Pkcs11-tool No Slot With A Token Was Found 2017
Pkcs11-tool No Slot With A Token Was Found Within
Pkcs11-tool No Slot With A Token Was Found Inside
Pkcs11-tool No Slot With A Token Was Found Near

2012-05-30 09:21:03 UTC

O slot number-i token pin-l key label. Example: dbencrypt.exe -S.myserver -d testdb -p SrongPass -m etoken -O 1 -i 1111 -l keylabel. Demo PKCS#11 module. Activecrypt Software provides a very basic PKCS#11 module. It contains only one token and only one AES key. Token password '0000'. Token implements basic encryption with a random access cipher. Hi, I can’t use HSM module ECC based keys in the openssl pkcs11 engine. First, I successfully generated RSA and ECC keypairs using pkcs11-tool (RSA with id 1001, ECC with id 1002): root@test1:# pkcs11-tool -module opensc-pkcs11.so -keypairgen -key-type rsa:2048 -label rsakey -id 1001 -login Using slot 1 with a present token (0x1) Logging in to 'SmartCard-HSM (UserPIN)'. Slot 2 -so-pin 12345678 I also researched and found that in pkcs15-init, a function to ask for PIN is implemented and added via scpkcs15initsetcallbacks, but pkcs11-tool does not do so. The question is: - 'Not ask for PIN' is intentional design of pkcs11-tool or a limitation? - What is the right way to provide Admin PIN to pkcs11-tool. This memo specifies a PKCS #11 Uniform Resource Identifier (URI) Scheme for identifying PKCS #11 objects stored in PKCS #11 tokens and also for identifying PKCS #11 tokens, slots, or libraries. The URI scheme is based on how PKCS #11 objects, tokens, slots, and libraries are identified in 'PKCS #11 v2.20: Cryptographic Token Interface Standard'.

Hello all,
As you may know, I'm trying to implement writing certificate to OpenPGP
card via PKCS#11.
I succeed with pkcs15-init tool but have difficulty with pkcs11-tool.
When I import via pkcs15-init tool (Command: pkcs15-init
--store-certificate ***@mbm.vn.pem), the tool asks for Admin PIN
and the work is done. But when I try with pkcs11-tool:
pkcs11-tool --module=/usr/lib/opensc-pkcs11.so -w quannguyen.crt -y cert
--slot 2
the tool does not ask for PIN and the write cannot succeed (in OpenPGP
card, writing certificate requires SO (Admin) PIN).
I tried to provide the Admin PIN in the command, but still not successful:
pkcs11-tool --module=/usr/lib/opensc-pkcs11.so -w quannguyen.crt -y cert
--slot 2 -l --so-pin 12345678
pkcs11-tool --module=/usr/lib/opensc-pkcs11.so -w quannguyen.crt -y cert
--slot 2 --so-pin 12345678
I also researched and found that in pkcs15-init, a function to ask for
PIN is implemented and added via sc_pkcs15init_set_callbacks(), but
pkcs11-tool does not do so.
The question is:
- 'Not ask for PIN' is intentional design of pkcs11-tool or a limitation?
- What is the right way to provide Admin PIN to pkcs11-tool to allow to
write data?
- When I do import certificate in Firefox, the browser ask for a PIN. I
expect it to ask for Admin PIN but not sure which PIN it actually asks
for (user PIN, to login to slot, or admin PIN, to write data). Do you
know how Firefox determines which PIN to ask? Does it always ask for
user PIN of the slot, or smart enough to ask for right PIN?

--
Regards,
Quân

1.0 Introduction

2.0 Sun PKCS#11 Provider

2.1 Requirements

2.2 Configuration

2.3 Accessing Network Security Services(NSS)

2.4 Troubleshooting PKCS#11

2.5 Disabling PKCS#11

2.5.1 Disabling PKCS#11Providers

2.5.2 Disabling SpecificMechanisms

3.0 Application Developers

3.1 Token Login

3.2 Token Keys

3.3 Delayed ProviderSelection

3.4 JAAS KeyStoreLoginModule

3.5 Tokens as JSSE Keystores and TrustStores

4.0 Tools

4.1 KeyTool and JarSigner

4.2 PolicyTool

5.0 Provider Developers

5.1 Provider Services

5.1.1 Instantiating EngineClasses

5.1.2 Parameter Support

Appendix A Sun PKCS#11 Provider's SupportedAlgorithms

Appendix B Sun PKCS#11Provider's KeyStore Restrictions

Appendix C Example Provider

1.0 Introduction

The Java platform defines a set of programming interfaces forperforming cryptographic operations. These interfaces arecollectively known as the Java Cryptography Architecture (JCA) andthe Java Cryptography Extension (JCE). Specifications are availableat the Java SE Security Documentationpage.

