search

p11-glue / p11-kit

Provides a way to load and enumerate PKCS#11 modules.
https://p11-glue.github.io/p11-glue/p11-kit.html
Other
150 stars 92 forks source link

p11-kit list-objects should support interactive prompts for PIN #570

Closed Jakuje closed 11 months ago

Jakuje commented 11 months ago

Writing PIN inside of the URI might not be the best security practice (while it is handy and common). The pin-source should already provide a way to get pin from file or from some command so it should be easy to spawn some prompt, but having a separate option (--login?) to log in and ask interactively for pin would be preferred.

Additionally, I was not able to make the list-objects login to the token with the uri like this -- prints just the publicly accessible private key:

p11-kit list-objects --verbose pkcs11:type=private?pin-source=file:~/pin

(the --verbose really does not print anything new and I really do not see if the log was attempted, if if failed or what happened)