Comments (3)
Or maybe a better question: Could there be a way to provide info from driver or settings which app/token is for authentication and which for signing?
I know this card is strange because there is a token with PK and cert without PIN which is also the first token listed. If it were the second listed, the openSC functionality would work perfectly.
from opensc.
Have you looked at: https://github.com/OpenSC/OpenSC/blob/master/etc/opensc.conf.example.in#L214-L227 I have never used it, but it might allow changing the order of pins.
In addition:
OpenSC was originally written assuming a card had only one applet. And a reader could only have one card at a time. Since then there are cards with multiple applets, for example PIV applet and OpenPGP applet.
The OpenSC PKCS11 implementation can present every reader as a slot and virtual slots used when an applet has more then one PIN where each virtual slot is used to access objects protected by its PIN. (PKCS11 has the limitation of only defining CKU_SO, CKU_USER, and CKU_CONTEXT_SPECIFIC per token.)
Code was never added to allow OpenSC PKCS11 to treat each applet on a card as a separate token.
PKCS15 is at the card level (or applet level) opensc-tool --list-readers
lists the readers on a system usually using PCSC and pkcs15-tool has options
--reader,
--list-applications(but only PKCS15 applications) and
--aid` to use a specific applet.
To further isolate cards, tokens and applets, OpenSC can restrict which card driver(s) can be used via opensc.conf
or env, so for env OPENSC_DRIVER=PIV-II
or OPENSC_DRIVER=openpgp` could be set to select the which applet you want for a process.
p11kit can be used with OpenSC PKCS11 module selecting one applet and using some other PKCS11 module for a different applet on the card.
from opensc.
Thank you for your explanation. I was fishing for a solution.
With no setup in conf file for PKCS15 framework the PKCS11 programming interface can access any token on the card, but over NSS and in firefox which both interact with PKCS11 library, I see the first token in first app, which as mentioned is not the token I want in browser.
After applying PKCS15 framework which disables one app, browser sees the appropriate token, but the other app can not be accessed over PKCS11 interface.
I was wondering how does firefox and NSS use the PKCS11 library to get only the first token, but python in my case can see all tokens. If there was a setting in the conf file that would help nss and firefox get the app id to query for tokens.
from opensc.
Related Issues (20)
- Error: Could not add card "/usr/local/lib/opensc-pkcs11-local.so": agent refused operation HOT 2
- New epass2003 token fails to initialize with error `Failed to create PKCS #15 meta structure: Card command failed` HOT 23
- Update Links in README.md before making a release HOT 2
- Building eOI (Slovenian eID) on ubuntu 22.04 HOT 12
- Compiling on Windows ignores CNGSDK_INCL_DIR and CPDK_INCL_DIR env. variables values HOT 2
- Problems with test scripts HOT 9
- Reselection of DF after failure in `sc_pkcs15_decipher` function HOT 5
- PIN change fails with CKR_PIN_LEN_RANGE because current PIN is too long HOT 10
- RFE: tools add --module-init arg for non-standard NSS softokn configDir HOT 5
- ActivIdentity Activkey_Sim 00 00 HOT 3
- CI: Check if refresh in documentation is needed
- doc: Python wrapper HOT 6
- pkcs11-tool: return value is 0 when signature verification fails HOT 3
- docbook-utf8.xsl missing from release archive HOT 1
- Probable Reasons For CKR_GENERAL_ERROR From C_Login HOT 4
- SC-HSM: Support for storing of ECDSA keys HOT 5
- C_FindObjects does not find keys generated by C_GenerateKeyPair without reinserting HOT 3
- In pkcs11-tool CKA_DERIVE is not set for write-object and keygen HOT 2
- pkcs15-crypt signing fails on release 0.25.0 w/ a YubiKey-bound RSA key HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from opensc.