xmlsectool can't find keys on eTokenPro

[Ian Young]

> On 19 Sep 2017, at 14:42, Rainer Hoerbe <rainer at hoerbe.at> wrote:
> 
> This seems to be the cause. `pkcs11-tool -cert` does list pubkeys as well.

> keytool shows no objects on the token. Also, when I try to use the token with `openssl -engine pkcs11` it will not find the key (possibly I did not get the the PKCS11-URL format right?). The vendor’s SAC-tool will show the same label/alias as pkcs11-tool.

If keytool doesn't understand the token properly, you won't get good results with anything written in Java that relies on the Java PKCS#11 bridge. You need to use vendor tools or the pkcs tools to set the token up before you will be able to make progress.

> tried to create a create certificate from the existing RSA key pair on the token. Spending quite a few hours I had no success so far. I do not want to re-create the key pair, because I want to replace pyff’s signing with xmlsectool because of xmldsig interop issues. pyff’s xmldsig library can create a signature just from the key pair, however, so I do not have certificates so far.

I can tell you what I did on the token I use (a Nitrokey HSM). Roughly:

# make the keypair
pkcs11-tool --login --pin XXX --keypairgen --key-type rsa:2048 --id 10 --label "test 2048"

# make a self-signed certificate signed by that keypair
OPENSSL_CONF=./hsm.conf openssl req -engine pkcs11 -keyform engine -new -key 0:10 -nodes -days 3560 -x509 -sha256 -out key10cert.pem -subj "/C=UK/ST=Scotland/L=Edinburgh/O=Ian A. Young/CN=key10"

# convert the cert to DER
openssl x509 -in key10cert.pem -out key10cert.der -inform pem -outform der

# write the cert to the HSM
pkcs11-tool --write-object key10cert.der --type cert --id 10 --login --pin XXX --label key10

If you use pkcs11-tool --list-objects at this stage you should see that there's a certificate there as well.

> Do you see any trivial option to tweak xmlsectool into using the public key instead of a x509 cert?

It's not trivial to change the code in this way. It's central to XMLSecTool's current operation that it has a certificate and key, not just a key. Obviously it would be possible to extend it, but I think it would be much simpler to get the token set up properly.

    -- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170919/e1e7a141/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170919/e1e7a141/attachment.p7s>