macOS version doesn't support C_CopyObject and C_CreateObject methods for private keys.

Need checking of Windows version

Currently, the log file is placed in /tmp, this makes sense for a system wide installation but on a per user installation, it is better to have it in the users tmp folder.

We should make the default the users tmp folder and have configuration available to place it wherever the user wants.

At the same time, we should be able to disable logging.

Don't change CKA_ID value for Object

OS X

Use kSecAttrApplicationLabel and kSecPublicKeyHash

We can set own ID on object creation, but it can be changed after modules restart.

PKCS#11 has 2 mechanisms CKM_AES_CBC and CKM_AES_CBC_PAD. 1st mechanism doesn't use padding and incoming must be multiple to BLOCK LENGTH (16), otherwise throw CKR_DATA_LEN_RANGE error.

I've got this error for CKM_AES_ECB mechanism with SoftHSM in node-webcrypto-p11. I can resolve this error on webcrypto layer.

node-webcrypto-ossl and webcrypto-liner use padding.

@rmhrisk What should I do for pvpkcs11? Current AES-ECB implementation supports padding and I use CKM_AES-ECB mechanism. Should I add vendor mechanism CKM_AES_ECB_PAD for it?

CKM_AES_ECB_PAD

If has Certificate My cert in keychain and adding new with the same name. It doesn't throw exception, but the last certificate is not in keychain

Is it possible to keep CSR data in custom attribute of SecKeyRef?
Is there any way to remove custom attribute?

https://github.com/PeculiarVentures/pvpkcs11/blob/master/src/mscapi/sc_session.cpp#L285

pvpkcs11 adds a slot for new SmartCard but throws CKR_FUNCTION_NOT_SUPPORTED exception on C_OpenSession

It must fix PeculiarVentures/fortify#138 issue

Loading C:\Program Files\Fortify\pvpkcs11.dll
Error: CKR_FUNCTION_NOT_SUPPORTED:84
  at Error (native) PKCS11:C_OpenSession:329

https://github.com/google/pkcs11test

Description:

When using the pvpkcs11 library on MacOS, the CKA_ID attribute is being altered during the execution of C_CreateObject. This inconsistency leads to an unexpected CKA_ID value in the PKCS#11 object, differing from the original value specified in the template.

Steps to Reproduce:

1. Create a PKCS#11 template with a specified CKA_ID attribute.
2. Call C_CreateObject with the created template.
3. Check the CKA_ID attribute of the created PKCS#11 object.

Expected Behavior:

The CKA_ID attribute in the PKCS#11 object should match the original value provided in the template.

Actual Behavior:

The CKA_ID attribute gets altered and does not match the value specified in the template. For instance:

• Template CKA_ID: '73e4ac6199ba1ff0c29b44a72d643f43'
• Resulting PKCS#11 Object CKA_ID: '2d0cf479b87f65381e211287443ade9f1413b666'

Code Snippet:

// Simplified C code snippet to reproduce the issue
// ... (Initialization and other code)
CK_ATTRIBUTE template[] = {
    {CKA_ID, id_data, id_length},
    // ... (Other attributes)
};
C_CreateObject(session, template, count, &object_handle);
// ... (Fetching the CKA_ID of the object and finding it altered)

Suggested Fix:

This appears to be a bug within the pvpkcs11 library, specifically when running on MacOS. The internal implementation of C_CreateObject may need to be revised to preserve the original CKA_ID attribute during object creation.

I using graphene and pvpkcs11 on windows for USB token : when signing using mechanic rsa_pkcs but error invalid mechanic ! Please help me ! Thanks you very much !

I've got some questions about SmartCard Provider using.

