4

I would like to make work OpenSSH with OpenSSL plus openCryptoki (pkcs11) plus a software TPM. As far as I have understood, openCryptoki is capable of software token (for test purpose). I would like to use the openCryptoki software TPM which I read it exists (alternatives looks like to be: softhsm, heimdal, tpmd).

I have installed : gnutls-bin, opencryptoki, libengine-pkcs11-openssl, libp11-2, libp11-2dev.

I did the following to start openCryptoki:

pkcs11_startup

Here is the pk_config_data file:

TRUE|0|Linux 3.5.0-54-generic Linux (TPM)|Linux 3.5.0-54-generic|TRUE|FALSE|TRUE|0|0|1|1|NONE|libpkcs11_tpm.so|ST_Initialize 
TRUE|0|Linux 3.5.0-54-generic Linux (Soft)|Linux 3.5.0-54-generic|TRUE|FALSE|FALSE|0|0|1|1|NONE|libpkcs11_sw.so|ST_Initialize 

I have not found how to use the openCryptoki software token.

Then I tried with opensc:

OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/opensc-pkcs11.so 
(dynamic) Dynamic engine loading support 
[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so 
[Success]: ID:pkcs11 
[Success]: LIST_ADD:1 
[Success]: LOAD 
[Success]: MODULE_PATH:/usr/lib/opensc-pkcs11.so 
Loaded: (pkcs11) pkcs11 engine 
     [ available ] 

OpenSSL> req -engine pkcs11 -new -key id_45 -keyform engine -out req.pem -text -x509 -subj "/CN=Andreas Jellinghaus"> 
engine "pkcs11" set. 
Invalid slot number: 0 
PKCS11_get_private_key returned NULL 
cannot load Private Key from engine 
3073657032:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126: 
unable to load Private Key 
error in req 

Then I tried with softhsm:

softhsm --init-token --slot 0 --label "softhsmTPM"
The SO PIN must have a length between 4 and 255 characters. 
Enter SO PIN: aaaa
The user PIN must have a length between 4 and 255 characters. 
Enter user PIN: bbbb
The token has been initialized. 

OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/libsofthsm.so 
(dynamic) Dynamic engine loading support 
[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so 
[Success]: ID:pkcs11 
[Success]: LIST_ADD:1 
[Success]: LOAD 
[Success]: MODULE_PATH:/usr/lib/libsofthsm.so 
Loaded: (pkcs11) pkcs11 engine 
SoftHSM: Could not open the config file: /etc/softhsm/softhsm.conf 
unable to load module /usr/lib/libsofthsm.so 
     [ unavailable ] 

Then I tried with an unused slot:

pkcsconf -s 
Slot #0 Info 
    Description: Linux 3.5.0-54-generic Linux (TPM) 
    Manufacturer: Linux 3.5.0-54-generic 
    Flags: 0x5 (TOKEN_PRESENT|HW_SLOT) 
    Hardware Version: 0.0 
    Firmware Version: 1.1 
Slot #1 Info 
    Description: Linux 3.5.0-54-generic Linux (Soft) 
    Manufacturer: Linux 3.5.0-54-generic 
    Flags: 0x1 (TOKEN_PRESENT) 
    Hardware Version: 0.0 
    Firmware Version: 1.1 

softhsm --init-token --slot 2 --label "softhsmTPM"
The SO PIN must have a length between 4 and 255 characters. 
Enter SO PIN: 
The user PIN must have a length between 4 and 255 characters. 
Enter user PIN: 
Error: The given slot does not exist. 

Whatever solution I try, it fails, but I am a new to this. Any help?

1 Answer 1

-1

https://blog.habets.se/2013/11/TPM-chip-protecting-SSH-keys---properly

It is also covering software that was written to use the tpm as pkcs11 provider in ssh.

3
  • 1
    Please quote the essential parts of the answer from the reference link(s), as the answer can become invalid if the linked page(s) change.
    – DavidPostill
    Jan 10, 2015 at 17:36
  • That does not answer the original question which is how to make working a software TPM, whatever it is, with openCryptoki, and not to replace openCryptoki with something else.
    – lalebarde
    Dec 4, 2015 at 14:18
  • also the answer was asking about SSL not SSH
    – arved
    Nov 15, 2017 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .