openssl req -engine pkcs11 fails with PKCS11_get_private_key returned NULL

[astrand]

Forked off Issue #202. With the latest master, openssl req fails with out Aventra cards:

• openssl req -engine pkcs11 -new -key slot_01 -keyform engine -x509 -out /tmp/tmp.dOrPFR1LVU/cert.pem -text -config /tmp/tmp.dOrPFR1LVU/openssl.cnf
  initializing engine
  engine "pkcs11" set.
  Looking in slot 1 for key:
  Found 2 slots
  [18446744073709551615] Virtual hotplug slot no tok
  [1] OmniKey CardMan 3121 00 0 login (MyEID (Basic PIN))
  Found slot: OmniKey CardMan 3121 00 00
  Found token: MyEID (Basic PIN)
  Found 0 certificate:
  Found 1 key:
  PKCS11_get_private_key returned NULL
  cannot load Private Key from engine
  139781956970312:error:80028012:PKCS11 library:PKCS11_get_attribute:Attribute type invalid:p11_attr.c:53:
  139781956970312:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126:
  unable to load Private Key

Due to issue #202, and since the fix 5437f87 contain a lot of unrelated stuff, it's difficult to use "git bisect" to find the problem.

[viktorTarasov]

Rather than git bisect delight, the opensc logs would be more appropriate here.

[dengert]

There is a possibility that this is caused by writing out the SPKI rather then then the RAW pubkey
to a card that can not handle it even though PKCS#15 allows it.

The changes in the pkcs15init/pkcs15-lib.c will always write out the SPKI.
The choice of which to write should be an option.

To verify if this is the problem, Astrand, can you try to replace the
call to sc_pkcs15_encode_pubkey_as_spki with the original call to
sc_pkcs15_encode_pubkey?

If that fixes your problem, we can look at what it will take to satisfy the
CardCcontact people. By adding an option to the pkcs15init code to specify
how to store the pubkey.

The default for this option could depend on the type of key, and type of card.

For RSA no additional benefit is gained by using SPKI vs RAW.
With ECC, the curve parameter is saved with the SPKI, but not with the RAW,
so SPKI is preferred if the card does not have a problem. This is what the
CardContact people needed.

I am not sure about GOST. Viktor???

On 1/14/2014 2:18 AM, astrand wrote:

Forked off Issue #202 #202. With the latest master, openssl req fails with out Aventra cards:

• openssl req -engine pkcs11 -new -key slot_01 -keyform engine -x509 -out /tmp/tmp.dOrPFR1LVU/cert.pem -text -config /tmp/tmp.dOrPFR1LVU/openssl.cnf initializing engine engine "pkcs11" set. Looking
  in slot 1 for key: Found 2 slots [18446744073709551615] Virtual hotplug slot no tok
  [1] OmniKey CardMan 3121 00 0 login (MyEID (Basic PIN)) Found slot: OmniKey CardMan 3121 00 00 Found token: MyEID (Basic PIN) Found 0 certificate: Found 1 key: PKCS11_get_private_key returned NULL
  cannot load Private Key from engine 139781956970312:error:80028012:PKCS11 library:PKCS11_get_attribute:Attribute type invalid:p11_attr.c:53: 139781956970312:error:26096080:engine
  routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126: unable to load Private Key

Due to issue #202 #202, and since the fix 5437f87 5437f87 contain a lot of unrelated
stuff, it's difficult to use "git bisect" to find the problem.

—
Reply to this email directly or view it on GitHub #206.

Douglas E. Engert [email protected] [email protected]
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

[astrand]

Well, I tried reverting 3d3592a, but that didn't help. Log file here:
http:https://www.cendio.com/~astrand/opensc/issue206-1.log

[dengert]

On 1/15/2014 2:47 AM, astrand wrote:

Well, I tried reverting 3d3592a 3d3592a,

That change was in how a public key was printed, and should not have any effect.

