[Opendnssec-user] Information about SoftHSM v2 - signing operation

[Rickard Bellgrim]

Hi Elizabeta

C_Login() will log in the user on the token, thus changing the login state
for all sessions on that token. The test script will login using
hSessionRO, but hSessionRW will also move from the public state to the user
state.

If you add C_Logout(hSessionRO) after the key generation and then try to
create a signature, you should get rv==CKR_USER_NOT_LOGGED_IN.

It is not possible to use a private object (CKA_PRIVATE==CK_TRUE) without
being logged in. You need the PIN to decrypt the key material.

// Rickard

On Tue, Apr 14, 2015 at 3:21 PM, Elizabeta <elizabeta.fourneret at gmail.com>
wrote:

> Hi Roland,
>
> I have a set of CPPUNIT tests for PKCS#11 that I'm using to discover
> SoftHSM, based on the SoftHSM v2 test configuration.
> For key generation, I'm using the generateKey function (see
> SignVerifyTests.cpp in the SoftHSM v2 test folder).
>
> However, the outcome of my tests, even if the CKA_PRIVATE attribute is
> CK_TRUE, is that I'm managing to sign without authentication.
>
> Cheers,
> Elizabeta
>
> Le 14 avr. 2015 à 13:54, Roland van Rijswijk - Deij <
> Roland.vanRijswijk at surfnet.nl> a écrit :
>
> > Hi Elizabeta,
> >
> > Elizabeta wrote:
> >> I'm new to opendnsec. I've tried to use SoftHSM v2 and I was able to
> sign a message without logging in.
> >> Is that fine for SoftHSM ? since in the PKCS#11 specification it is
> written that some tokens may not require any type of authentication to make
> the usage of its cryptographic functions.
> >
> > To answer your question we'll need a little bit more context. When you
> > say sign, do you mean that you have (created) a program that used
> > SoftHSM v2 as a PKCS #11 library? And if so, how did you create the keys
> > that you were using to sign? If the private key was created with the
> > CKA_PRIVATE attribute set to CK_FALSE, then you can create signatures
> > without logging in on the token.
> >
> > Cheers,
> >
> > Roland
> >
> > --
> > -- Roland M. van Rijswijk - Deij
> > -- SURFnet bv
> > -- w: http://www.surf.nl/en/about-surf/subsidiaries/surfnet
> > -- e: roland.vanrijswijk at surfnet.nl
>
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-user at lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20150414/5f183465/attachment.htm>