0

I'm trying to use TPM 2.0 chip in my laptop to manage new pair of RSA keys and create a CSR on top of new private key but when I list certificates managed by my TPM, I got only keys labeled as public and don't know, how to get URL to my private key which I want to use for CSR generation.

I used following procedure:

#generate rsa key:
p11tool --login --so-login --generate-rsa --bits=2048 --label=dave4 "$token"```

#list my certificates:
p11tool --list-all ""

But all certificates URL I got when I try to list them are labeled as public:

pkcs11:model=NPCT75x;manufacturer=Nuvoton;serial=0000000000000000;token=dave4;id=%34%39%30%66%65%35%65%34%30%30%34%64%65%33%65%30;object=myfirstkey;type=public

and list priv keys does not return any object:

p11tool --list-privkeys pkcs11:model=NPCT75x;manufacturer=Nuvoton;serial=0000000000000000;token=dave4
No matching objects found

Do you have any idea how to get list of private keys URL or another way how to generate new rsa keypair in order to create CSR afterwards?

Thanks.

0

Usually these objects are created with the CKA_PRIVATE attribute, indicating that they're hidden from the normal list – you must specify --login and provide the token PIN in order to see them.

p11tool --login --list-privkeys 'pkcs11:model=NPCT75x;manufacturer=Nuvoton;token=dave4'

But if the PKCS#11 module has a private key stored, then the URI for public and private halves almost always has exactly the same id=, so you can just edit the URI by hand. The private key might have a different object= label (so remove that parameter), and it will of course have type=private.

For example, this should be a working URL:

pkcs11:model=NPCT75x;manufacturer=Nuvoton;serial=0000000000000000;token=dave4;id=%34%39%30%66%65%35%65%34%30%30%34%64%65%33%65%30;object=myfirstkey;type=private

or even:

pkcs11:model=NPCT75x;token=dave4;id=%34%39%30%66%65%35%65%34%30%30%34%64%65%33%65%30;type=private
pkcs11:model=NPCT75x;token=dave4;object=myfirstkey;type=private

Note that tpm-pkcs11 is still far from complete. There have been many API-related bugfixes recently (some of them were merged literally yesterday).

  • Thanks a lot! Actually it successfully work also in case you don't change type=public to type=private and I don't really understand it, but this was exactly what I was looking for. :) – Jiří Malák Dec 10 '19 at 12:20
  • Yes, when you're signing or decrypting, the library already knows that it requires a specific object type, so you don't even need to add type= at all – it will be replaced by the library anyway. It's only needed when using generic functions such as reading or deleting. – user1686 Dec 10 '19 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.