What I wanted you to try was in pkcs15init/pkcs15-lib.c,
1566 /* DER encode public key components /
1567 / EC key are encoded as SPKI to preserve domain parameter */
1568 r = sc_pkcs15_encode_pubkey_as_spki(p15card->card->ctx, &key, &object->content.value, &object->content.len);

Change above line to:
r = sc_pkcs15_encode_pubkey(p15card->card->ctx, &key, &object->content.value, &object->content.len);

So it does not try and use the SPKI version.

but that didn't help. Log file here:

http:https://www.cendio.com/~astrand/opensc/issue206-1.log http:https://www.cendio.com/%7Eastrand/opensc/issue206-1.log

Looking at the log, it shows

C_FindObjectsInit(): CKA_CLASS = CKO_PUBLIC_KEY

Object 1/34897424 matches
Object 34897424: CKA_LABEL = Private Key

But then it reads from the private key:
Object 34896960: CKA_SENSITIVE = TRUE
Object 34896960: CKA_EXTRACTABLE = FALSE
Object 34896960: CKA_MODULUS =

This looks like the libp11 is having problems matching up the private key and public key.

What version of the opensc-engine and libp11 are you using?

—
Reply to this email directly or view it on GitHub #206 (comment).

Douglas E. Engert [email protected] [email protected]
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

[dengert]

Since you have been testing with a build of OpenSC, I assume you built the OpenSC
from git and did not install it over the default locations.

I looked at the pkcs15-selfsigned.sh script that you sent with #202.

The script calls openssl with the engine parameters:

  dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so
  MODULE_PATH = opensc-pkcs11.so

The MODULE_PATH is not a full path, This means that the opensc-pkcs11.so
and other opensc libs will be from the default locations and not from your build.

(The default engine and the libp11.so should be OK.)

But the pubkey was stores as an SPKI, the old code can not handle it.

Can you give a full path to the opensc-pkcs11.so that you built?

And can you run the ldd command on opensc-pkcs11.so to make sure it is
using the git version of the libs you built?

Setting LD_LIBRARY_PATH might also be needed.

On 1/15/2014 2:47 AM, astrand wrote:

Well, I tried reverting 3d3592a 3d3592a, but that didn't help. Log file here:
http:https://www.cendio.com/~astrand/opensc/issue206-1.log http:https://www.cendio.com/%7Eastrand/opensc/issue206-1.log

—
Reply to this email directly or view it on GitHub #206 (comment).

Douglas E. Engert [email protected] [email protected]
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

[dengert]

Looking closer at the issue206-1.log,
Lines 1807-1818 show the pubkey being read, it is SPKI.

something like:
0:d=0 hl=3 l= 159 cons: SEQUENCE
X:d=1 hl=2 l= 13 cons: SEQUENCE
X:d=2 hl=2 l= 9 prim: OBJECT :rsaEncryption
XX:d=2 hl=2 l= 0 prim: NULL
XX:d=1 hl=3 l= 141 prim: BIT STRING

But lines 1827 look like the old code,
pkcs15.c:2277:sc_pkcs15_read_file: returning with: 0 (Success)
That message should have been from line 2380.

Then in the new code in pkcs15-pubkey.c line 856 would have
called sc_pkcs15_decode_pubkey_with_param which would have found the
data read was the SPKI, and parsed it.

So I think the issue is using the old that can not read the SPKI.

So can you try pointing openssl at the new opensc, to see if it
actually works?

This points out some some comparability issues with new cards using
older opensc code on other machines.

The use of the SPKI should be an option, and not done by default,
and since there is no benefit with RSA to use the SPKI vs just the
publicKeyCoefficients (i.e. there are no parameters for RSA)
I will propose a change to the pkcs15init/pubkey-lib.c code
to not use the SPKI for RSA. ECC benefits from using SPKI,
and GOST might too.Viktor?

If we add an option in tghe next release to the pkcs15 profile,
its up to the card issurer and by that time the SPKI will then be
in the "older" code.

On 1/15/2014 2:47 AM, astrand wrote:

Well, I tried reverting 3d3592a 3d3592a, but that didn't help. Log file here:
http:https://www.cendio.com/~astrand/opensc/issue206-1.log http:https://www.cendio.com/%7Eastrand/opensc/issue206-1.log

—
Reply to this email directly or view it on GitHub #206 (comment).

Douglas E. Engert [email protected] [email protected]
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

[astrand]

Thanks, you were right. After pointing to the correct/built version of opensc-pkcs11.so, it works fine. Thanks for your help.