Re: Using external key with ncipher HSM

> OK then. So your starcos cards should work with the opensc-pkcs11.dll, but not the american banknote ones...
> I understand your starcos cards work well with firefox and opensc-pkcs11.dll, right?
>
> El Jueves, 30 de Octubre de 2008 19:26:16 Leonardo L. P. da Mata escribió:
>> i have 2 different kinds of cards, starcos and american banknote cards..
>>
>> the starcos card have been initialized with opensc and they work for
>> the browser ssl authentication.
>> the american banknote cards came initialized from the factory (i don't
>> know why people do that).
>>
>>
>>
>> On Thu, Oct 30, 2008 at 3:35 PM, Miguel Angel Tormo Alfaro
>> <mlists@...> wrote:
>> > That means opensc cannot recognize the format of your cards.
>> > Which card are you using? Did you format it with opensc?
>> >
>> > El Jueves, 30 de Octubre de 2008 18:25:09 Leonardo L. P. da Mata escribió:
>> >> i mean, the htmf could open the library, but couldn't use it to read
>> >> the cards. It says that the card is not supported.
>> >>
>> >>
>> >> On Thu, Oct 30, 2008 at 3:24 PM, Leonardo L. P. da Mata
>> >> <barroca@...> wrote:
>> >> > it was hanging on oppening the library (wrong pkcs11 interface). i've
>> >> > changed to opensc-pkcs11.dll, but now it can't reconize my cards...
>> >> >
>> >> >
>> >> >
>> >> > On Thu, Oct 30, 2008 at 8:05 AM, EJBCA Support
>> >> > <ejbca-support@...> wrote:
>> >> >> Hi Leonardo
>> >> >>
>> >> >> I'm assuming you are using the java web start deployment of Tolima. The
>> >> >> htmf log files are stored in <USER_HOME>/.hardtokenmgmt<n>_<n>.log can
>> >> >> you send it to me.
>> >> >>
>> >> >> Which tokens are you using and which pkcs11 driver?
>> >> >>
>> >> >> // Regards Philip
>> >> >>
>> >> >> Leonardo L. P. da Mata skrev:
>> >> >>> Hey, i've advanced a lot in the ejbca installation and it's
>> >> >>> integration with htmf, but i still can't use htmf correct. I'm sending
>> >> >>> this message here because the htmf list has no discussion at all.
>> >> >>>
>> >> >>> so, i'm using java 6 and intert explorer to access tolima. I've
>> >> >>> generated an administrator card, and it seems to work (i can use this
>> >> >>> card with other applications to sign).
>> >> >>>
>> >> >>> after the administrator authenthicate in the htmf, the ejbca send a message:
>> >> >>>   19:09:11,390 INFO [Log4jLogDevice] 29 de Outubro de 2008 19h9min11s
>> >> >>> BRST, CAId : -1688117755, AUTHORIZATION,
>> >> >>> EVENT_INFO_AUTHORIZEDTORESOURCE, Administrator : C LIENTCERT,
>> >> >>> Certificate SNR : 3964574de5f7dca8, CN=AdminCA1,O=EJBCA Sample,C=SE,
>> >> >>> User : No user involved, Certificate : No certificate involved,
>> >> >>> Comment : Resour ce :
>> >> >>>
>> >> >>> and the htmf hangs with no answer and no debug information.
>> >> >>>
>> >> >>> Anyone have any idea why this isn't working?
>> >> >>>
>> >> >>> BTW, the ant deploy of htmf doesn't substitute all variables correct,
>> >> >>> the $*.hostname variables are beeing deployed without beeing
>> >> >>> substituded. Maybe this is a bug of htmf (TOLIMA)
>> >> >>>
>> >> >>>
>> >> >>> Thanks.
>> >> >>>
>> >> >>> On Tue, Oct 21, 2008 at 5:34 AM, Tomas Gustavsson <tomas@...> wrote:
>> >> >>>
>> >> >>>> Thanks added it to docs for next release.
