4

I would like to make work OpenSSH with OpenSSL plus openCryptoki (pkcs11) plus a software TPM. As far as I have understood, openCryptoki is capable of software token (for test purpose). I would like to use the openCryptoki software TPM which I read it exists (alternatives looks like to be: softhsm, heimdal, tpmd).

I have installed : gnutls-bin, opencryptoki, libengine-pkcs11-openssl, libp11-2, libp11-2dev.

I did the following to start openCryptoki:

pkcs11_startup

Here is the pk_config_data file:

TRUE|0|Linux 3.5.0-54-generic Linux (TPM)|Linux 3.5.0-54-generic|TRUE|FALSE|TRUE|0|0|1|1|NONE|libpkcs11_tpm.so|ST_Initialize 
TRUE|0|Linux 3.5.0-54-generic Linux (Soft)|Linux 3.5.0-54-generic|TRUE|FALSE|FALSE|0|0|1|1|NONE|libpkcs11_sw.so|ST_Initialize 

I have not found how to use the openCryptoki software token.

Then I tried with opensc:

OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/opensc-pkcs11.so 
(dynamic) Dynamic engine loading support 
[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so 
[Success]: ID:pkcs11 
[Success]: LIST_ADD:1 
[Success]: LOAD 
[Success]: MODULE_PATH:/usr/lib/opensc-pkcs11.so 
Loaded: (pkcs11) pkcs11 engine 
     [ available ] 

OpenSSL> req -engine pkcs11 -new -key id_45 -keyform engine -out req.pem -text -x509 -subj "/CN=Andreas Jellinghaus"> 
engine "pkcs11" set. 
Invalid slot number: 0 
PKCS11_get_private_key returned NULL 
cannot load Private Key from engine 
3073657032:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126: 
unable to load Private Key 
error in req 

Then I tried with softhsm:

softhsm --init-token --slot 0 --label "softhsmTPM"
The SO PIN must have a length between 4 and 255 characters. 
Enter SO PIN: aaaa
The user PIN must have a length between 4 and 255 characters. 
Enter user PIN: bbbb
The token has been initialized. 

OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/libsofthsm.so 
(dynamic) Dynamic engine loading support 
[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so 
[Success]: ID:pkcs11 
[Success]: LIST_ADD:1 
[Success]: LOAD 
[Success]: MODULE_PATH:/usr/lib/libsofthsm.so 
Loaded: (pkcs11) pkcs11 engine 
SoftHSM: Could not open the config file: /etc/softhsm/softhsm.conf 
unable to load module /usr/lib/libsofthsm.so 
     [ unavailable ] 

Then I tried with an unused slot:

pkcsconf -s 
Slot #0 Info 
    Description: Linux 3.5.0-54-generic Linux (TPM) 
    Manufacturer: Linux 3.5.0-54-generic 
    Flags: 0x5 (TOKEN_PRESENT|HW_SLOT) 
    Hardware Version: 0.0 
    Firmware Version: 1.1 
Slot #1 Info 
    Description: Linux 3.5.0-54-generic Linux (Soft) 
    Manufacturer: Linux 3.5.0-54-generic 
    Flags: 0x1 (TOKEN_PRESENT) 
    Hardware Version: 0.0 
    Firmware Version: 1.1 

softhsm --init-token --slot 2 --label "softhsmTPM"
The SO PIN must have a length between 4 and 255 characters. 
Enter SO PIN: 
The user PIN must have a length between 4 and 255 characters. 
Enter user PIN: 
Error: The given slot does not exist. 

Whatever solution I try, it fails, but I am a new to this. Any help?

-1

https://blog.habets.se/2013/11/TPM-chip-protecting-SSH-keys---properly

It is also covering software that was written to use the tpm as pkcs11 provider in ssh.

| improve this answer | |
  • 1
    Please quote the essential parts of the answer from the reference link(s), as the answer can become invalid if the linked page(s) change. – DavidPostill Jan 10 '15 at 17:36
  • That does not answer the original question which is how to make working a software TPM, whatever it is, with openCryptoki, and not to replace openCryptoki with something else. – lalebarde Dec 4 '15 at 14:18
  • also the answer was asking about SSL not SSH – arved Nov 15 '17 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.