The cryptographic interfaces are provider-based. Specifically,applications talk to Application Programming Interfaces (APIs), andthe actual cryptographic operations are performed in configuredproviders which adhere to a set of Service Provider Interfaces(SPIs). This architecture supports different providerimplementations. Some providers may perform cryptographicoperations in software; others may perform the operations on ahardware token (for example, on a smartcard device or on a hardwarecryptographic accelerator).

The Cryptographic Token Interface Standard, PKCS#11, is producedby RSA Security and defines native programming interfaces tocryptographic tokens, such as hardware cryptographic acceleratorsand Smartcards. To facilitate the integration of native PKCS#11tokens into the Java platform, a new cryptographic provider, theSun PKCS#11 provider, has been introduced into the J2SE 5.0release. This new provider enables existing applications written tothe JCA and JCE APIs to access native PKCS#11 tokens. Nomodifications to the application are required. The only requirementis the proper configuration of the provider into the JavaRuntime.

Although an application canmake use of most PKCS#11 features using existing APIs, someapplications might need more flexibility and capabilities. Forexample, an application might want to deal with Smartcards beingremoved and inserted dynamically more easily. Or, a PKCS#11 tokenmight require authentication for some non-key-related operationsand therefore, the application must be able to log into the tokenwithout using keystore. In J2SE 5.0, the JCA was enhanced to allowapplications greater flexibility in dealing with differentproviders.

This document describes how native PKCS#11 tokens can beconfigured into the Java platform for use by Java applications. Italso describes the enhancements that were made to the JCA to makeit easier for applications to deal with different types ofproviders, including PKCS#11 providers.

2.0 Sun PKCS#11 Provider

The Sun PKCS#11 provider, in contrast to most other providers,does not implement cryptographic algorithms itself. Instead, itacts as a bridge between the Java JCA and JCE APIs and the nativePKCS#11 cryptographic API, translating the calls and conventionsbetween the two. This means that Java applications calling standardJCA and JCE APIs can, without modification, take advantage ofalgorithms offered by the underlying PKCS#11 implementations, suchas, for example,

Cryptographic Smartcards,
Hardware cryptographic accelerators, and
High performance software implementations.

Note that Java SE only facilitates accessing native PKCS#11implementations, it does not itself include a native PKCS#11implementation. However, cryptographic devices such as Smartcardsand hardware accelerators often come with software that includes aPKCS#11 implementation, which you need to install and configureaccording to manufacturer's instructions.

2.1 Requirements

The Sun PKCS#11 provider is supported on Solaris (SPARC andx86), Linux (x86), and Windows platforms in both 32-bit and 64-bitJava processes.

The Sun PKCS#11 provider requires an implementation of PKCS#11v2.0 or later to be installed on the system. This implementationmust take the form of a shared-object library (.so on Solaris andLinux) or dynamic-link library (.dll on Windows). Please consultyour vendor documentation to find out if your cryptographic deviceincludes such a PKCS#11 implementation, how to configure it, andwhat the name of the library file is.

The Sun PKCS#11 provider supports a number of algorithms,provided that the underlying PKCS#11 implementation offers them.The algorithms and their corresponding PKCS#11 mechanisms arelisted in the table in Appendix A.

2.2 Configuration

The Sun PKCS#11 provider is implemented by the main classsun.security.pkcs11.SunPKCS11 and accepts the fullpathname of a configuration file as an argument. To use theprovider, you must first install it by using the Java CryptographyArchitecture (JCA). As with all JCA providers, installation ofth

Pkcs11-tool No Slot With A Token Was Found