>> >> >>>>
>> >> >>>> Cheers,
>> >> >>>> Tomas
>> >> >>>>
>> >> >>>>
>> >> >>>> Leonardo L. P. da Mata wrote:
>> >> >>>>
>> >> >>>>> So, after some time trying to find the problem, i think i could get it solved.
>> >> >>>>> The eviroment variable JDK_HOME must be set correct for this to work.
>> >> >>>>> This is a problem with ncipher software that is not well documented,
>> >> >>>>> but i think it is important to put a note in the User's Guide.
>> >> >>>>>
>> >> >>>>> Command used:
>> >> >>>>> C:\Documents and
>> >> >>>>> Settings\barroca\Desktop\server_keys>c:\nfast\bin\generatekey.exe
>> >> >>>>> --import -c mscapi jcecsp pemreadfile=unprotected.pem
>> >> >>>>> keystore=temp.keystore type=RSA alias=imported1
>> >> >>>>> Result:
>> >> >>>>> recovery: Key recovery? (yes/no) [yes] >
>> >> >>>>> keystorepass: JCE key store password? (hidden)
>> >> >>>>> x509country: Country code? [] >
>> >> >>>>> x509province: State or province? [] >
>> >> >>>>> x509locality: City or locality? [] >
>> >> >>>>> x509org: Organisation? [] >
>> >> >>>>> x509orgunit: Organisation unit? [] >
>> >> >>>>> x509dnscommon: Domain name? [] >
>> >> >>>>> x509email: Email address? [] >
>> >> >>>>> nvram: Store blob in NVRAM (will require administrator cardset)? (yes/no) [no]
>> >> >>>>> key generation parameters:
>> >> >>>>>  operation      Operation to perform                                      import
>> >> >>>>>
>> >> >>>>>  application    Application                                               jcecsp
>> >> >>>>>
>> >> >>>>>  protect        Protected by                                              token
>> >> >>>>>  slot           Slot to read cards from                                   0
>> >> >>>>>  recovery       Key recovery                                              yes
>> >> >>>>>  verify         Verify security of key                                    yes
>> >> >>>>>  type           Key type                                                  RSA
>> >> >>>>>  pemreadfile    PEM file containing RSA key                               unprot
>> >> >>>>> ected.pem
>> >> >>>>>  keystore       Filename of JCE key store                                 temp.k
>> >> >>>>> eystore
>> >> >>>>>  keystorepass   JCE key store password                                    <hidde
>> >> >>>>> n>
>> >> >>>>>  alias          JCE key alias                                             import
>> >> >>>>> ed1
>> >> >>>>>  x509country    Country code
>> >> >>>>>  x509province   State or province
>> >> >>>>>  x509locality   City or locality
>> >> >>>>>  x509org        Organisation
>> >> >>>>>  x509orgunit    Organisation unit
>> >> >>>>>  x509dnscommon  Domain name
>> >> >>>>>  x509email      Email address
>> >> >>>>>  nvram          Store blob in NVRAM (will require administrator cardset)  no
>> >> >>>>>
>> >> >>>>> Loading `mscapi':
>> >> >>>>>  Module 1: 0 cards of 1 read
>> >> >>>>>  Module 1 slot 0: `mscapi' #1 (`oper')
>> >> >>>>>  Module 1 slot 0:- passphrase supplied - reading card
>> >> >>>>> Card reading complete.
>> >> >>>>>
>> >> >>>>> Subprocess failed
>> >> >>>>> Arguments: {C:/Arquivos de programas/Java/jdk1.6.0_07/bin/java.exe} com.ncipher.
