<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Rickard,<div><br></div><div>Thank you for the clarifications. Thanks also to Roland for the previous information.</div><div>I will check in more details my trials and get back to you, if there are still some issues.</div><div><br></div><div>In addition, concerning the key generation are there any advises when to use the function C_CreateObject instead of C_GenerateKey ? I'm rising this question since, as given in the specification, we can use both of them for key generation. But what would be the best choice?</div><div><br></div><div>Thanks in advance.</div><div><br></div><div>Best,</div><div>Elizabeta</div><div><br></div><div><br><div><div>Le 14 avr. 2015 à 20:58, Rickard Bellgrim <<a href="mailto:rickard@opendnssec.org">rickard@opendnssec.org</a>> a écrit :</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Hi Elizabeta<div><br></div><div>C_Login() will log in the user on the token, thus changing the login state for all sessions on that token. The test script will login using hSessionRO, but hSessionRW will also move from the public state to the user state.</div><div><br></div><div>If you add C_Logout(hSessionRO) after the key generation and then try to create a signature, you should get rv==CKR_USER_NOT_LOGGED_IN.</div><div><br></div><div>It is not possible to use a private object (CKA_PRIVATE==CK_TRUE) without being logged in. You need the PIN to decrypt the key material.</div><div><br></div><div>// Rickard<br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 14, 2015 at 3:21 PM, Elizabeta <span dir="ltr"><<a href="mailto:elizabeta.fourneret@gmail.com" target="_blank">elizabeta.fourneret@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi Roland,<br>
<br>
I have a set of CPPUNIT tests for PKCS#11 that I'm using to discover SoftHSM, based on the SoftHSM v2 test configuration.<br>
For key generation, I'm using the generateKey function (see SignVerifyTests.cpp in the SoftHSM v2 test folder).<br>
<br>
However, the outcome of my tests, even if the CKA_PRIVATE attribute is CK_TRUE, is that I'm managing to sign without authentication.<br>
<br>
Cheers,<br>
Elizabeta<br>
<div class=""><div class="h5"><br>
Le 14 avr. 2015 à 13:54, Roland van Rijswijk - Deij <<a href="mailto:Roland.vanRijswijk@surfnet.nl">Roland.vanRijswijk@surfnet.nl</a>> a écrit :<br>
<br>
> Hi Elizabeta,<br>
><br>
> Elizabeta wrote:<br>
>> I'm new to opendnsec. I've tried to use SoftHSM v2 and I was able to sign a message without logging in.<br>
>> Is that fine for SoftHSM ? since in the PKCS#11 specification it is written that some tokens may not require any type of authentication to make the usage of its cryptographic functions.<br>
><br>
> To answer your question we'll need a little bit more context. When you<br>
> say sign, do you mean that you have (created) a program that used<br>
> SoftHSM v2 as a PKCS #11 library? And if so, how did you create the keys<br>
> that you were using to sign? If the private key was created with the<br>
> CKA_PRIVATE attribute set to CK_FALSE, then you can create signatures<br>
> without logging in on the token.<br>
><br>
> Cheers,<br>
><br>
> Roland<br>
><br>
> --<br>
> -- Roland M. van Rijswijk - Deij<br>
> -- SURFnet bv<br>
> -- w: <a href="http://www.surf.nl/en/about-surf/subsidiaries/surfnet" target="_blank">http://www.surf.nl/en/about-surf/subsidiaries/surfnet</a><br>
> -- e: <a href="mailto:roland.vanrijswijk@surfnet.nl">roland.vanrijswijk@surfnet.nl</a><br>
<br>
</div></div><div class=""><div class="h5">_______________________________________________<br>
Opendnssec-user mailing list<br>
<a href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a><br>
<a href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user" target="_blank">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a><br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div></body></html>