Collaborate Disseminate
I am trying to follow this tutorial https://p11-glue.github.io/p11-glue/p11-kit/manual/remoting.html , but there are many points making me confused.
Which side is pkcs11 server?
It said "Setting up the PKCS#11 forwarding server on … Continue reading PKCS#11 Forwarding: Clarifying Client and Server Confusion
I am setting up a nginx proxy. It requires to use HSM for TLS offloading. So I configure nginx that enables ssl_engine pkcs11;; instead of indicating ssl_certificate_key file path, I use pkcs11 URI to point to the private key in HSM. It is… Continue reading How nginx proxy to communicate with remote softHSM for offloading?
I have been assigned an application that is a few years old now, written by people who are no longer at the company. There is little-to-no documentation on processes or code.
It signs firmware for a System to accept, while digging through … Continue reading OpenSSL CMS Sign and Verify
I’m a bit confused with PKCS11 (v3) standard…
In particular, it’s blurry to me if one can invoke C_DeriveKey, passing, say, CKM_SHA512_KEY_DERIVATION (or some HKDF) to it as the mechanism and also set the following in the template:
CKA_… Continue reading Deriving EC keypairs pairs via PKCS11?
I need to perform a public/private key generation on USB devices and store private key parts on at least 3 USB tokens.
Java javax.smartcardio allows to perform such an operation on Smart-cards that I plug into smart-card reader (key genera… Continue reading Is there any stable Java library to perform the same set of operations on USB tokens as javax.smartcadio does?
I did a lot of research on how to securely create, use and backup android signing keys (when using Google Play Signing is not an option). The best option seams to be a Yubikey or a Nitrokey HSM 2 and use their pkcs11 capability [0].
Backin… Continue reading How to create, use and backup android signing keys without trusting the computer?
I have been searching for a way to use challenge-response over PKCS11, is that possible? I have found that it is possible for Windows Minidriver, but all the PKCS11 challenge-response protocols are custom and vendor defined.
How can someon… Continue reading How to implement challenge-response authentication using PKCS11
PIN-pad smartcard readers (class 2) for secure PIN entry exist, but I have only seen them for smartcards (that come in a card form factor) and they are both a PIN-pad and a card reader. Is there something analogous for USB security tokens … Continue reading Using USB Security Token with PIN-Pad for Secure PIN Entry [closed]
When we generate an API key in Binance there is a generated secret key too. I could not find any reference that those are RSA key pairs. They could be just random unrelated numbers. Is the Binance API Key the public key of RSA key pairs?
I am trying to utilize the SafeNet eToken 5110CC, which basically has the IDPrime 940MD with the applet 4.4.2.A., to generate ECC keys with lengths 384bits and 521bits to no avail.
The product brief says that ECDSA and ECDH of 384/521bits … Continue reading SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication