Hi Rickard, Thank you for the clarifications. Thanks also to Roland for the previous information. I will check in more details my trials and get back to you, if there are still some issues.
In addition, concerning the key generation are there any advises when to use the function C_CreateObject instead of C_GenerateKey ? I'm rising this question since, as given in the specification, we can use both of them for key generation. But what would be the best choice? Thanks in advance. Best, Elizabeta Le 14 avr. 2015 à 20:58, Rickard Bellgrim <[email protected]> a écrit : > Hi Elizabeta > > C_Login() will log in the user on the token, thus changing the login state > for all sessions on that token. The test script will login using hSessionRO, > but hSessionRW will also move from the public state to the user state. > > If you add C_Logout(hSessionRO) after the key generation and then try to > create a signature, you should get rv==CKR_USER_NOT_LOGGED_IN. > > It is not possible to use a private object (CKA_PRIVATE==CK_TRUE) without > being logged in. You need the PIN to decrypt the key material. > > // Rickard > > On Tue, Apr 14, 2015 at 3:21 PM, Elizabeta <[email protected]> > wrote: > Hi Roland, > > I have a set of CPPUNIT tests for PKCS#11 that I'm using to discover SoftHSM, > based on the SoftHSM v2 test configuration. > For key generation, I'm using the generateKey function (see > SignVerifyTests.cpp in the SoftHSM v2 test folder). > > However, the outcome of my tests, even if the CKA_PRIVATE attribute is > CK_TRUE, is that I'm managing to sign without authentication. > > Cheers, > Elizabeta > > Le 14 avr. 2015 à 13:54, Roland van Rijswijk - Deij > <[email protected]> a écrit : > > > Hi Elizabeta, > > > > Elizabeta wrote: > >> I'm new to opendnsec. I've tried to use SoftHSM v2 and I was able to sign > >> a message without logging in. > >> Is that fine for SoftHSM ? since in the PKCS#11 specification it is > >> written that some tokens may not require any type of authentication to > >> make the usage of its cryptographic functions. > > > > To answer your question we'll need a little bit more context. When you > > say sign, do you mean that you have (created) a program that used > > SoftHSM v2 as a PKCS #11 library? And if so, how did you create the keys > > that you were using to sign? If the private key was created with the > > CKA_PRIVATE attribute set to CK_FALSE, then you can create signatures > > without logging in on the token. > > > > Cheers, > > > > Roland > > > > -- > > -- Roland M. van Rijswijk - Deij > > -- SURFnet bv > > -- w: http://www.surf.nl/en/about-surf/subsidiaries/surfnet > > -- e: [email protected] > > _______________________________________________ > Opendnssec-user mailing list > [email protected] > https://lists.opendnssec.org/mailman/listinfo/opendnssec-user >
_______________________________________________ Opendnssec-user mailing list [email protected] https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
