Yubico / yubihsm-shell

yubihsm-shell and libyubihsm
https://developers.yubico.com/yubihsm-shell/
Apache License 2.0
89 stars 52 forks source link

Unable to use pkcs11-tool with yubihsm-pkcs11.dylib module #356

Open tiger-at-cranius opened 1 year ago

tiger-at-cranius commented 1 year ago

On two different machines (MacOS and on an Ubuntu VM running on WIndows Host), I have been able to set up the YubiHSM SDK and connect to the HSM using the shell, as well as access the HSM through the openssl command using the PKCS11 engine, as described in the guide https://developers.yubico.com/YubiHSM2/Usage_Guides/OpenSSL_with_pkcs11_engine.html. However, when I try to run pkcs11-tool --module /path/to/yubihsm_pkcs11.so --login --pin 0001password \ --keypairgen --key-type rsa:2048 --label "my_key" --usage-sign, or any other pkcs11-tool command with the specified module, I get this error:

Main C_Initialize(NULL) rv:CKR_ARGUMENTS_BAD
error: PKCS11 function C_Initialize failed: rv = CKR_ARGUMENTS_BAD (0x7)
Aborting.

The bad argument in question seems to be the module argument, as the same error appears when just listing objects or even running the test option. That would indicate some incompatibility of the YubiHSM PKCS11 library and the pkcs11-tool.

qpernil commented 1 year ago

It has been tested with pkcs11-tool and should work. My guess would be that it is not finding the config file. You can set the YUBIHSM_PKCS11_DBG environment variable to get debugging even at startup (i.e. before trying to read the config file).