Adapt pkcs11 engine and pkcs11-tool login with optional user roles

[YoussefAbady]

There are optional user roles like "crypto user" role with different IDs than default ( USER:0 , SO:1 )

Is there possible way to configure the engine to use custom role list with different IDs than the default ones whithout building the whole project from the beginning ?

[dengert]

libp11 allows application to call PKCS11_login(PKCS11_SLOT *slot, int so, const char *pin)
which leads to:

pkcs11_login(PKCS11_SLOT *slot, int so, const char *pin, int relogin)
...
 C_Login(spriv->session, so ? CKU_SO : CKU_USER,
                         (CK_UTF8CHAR *) pin, pin ? (unsigned long) strlen(pin) : 0));

So it is already in the libp11 code.

But the engine in eng_back.c has if (PKCS11_login(slot, 0, ctx->pin)) { so it only supports CK_USER.
It does not look to hard to add another engine control, like "FORCE_LOGIN" added in af06b4a

If you really need a dynamic version, you could look at overloading the password prompt. The engine uses ui_method and callback_data to have OpenSSL prompt for the password. So the it might be possible to treat a password like CK_SO:password or CK_USER:password to provide both the type and the password. This should be controlled by an engine control or default to password. The size of responses and prompts need review.

[YoussefAbady]

ok but can like change CKU_USER ID from 1 to another ID ?

The problem i facing that my HSM have another users role ( Crypto USER , Crypto OFFICER ) and each of them has ID like (213548533)

So i can't establish communication between the Engine and HSM and can't edit HSM User roles or IDs.

So can i edit the ( CKU_USER , CKU_SO ) IDs to match ( CRYP_USER , CRYPTO_SO ) IDs in my HSM ?

[dengert]

What HSM do you have?
Does it have a PKCS11 module?
Does the HSM manual says anything about how to use this with C_Login as a user role?
Does the HSM have a CKF_PROTECTED_AUTHENTICATION_PATH flag in its CK_TOKEN_INFO?
What does the vendor say the "ID" of 213548533 is?

pkcs11 C_Login expects a PIN, and only defines 3 types, with CKU_CONTEXT_SPECIFIC being used for re-authentication and used when the PIN must be entered again. But does not put any real limits on the PIN
but treats is as CK_UTF8CHAR and some cards can accept a fingerprint which can be verified on the card,
so you can really pass anything here, as lone is engine, libp11 of the module don't set some size limits expecting short pins.

213548533 == 0x0CBA7DF5 or 0xF57DBA0C. PKCS11 does support Vendor defined objects, attributes, return codes, certificates, but not a CKU_ type. These are 32 bit, with 0x80000000 set. By convention PKCS11 vendors tend to set the first 3 bytes to a vendor specific value, which leave 8 bits for multiple attributes. Mozilla NSS uses "NSC" for Netscape. OpenSC uses "OSC"

Are you confusing a CKA_ID with the 2135483?
PKCS11 says:
"The CKA_ID attribute is intended as a means of distinguishing multiple public-key/private-key pairs held
by the same subject (whether stored in the same token or not). (Since the keys are distinguished by
subject name as well as identifier, it is possible that keys for different subjects may have the same
CKA_ID value without introducing any ambiguity.)"

There are also CK_SLOT_ID, and CKA_OBJECT_ID.

CKF_PROTECTED_AUTHENTICATION_PATH indicates the module has some other way to authenticate
but not via PKCS11. These are usually some 3DES, AES, or RSA key.

[YoussefAbady]

Luna HSM using cryptoki.dll pkcs11 interface ,
and my problem is simply this:

This is the luna HSM user roles:

This is the pkcs11 user roles:

So as you can see when i access HSM as USER it understand this as Crypto Officer and i can't access it as user as pkcs11 doesn't have crypto user role with this ID.

knowing that we managed to fix this issue before in C# implementation of PKCS11 (Pkcs11Interop) like this :

Do you have any idea how can i fix this in this implementation also ?

[dengert]

As best I can tell, (googling for: luna hsm pkcs11 extensions)
https://thalesdocs.com/gphsm/luna/7.2/docs/network/Content/sdk/pkcs11/pkcs11_sample.htm

Thales has made extensive extensions to the PKCS11 standard that go beyond the PKCS11 vendor provided
extensions defined in PKCS11. This may not be the last.

2147483649 == 0x800000001 (which is not the same number you gave originally) It looks like a vendor provided value for CKU_ which is not one of the fields that PKCS11 says you can add the vendor provided bit.

I would be very reluctant to make this change in libp11. It may not be the only change that would be needed.

But Thales has their own OpenSSL engine. (Google for luna hsm openssl )
https://cpl.thalesgroup.com/sites/default/files/content/integration_guides/field_document/2020-05/007-012068-001_OpenSSL_SafeNetHSM_IntegrationGuide_RevP.pdf

So if you are using libp11 for the engine, I would not use libp11 at all, but use their engine. You must have paid a lot for this FIPS compliant device so I would skip open source code in this case too.

[YoussefAbady]

The problem that we need to integrate another solution using PKCS11 engine with our HSM.

But anyway i got your point i will try to trace the edit we did in Pkcs11Interop and worked fine to see how we can made the same change in libp11 to our case.

I suggested this edit just to be more flexible to any user roles with any ID not just ( SO:0,USER:1,CONTEXT-SPECIFIC:3)

Anyway thanks a lot for your support and interest I really appreciate it .