Closed sztsian closed 2 years ago
I also have an Safenet eToken 5110, it does not work either.
$ pkcs11-tool --module /usr/lib64/libeToken.so --login -O
Using slot 0 with a present token (0x0)
Logging in to "my5110".
Please enter User PIN:
Private Key Object; RSA
label: test@example.com
ID: 01
Usage: decrypt, sign, unwrap
Access: sensitive, always sensitive, never extractable, local
Public Key Object; RSA 2048 bits
label: test@example.com
ID: 01
Usage: encrypt, verify, wrap
Access: local
Certificate Object; type = X.509 cert
label: test@example.com
subject: DN: C=CN, L=Default City, O=Default Company Ltd, CN=test@example.com/emailAddress=test@example.com
ID: 01
$ cat ~/.gnupg/gnupg-pkcs11-scd.conf
providers safenet
provider-safenet-library /lib64/libeToken.so
log-file /tmp/pkcs11log
verbose
debug-all
$ gpg-agent --server gpg-connect-agent << EOF
SCD LEARN
EOF
OK Pleased to meet you
S SERIALNO D27600012401115031312FDDC3EC1111
S APPTYPE PKCS11
S KEY-FRIEDNLY 8DC2B2074EFAF0D03FA0EAB3DA0B5A9F8673B3D6 /C=CN/L=Default City/O=Default Company Ltd/CN=test@example.com/emailAddress=test@example.com on my5110
S CERTINFO 101 pkcs11:model=eToken;token=my5110;manufacturer=SafeNet%2c%20Inc.;serial=0248f688;id=%01
S KEYPAIRINFO 8DC2B2074EFAF0D03FA0EAB3DA0B5A9F8673B3D6 pkcs11:model=eToken;token=my5110;manufacturer=SafeNet%2c%20Inc.;serial=0248f688;id=%01
OK
gpg also fails to show card
$ gpg2 --card-status
gpg: WARNING: server 'scdaemon' is older than us (0.10.0 < 2.3.4)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: OpenPGP card not available: Not found
Full log pkcs11log-safenet5110.txt
Within the log, similar CKR_SESSION_HANDLE_INVALID
also shows up.
gnupg-pkcs11-scd[35533.3827447616]: PKCS#11: _pkcs11h_session_validate return rv=179-'CKR_SESSION_HANDLE_INVALID'
gnupg-pkcs11-scd[35533.3827447616]: PKCS#11: Get certificate attributes failed: 179:'CKR_SESSION_HANDLE_INVALID'
However, if I change the config to
$ cat ~/.gnupg/gnupg-pkcs11-scd.conf
providers safenet
provider-safenet-library /lib64/libeToken.so
provider-safenet-allow-protected-auth
provider-safenet-cert-private
log-file /tmp/pkcs11log.txt
verbose
debug-all
Then gpg-agent already reports error
$ gpg-agent --server gpg-connect-agent << EOF
SCD LEARN
EOF
OK Pleased to meet you
S SERIALNO D27600012401115031312FDDC3EC1111
S APPTYPE PKCS11
ERR 83902463 End of file <Pinentry>
But the pinentry is really a valid one that I can use with normal GPG
$ file /usr/bin/pinentry-gtk
/usr/bin/pinentry-gtk: symbolic link to pinentry-gtk-2
Hi, You are using patched pkcs11-helper. Please build it yourself and send me logs. For yubikey to work you must use latest version of pkcs11-helper and latest gnupg-pkcs11. Alon
Hi Alon,
Thanks for the hints. It seems it's caused by my environment somewhere.
Still with the Fedora version of pkcs11-helper and gnupg-pkcs11-scd I find that yubikey works with /usr/lib64/opensc-pkcs11.so
but not libykpiv.so.2
, although I haven't confirm if the library is actually using the piv/pkcs11 applet or the gpg applet. And the eToken 5110 starts to work as well. The only thing before this work is that after I posted this issue, I powered off my computer.
I'll double confirm later and if they all work as expected I'll close the issue.
I managed to make this work and wrote my notes here. https://sztsian.github.io/2022/02/20/Using-PKCS11-Token-With-GPG.html
Closing.
I'm trying to use pkcs11 with gpg on Fedora. The hardware I am using is a Yubikey, with PIV initialized. However, I never have any luck with
gpg2 --card-status
. The packages I have isNote: gnupg-pkcs11-scd above is self-compiled. others are all from the official Fedora repo.
My config looks like the following
And the command output looks like
Attached is the full debug log pkcs11log-yubikey.txt
Within the log, I find something suspecious:
So I feel this is likely a bug somewhere. However, I have limited knowledge for debugging future, so I'm posting this issue for investigate.