libp11 with openssl and optee_client pkcs11 ta

[Dvergatal]

I was wondering about usage of libp11 for my project together with https://github.com/etienne-lms/optee_os/tree/sks-to-pkcs11. Because from what i understand the libp11 is for connecting openssl with some other third party pkcs11 implementations? Please correct me if i am wrong.

[dengert]

Libp11 defines a OpenSSL engine and a API than can be called by other applications. The engine code uses the API in libp11 which loads and calls third party PKCS#11 module.

But OP-TEE appears to be some linux kernel interface. In a 10 minute search, it is not clear if they define a PKCS#11 module or use one.

Best to ask OP-TEE or https://github.com/etienne-lms .

[Dvergatal]

I know what is OP-TEE and yes there is a defined PKCS#11 module for OP-TEE. Etienne-lms has done it in his branch. So if i have a third party PKCS#11 module for OP-TEE it can be called by libp11 engine and then through opennssl?

[dengert]

Yes. The pkcs#11 module and other parameters are pased via the engine or the openssl config file
https://github.com/OpenSC/libp11/blob/master/README.md#pkcs-11-module-configuration

MODULE_PATH would be the PKCS#11 module for OP-TEE

[Dvergatal]

Ok and does the MODULE_PATH must be the full path to the PKCS#11 module for OPT-TEE or is it being taken from /usr/lib;/lib paths?

[mtrojnar]

Please use the full path. PKCS#11 modules are designed to be opened with dlopen(3), so they are not normally deployed on the dynamic linker path.

[Dvergatal]

Ah i see, than it ok to me, because i am compiling this op-tee module and from what i know it deploys it in dynamic linker path. But never the less it can be also a full path:] Thank you all for help i can close now this issue.

[Dvergatal]

I'm sorry for reopening this issue but i have come to the real situation when i am testing the hypothesis :] I have now working pkcs11 ttrusted application and a module for pkcs11 to use with openssl. My configuration file looks like this:

openssl_conf = openssl_init

[openssl_init]
engines = engine_section

[engine_section]
pkcs11 = pkcs11_section

[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/engines-1.1/libpkcs11.so
MODULE_PATH = /usr/lib/libckteec.so
init = 0

and this is the command with which i wanted to generate a certificate request for a already stored key on that token:

[root@rk3399:~]# openssl req -new -x509 -days 365 -subj '/CN=my key/' -sha256 -config engine.conf -engine pkcs11 -keyform engine -key slot_0-tls -out cert.pem

But unfortunately it produces me an error:

547486870672:error:26078067:engine routines:engine_list_add:conflicting engine id:crypto/engine/eng_list.c:63:
547486870672:error:2606906E:engine routines:ENGINE_add:internal list error:crypto/engine/eng_list.c:223:
547486870672:error:260B6067:engine routines:dynamic_load:conflicting engine id:crypto/engine/eng_dyn.c:502:
547486870672:error:260BC066:engine routines:int_engine_configure:engine configuration error:crypto/engine/eng_cnf.c:141:section=pkcs11_section, name=dynamic_path, value=/usr/lib/engines-1.1/libpkcs11.so
547486870672:error:0E07606D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:177:module=engines, value=engine_section, retcode=-1

Can anybody help resolve this issue?

[Dvergatal]

Using this command:

[root@rk3399:~]# openssl
OpenSSL> engine dynamic -pre SO_PATH:/usr/lib/engines-1.1/libpkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/libckteec.so

works and produces an output:

(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/engines-1.1/libpkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib/libckteec.so
Loaded: (pkcs11) pkcs11 engine

[Dvergatal]

Ok i have went further but now i have a new issue. When i have initialized engine i try to generate signing request with this command:

openssl req -engine pkcs11 -new -key "pkcs11:object=tls;type=private;pin-value=1234567890" -keyform engine -out req.pem -text -x509 -subj "/CN=Andreas Jellinghaus"

and the output is:

engine "pkcs11" set.
Found uninitialized token
Login failed
Login to token failed, returning NULL...
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
548022168720:error:82074102:PKCS#11 module:pkcs11_login:User pin not initialized:p11_slot.c:240:
548022168720:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:crypto/engine/eng_pkey.c:78:
unable to load Private Key

but for listing of available slots i see:

[root@rk3399:~]# pkcs11-tool --module /usr/lib/libckteec.so -L
Available slots:
Slot 0 (0x0): OP-TEE PKCS11 TA - TEE UUID 94e9ab89-4c43-56ea-8b35-45dc07226830
  token label        : foo
  token manufacturer : Linaro
  token model        : OP-TEE TA
  token flags        : login required, rng, SO PIN to be changed, token initialized, PIN initialized, other flags=0x200
  hardware version   : 0.0
  firmware version   : 0.1
  serial num         : 0000000000000000
  pin min/max        : 10/128
Slot 1 (0x1): OP-TEE PKCS11 TA - TEE UUID 94e9ab89-4c43-56ea-8b35-45dc07226830
  token state:   uninitialized
Slot 2 (0x2): OP-TEE PKCS11 TA - TEE UUID 94e9ab89-4c43-56ea-8b35-45dc07226830
  token state:   uninitialized

Maybe i should specify on which slot i want to call that command but i dunno how. Maybe someone can point me?

[dengert]

Looks like the Found uninitialized token or pin is not initialized and C_Login failed.

If you really want to see the PKCS11 traffic, test with OpenSC SPY as the MODULE_PATH: or --module
and env: export PKCS11SPY=/usr/lib/libckteec.so and maybe export PKCS11SPY_OUTPUT=/tmp/spy.txt
See https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC.
That would show you what slots you module is returning, and what slot was selected and why C_Login failed.

[Dvergatal]

I'm sorry but i'am confused now. I should call:

export PKCS11SPY=/usr/lib/libckteec.so
export PKCS11SPY_OUTPUT=/tmp/spy.txt

and than:

openssl req -engine pkcs11 -key "pkcs11:object=tls;type=private" -keyform engine -out req.pem -text -x509 -subj "/CN=Andreas Jellinghaus"

?

[Dvergatal]

Ohhh ok i understood now. Changing my MODULE_PATH from /usr/lib/libckteec.so into /usr/lib/pkcs11-spy.so in openssl.conf, do the exports and than call the command.

[Dvergatal]

Ok i am uploading the spy.txt. From what i see it uses slot id 2, but i am not sure. Please if you could verify it.