>> >> >>>>> provider.tools.ImportKey --keystore temp.keystore --alias imported1 --ident d34d
>> >> >>>>> 2ec33c1b108ceb2d890094736947514ab4ca --type com.ncipher.provider.km.KMRSAPrivate
>> >> >>>>> Key --certificate C:/nfast/kmdata/tmp/436_basilisco.cert << {123456
>> >> >>>>> }
>> >> >>>>> Errors:
>> >> >>>>> FATAL: error creating temp.keystore
>> >> >>>>>
>> >> >>>>>
>> >> >>>>> ERROR: Tcl_Eval of 'store' failed: child process exited abnormally
>> >> >>>>> 17:11:36 ERROR: cannot remove kmdata file (C:\nfast\kmdata\local\key_jceshim_d34
>> >> >>>>> d2ec33c1b108ceb2d890094736947514ab4ca): No such file or directory
>> >> >>>>> nfgk_operate: SoftwareFailed
>> >> >>>>>
>> >> >>>>>
>> >> >>>>>
>> >> >>>>> I still need to test if the key is working correct, but when i list
>> >> >>>>> keys with nfkminfo, i can see the new imported keys.
>> >> >>>>>
>> >> >>>>> Thanks.
>> >> >>>>>
>> >> >>>>>
>> >> >>>>> On Mon, Oct 20, 2008 at 12:27 PM, Leonardo L. P. da Mata
>> >> >>>>> <barroca@...> wrote:
>> >> >>>>>
>> >> >>>>>> Hey Brune, the Security World is ok. I've checked  the file
>> >> >>>>>> permissions, and apparently this is not an issue, because i'm getting
>> >> >>>>>> the same problem using the system administrator.
>> >> >>>>>>
>> >> >>>>>> I'm following the steps of ejbca user's guide. When importing a file,
>> >> >>>>>> i can't access the keystore of the HSM:
>> >> >>>>>>
>> >> >>>>>> keystore: Filename of JCE key store? []
>> >> >>>>>>
>> >> >>>>>>> temp.keystore
>> >> >>>>>>>
>> >> >>>>>> ERROR: keystore: key store key is missing
>> >> >>>>>> keystore: Filename of JCE key store? []
>> >> >>>>>>
>> >> >>>>>>> 59b8a83024f6d271ac8ec03838d8e3de7c204785
>> >> >>>>>>>
>> >> >>>>>> ERROR: keystore: cannot open file
>> >> >>>>>> keystore: Filename of JCE key store? []
>> >> >>>>>>
>> >> >>>>>>> c:\nfast\kmdata\local\key_jcecsp_59b8a83024f6d271ac8ec03838d8e3de7c204785
>> >> >>>>>>>
>> >> >>>>>> ERROR: keystore: invalid keystore
>> >> >>>>>> ERROR: keystore: key store key is missing
>> >> >>>>>> keystore: Filename of JCE key store? []
>> >> >>>>>> ERROR: keystore: invalid filename
>> >> >>>>>> keystore: Filename of JCE key store? []
>> >> >>>>>>
>> >> >>>>>>> c:\nfast\kmdata\local\
>> >> >>>>>>>
>> >> >>>>>> ERROR: keystore: cannot open file
>> >> >>>>>> keystore: Filename of JCE key store? []
>> >> >>>>>>
>> >> >>>>>>
>> >> >>>>>>
>> >> >>>>>> temp.keystore contains "59b8a83024f6d271ac8ec03838d8e3de7c204785" as
>> >> >>>>>> mentioned in the user guide:
>> >> >>>>>> "Windows: 'copy con: temp.keystore' and copypaste the string, press
>> >> >>>>>> Ctrl-Z and Enter"
>> >> >>>>>>
>> >> >>>>>> Thanks again.
>> >> >>>>>>
>> >> >>>>>> On Mon, Oct 20, 2008 at 10:22 AM, Bruno Bonfils <asyd@...> wrote:
>> >> >>>>>>
>> >> >>>>>>> On Mon 20 October, Leonardo L. P. da Mata wrote:
>> >> >>>>>>>
>> >> >>>>>>>> I've read the HSM manual and checked that my Security world is a fips level 2.
>> >> >>>>>>>> The NFAST_HOME is ok. I think this a security issue. I'm gonna try
>> >> >>>>>>>> with the system administrator.
