Collaborate Disseminate
I’m trying to wrap AES keys with an AES key using PKCS#11. Keys to be wrapped have the attribute CKA_WRAP_WITH_TRUSTED but the wrapping AES key(KEK) have the CKA_TRUSTED = false and still the wrapping works. Shouldn’t this be impossible. A… Continue reading Wrap keys with an AES key
I have implemented a solution where I can decrypt DUKPT taking 10 bytes of KSN, and derive a key using a vendor defined mechanism. This vendor defined mechanism uses the existing parameter of CK_KEY_DERIVATION_STRING_DATA. I tried to imple… Continue reading PKCS11, softHSM, and vendor defined mechanism
I am fairly new to Security and Cryptography, and at the moment I am trying to implement a POC (Proof-of-Concept) an end-to-end implementation of PKCS#11, with a device token.
Do you know any open source tool/project, book that can help… Continue reading Sample PKCS#11 End-to-end implementation [closed]
I am new to PKCS#11, and I am going through the docs, and I am a little bit confused where Cryptoki fits in. And after I read the initial part of the OASIS Spec, I came to conclusion that the Implementation of the Interface is left to the… Continue reading Who implements Cryptoki on PKCS#11 Infrastructure, Software or Token/Devices
I am trying to understand the benefits of a PKCS #11 keyfile stored on a smartcard such as a YubiKey with regards to Veracrypt volumes. Am I correct that the file will be taken off of the hardware device to be used? If so, this would see… Continue reading Do PKCS #11 keyfiles on a yubikey actually improve security for Veracrypt?
I’ve created an RSA private key in SoftHSM 2 via EJBCA with the following config:
attributes(*, CKO_PUBLIC_KEY, *) = {
CKA_TOKEN = false
CKA_ENCRYPT = true
CKA_VERIFY = true
CKA_WRAP = false
}
attributes(*, CKO_PRI… Continue reading RSA insensitive and extractable private key export from SoftHSM 2
While S/MIME has been a PKCS7 standard, what happens while I sign/encrypt an email using a smart card implementing PKCS11? Is PKCS7 supported as kind of backward compatibility?
What I am trying to achieve:
send a signed, unencrypted email using a smart card token through a Python script
What I’ve tried so far:
Have a look on an incoming email signed with same corporate smart card system. It is… Continue reading Email security with PCKS11 and Python – send a signed uncenrypted email
I have some private keys stored on the HSM but without public keys. I want to get the corresponding public key using PKCS11 interface.
If the private key is a RSA key, I can extract the modulus from CKA_MODULUS and exponent … Continue reading How to get public key from private key stored in HSMs [migrated]
I’m new to MongoDB and I’m not sure what I am missing in this.
MongoDB advises that as of v4.0, it uses the native OpenSSL libraries; but no matter what, my build or install from the repository, the OpenSSL binary appears to… Continue reading Mongodb use native openssl in centos