1. Is there any way to open MS_SMART_CARD_KEY_STORAGE_PROVIDER provider (NCryptOpenStorageProvider) for specific card?
   It looks that Windows opens only first SmartCard and doesn't enum certificates and keys for multi SmartCard using

two tokens in slot

1. Rutoken
2. Yubikey NEO

Start SmartCard application
SmartCard GUID: 98364C541F19BC0E25D0B8CD4A7159F5
Provider name: Microsoft Smart Card Key Storage Provider
Certificate: RU, "RSA rutoken #1"
Key enum:
  81d4edc5-8696-4170-b42b-4d5ae9453a50
  New key
Done

first token was removed

2. Yubikey NEO

Start SmartCard application
SmartCard GUID: F8CD87C7503693F2612A81C4BA57AFBB
Provider name: Microsoft Smart Card Key Storage Provider
Certificate: micro
Key enum:
  c787cdf8-3650-f293-612a-81c4ba5fc10b
Done

fist token supports CSP interface only

1. SafeNET (CSP only)
2. Yubikey NEO

Start SmartCard application
SmartCard GUID: F8CD87C7503693F2612A81C4BA57AFBB
Provider name: Microsoft Smart Card Key Storage Provider
Certificate: micro
Key enum:
  c787cdf8-3650-f293-612a-81c4ba5fc10b
Done

2. Which implementation do we have to use?

Current version

1. Use SCard API to catch insert/remove tokens. This API allows to determine which Storage Provider SmartCard uses (CSP, KSP or custom)
2. Create slot for each Reader name. (Certificates from user store have property with linked Reader name)
3. Use SmartCards for signing only. Cannot generate key.

New version

1. Create slot for KSP and CSP providers
2. Generate keys and adding certificates
3. Remove keys and certificates
4. Use crypto operations

• Doesn't support multi smart cards
• We don't know reader name from provider

https://github.com/google/wycheproof

Add custom CKU_MACHINE = CKU_CONTEXT_SPECIFIC | 0x01 constant for C_Login function

https://developer.apple.com/documentation/cryptotokenkit/using_cryptographic_assets_stored_on_a_smart_card

App was crashed on iPhone Developer cert

Cryptoki params

typedef struct CK_C_INITIALIZE_ARGS {
  CK_CREATEMUTEX CreateMutex;
  CK_DESTROYMUTEX DestroyMutex;
  CK_LOCKMUTEX LockMutex;
  CK_UNLOCKMUTEX UnlockMutex;
  CK_FLAGS flags;
  CK_VOID_PTR pReserved;
} CK_C_INITIALIZE_ARGS;

NSS params

typedef struct CK_NSS_C_INITIALIZE_ARGS {
    CK_CREATEMUTEX CreateMutex;
    CK_DESTROYMUTEX DestroyMutex;
    CK_LOCKMUTEX LockMutex;
    CK_UNLOCKMUTEX UnlockMutex;
    CK_FLAGS flags;
    CK_CHAR_PTR LibraryParameters;
    CK_VOID_PTR pReserved;
} CK_NSS_C_INITIALIZE_ARGS;

It would be nice to use something like NSS CK_CHAR_PTR LibraryParameters

JWK EC key

{
  kty: 'EC',
  crv: 'P-256',
  ext: true,
  key_ops: [ 'decrypt', 'deriveKey', 'deriveBits', 'sign', 'unwrapKey' ],
  d: '0QhOR25Onsgw3fySSzx3FYTVWxKbLGkWJLfyD6JGrUI',
  x: '8p8RVlOAWn8Mz6tMEkCzhNsHCs-z_FCv6bDZwGqqX_0',
  y: 'R6PlEjvTilfq2HrgVkxlfyNT9hCzKt6S7apJwisBk9E' 
}

OpenSSL derived result (source):

3709caac756a1cdce41de9cde756e114

pvpkcs11 derived result (source):

641BA0F75D0BC476B71600B532C641A47D075B7D7E556FC81BEB18111D92528D

https://gist.github.com/vcsjones/9a53e482851a4c8def5a75b2083f072e

Two ways to do it

• Useing vendor attribute for the certificate to mark is it User or System
• Useing different slots. One for User and another for System certificates

node-webcrypto-p11 uses CKD_NULL for CK_EC_KDF_TYPE.

@rmhrisk Could you help me to find any examples for CNG key derivation with the same KDF parameter?

Here are some exmples I found:
Example 1
Example 2

• generate session key only