid...@go...>]

Here is what I did to generate the key:

/usr/lib/jvm/jdk1.7.0/bin/keytool -genseckey -keystore NONE -storetype
PKCS11 -keyalg AES -keysize 256 -alias test

I had expected that an error like this would occur while storing the
key, not when I try to read the key.

I tried to perform the same task in Java:

               //Initialize and login
               char[] pin = {'1','2','3','4','5','6'};
               KeyStore ks = KeyStore.getInstance("PKCS11");
               ks.load(null, pin);
               //Generate the key
               KeyGenerator keygen = KeyGenerator.getInstance("AES");
               keygen.init(256);
               SecretKey secretKey = keygen.generateKey();
               //Write the secret key to the token
               KeyStore.SecretKeyEntry keyEntry = new
               KeyStore.SecretKeyEntry(secretKey);
               ks.setEntry(args[0], keyEntry, new
               KeyStore.PasswordProtection(pin));

But the problem is still the same.

In this case the key is generated with the RNG of the TPM and then
stored in the token.

Gideon

2012/6/26 Joy Latten <la...@us...>:
> Let me make sure I understand.
> Are you trying to store an externally generated AES key ?
> If so, how are you creating the pkcs#11 secret key object?
>
> regards,
> Joy
>
> Gideon Knocke <gid...@go...> wrote on 06/25/2012 08:30:40 AM:
>
>> Gideon Knocke <gid...@go...>
>> 06/25/2012 08:30 AM
>>
>> To
>>
>> ope...@li...,
>>
>> cc
>>
>> Subject
>>
>> [opencryptoki-users] Opencryptoki and Java JCA
>>
>> Hi,
>>
>> I'm trying to use the Sun PKCS#11 provider to manage my TPM token. I
>> can use stored symmetric keys within a Java program but I'm not able
>> to store an AES key in the token. In fact I can store the key but I am
>> not able to read the stored key. The same problem occurs when I use
>> keytool to generate and store a secret key. This is the error which
>> occurs when I try to read the secret key:
>>
>> Exception in thread "main" java.security.ProviderException:
>> sun.security.pkcs11.wrapper.PKCS11Exception:
>> CKR_ATTRIBUTE_TYPE_INVALID
>>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:335)
>>  at java.security.KeyStore.getKey(KeyStore.java:792)
>>  at Java4.main(Java4.java:16)
>> Caused by: sun.security.pkcs11.wrapper.PKCS11Exception:
>> CKR_ATTRIBUTE_TYPE_INVALID
>>  at sun.security.pkcs11.wrapper.PKCS11.C_GetAttributeValue(Native Method)
>>  at sun.security.pkcs11.P11KeyStore.loadSkey(P11KeyStore.java:1306)
>>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:328)
>>  ... 2 more
>>
>> I haven't specified any additional Attibutes. The problem does not
>> occur if the key is generated with "tpmtoken_protect".
>> The used software is Java 1.7 and Opencryptoki 2.4.2
>>
>> Thanks!
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> opencryptoki-users mailing list
>> ope...@li...
>> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>>

Re: [opencryptoki-users] Opencryptoki and Java JCA

[Joy L. <la...@us...>]

Let me make sure I understand.
Are you trying to store an externally generated AES key ?
If so, how are you creating the pkcs#11 secret key object?

regards,
Joy

Gideon Knocke <gid...@go...> wrote on 06/25/2012 08:30:40
AM:

> Gideon Knocke <gid...@go...>
> 06/25/2012 08:30 AM
>
> To
>
> ope...@li...,
>
> cc
>
> Subject
>
> [opencryptoki-users] Opencryptoki and Java JCA
>
> Hi,
>
> I'm trying to use the Sun PKCS#11 provider to manage my TPM token. I
> can use stored symmetric keys within a Java program but I'm not able
> to store an AES key in the token. In fact I can store the key but I am
> not able to read the stored key. The same problem occurs when I use
> keytool to generate and store a secret key. This is the error which
> occurs when I try to read the secret key:
>
> Exception in thread "main" java.security.ProviderException:
> sun.security.pkcs11.wrapper.PKCS11Exception:
> CKR_ATTRIBUTE_TYPE_INVALID
>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:335)
>  at java.security.KeyStore.getKey(KeyStore.java:792)
>  at Java4.main(Java4.java:16)
> Caused by: sun.security.pkcs11.wrapper.PKCS11Exception:
> CKR_ATTRIBUTE_TYPE_INVALID
>  at sun.security.pkcs11.wrapper.PKCS11.C_GetAttributeValue(Native Method)
>  at sun.security.pkcs11.P11KeyStore.loadSkey(P11KeyStore.java:1306)
>  at sun.security.pkcs11.P11KeyStore.engineGetKey(P11KeyStore.java:328)
>  ... 2 more
>
> I haven't specified any additional Attibutes. The problem does not
> occur if the key is generated with "tpmtoken_protect".
> The used software is Java 1.7 and Opencryptoki 2.4.2
>
> Thanks!
>
>
------------------------------------------------------------------------------

> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions

> will include endpoint security, mobile security and the latest in malware

> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> opencryptoki-users mailing list
> ope...@li...
> https://lists.sourceforge.net/lists/listinfo/opencryptoki-users
>