>> >> >>>>>>>>
>> >> >>>>>>> Hi,
>> >> >>>>>>>
>> >> >>>>>>> in order to create some key protected by the HSM, you need to create a
>> >> >>>>>>> Security World, and OCS (Operator Card Set). This procedure is well
>> >> >>>>>>> documented in the HSM documentations. However I may help if you trouble
>> >> >>>>>>> (ps: I work at Linagora and I used to work with EJBCA and nCipher).
>> >> >>>>>>>
>> >> >>>>>>> If you really already have a security world, check the file permissions,
>> >> >>>>>>> I don't know how is going on windows, but on unix environnement,
>> >> >>>>>>> nCipher's default permissions only allow root to read/write the security
>> >> >>>>>>> world's files.
>> >> >>>>>>>
>> >> >>>>>>> BEst regards
>> >> >>>>>>>
>> >> >>>>>>> --
>> >> >>>>>>> http://asyd.net/home/   - Home Page
>> >> >>>>>>> http://guses.org/home/  - French Speaking (Open)Solaris User Group
>> >> >>>>>>>
>> >> >>>>>>> -------------------------------------------------------------------------
>> >> >>>>>>> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
>> >> >>>>>>> Build the coolest Linux based applications with Moblin SDK & win great prizes
>> >> >>>>>>> Grand prize is a trip for two to an Open Source event anywhere in the world
>> >> >>>>>>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> >> >>>>>>> _______________________________________________
>> >> >>>>>>> Ejbca-develop mailing list
>> >> >>>>>>> Ejbca-develop@...
>> >> >>>>>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >> >>>>>>>
>> >> >>>>>>>
>> >> >>>>>> --
>> >> >>>>>> Leonardo Luiz Padovani da Mata
>> >> >>>>>> barroca@...
>> >> >>>>>>
>> >> >>>>>> "May the force be with you, always"
>> >> >>>>>> "Nerd Pride... eu tenho. Voce tem?"
>> >> >>>>>>
>> >> >>>>>>
>> >> >>>>>
>> >> >>>>>
>> >> >>>> -------------------------------------------------------------------------
>> >> >>>> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
>> >> >>>> Build the coolest Linux based applications with Moblin SDK & win great prizes
>> >> >>>> Grand prize is a trip for two to an Open Source event anywhere in the world
>> >> >>>> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> >> >>>> _______________________________________________
>> >> >>>> Ejbca-develop mailing list
>> >> >>>> Ejbca-develop@...
>> >> >>>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >> >>>>
>> >> >>>>
>> >> >>>
>> >> >>>
>> >> >>>
>> >> >>>
>> >> >>
>> >> >>
>> >> >> -------------------------------------------------------------------------
>> >> >> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
>> >> >> Build the coolest Linux based applications with Moblin SDK & win great prizes
>> >> >> Grand prize is a trip for two to an Open Source event anywhere in the world
>> >> >> http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> >> >> _______________________________________________
>> >> >> Ejbca-develop mailing list
>> >> >> Ejbca-develop@...
>> >> >> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >> >>
>> >> >
>> >> >
>> >> >
>> >> > --
>> >> > Leonardo Luiz Padovani da Mata
>> >> > barroca@...
>> >> >
>> >> > "May the force be with you, always"
>> >> > "Nerd Pride... eu tenho. Voce tem?"
>> >> >
>> >>
>> >>
>> >>
>> >
>> >
>> >
>> > -------------------------------------------------------------------------
>> > This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
>> > Build the coolest Linux based applications with Moblin SDK & win great prizes
>> > Grand prize is a trip for two to an Open Source event anywhere in the world
>> > http://moblin-contest.org/redirect.php?banner_id=100&url=/
>> > _______________________________________________
>> > Ejbca-develop mailing list
>> > Ejbca-develop@...
>> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >
>>
>>
>>
>
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Ejbca-develop mailing list
> Ejbca-develop@...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>