Problems getting started

[gmrza]

I am trying to use a PicoHSM connected to a Raspberry Pi 5.

I've started following the instructions at https://github.com/polhenarejos/pico-hsm/blob/master/doc/usage.md, but I am getting stuck.

output of lsusb is as follows:

# lsusb Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub Bus 003 Device 005: ID 1050:0030 Yubico.com Pico Key Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Running initialisation using pico-hsm-tool.py works:

# python3 pico-hsm-tool.py --pin 648219 initialize --so-pin 57621880
Pico HSM Tool v2.4
Author: Pol Henarejos
Report bugs to https://github.com/polhenarejos/pico-hsm/issues


********************************
*   PLEASE READ IT CAREFULLY   *
********************************

This tool will erase and reset your device. It will delete all private and secret keys.
Are you sure?
[Press enter to confirm]
Public Point: 048f787ae291b62434db9bdb696435428c9c378c502be688c7c068816f37a7cd2a2f797e7af8b119184e24d1906a3dded8513f28bc242a75cac8ba066d294c15d2
Device name: ESPICOHSMTRDT149
Certificate uploaded successfully!

Note that the device is initialized with a default PIN and configuration.
Now you can initialize the device as usual with your chosen PIN and configuration options.

However, when I try to use pkcs11-tool, it does not see the HSM:

# pkcs11-tool --login --pin 648219 --change-pin --new-pin 123456
No slots.

I have added the following lines to the start of /etc/ssl/openssl.cnf:

openssl_conf = openssl_init
[openssl_init]
engines=engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/aarch64-linux-gnu/opensc-pkcs11.so
MODULE_PATH = /usr/lib/aarch64-linux-gnu/opensc-pkcs11.so
init=0
PIN=648219

At this point, I am a bit stuck trying to work out what I have got wrong.

Any assistance would be greatly appreciated.

Geoff.

[polhenarejos]

Did you patch with pid 0030?

[gmrza]

Did you patch with pid 0030?

Yes, I did, using the Pico Commissioner, I configured it as a YubiHSM.

[polhenarejos]

Yubi is not likely working with middlewares like OpenSC. Actually, with a Yubi VID you won’t be able to commission again through the Web.
Use FSIJ VIDPID, for instance. If WebUSB doesn’t work anymore, wipe the flash with picotool.

[gmrza]

Yubi is not likely working with middlewares like OpenSC. Actually, with a Yubi VID you won’t be able to commission again through the Web. Use FSIJ VIDPID, for instance. If WebUSB doesn’t work anymore, wipe the flash with picotool.

I've given that a try, but still no luck.

dmesg reports the following:

[ 3586.845414] usb 3-1: USB disconnect, device number 2
[ 3587.824501] usb 3-1: new full-speed USB device number 3 using xhci-hcd
[ 3587.973085] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10
[ 3587.985084] usb 3-1: New USB device found, idVendor=feff, idProduct=fcfd, bcdDevice= 7.00
[ 3587.985089] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 3587.985092] usb 3-1: Product: Pico Key
[ 3587.985094] usb 3-1: Manufacturer: Pol Henarejos
[ 3587.985097] usb 3-1: SerialNumber: 9646D23F044C8C48

lsusb reports:

Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 003: ID feff:fcfd Pol Henarejos Pico Key
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

pico-hsm-tool.py still works fine:

Pico HSM Tool v2.4
Author: Pol Henarejos
Report bugs to https://github.com/polhenarejos/pico-hsm/issues


********************************
*   PLEASE READ IT CAREFULLY   *
********************************

This tool will erase and reset your device. It will delete all private and secret keys.
Are you sure?
[Press enter to confirm]
Public Point: 048f787ae291b62434db9bdb696435428c9c378c502be688c7c068816f37a7cd2a2f797e7af8b119184e24d1906a3dded8513f28bc242a75cac8ba066d294c15d2
Device name: ESPICOHSMTRDT149
Certificate uploaded successfully!

Note that the device is initialized with a default PIN and configuration.
Now you can initialize the device as usual with your chosen PIN and configuration options.

When I try to move to using opensc, it doesn't detect the device.

It looks like the problem may be with pcscd.
When I run pcsc-scan, it doesn't detect the device:

PC/SC device scanner
V 1.6.2 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader... | 

Here are the settings I've used now in Pico Commissioner:

[gmrza]

I seem to be making some progress. It looks like the first problem is that pcscd does not know the vendor and product ids. So I made some edits to /usr/lib/pcsc/drivers/ifd-ccid.bundle/Contents/Info.plist:

# diff -c /tmp/Info.plist Info.plist 
*** /tmp/Info.plist	2025-08-25 15:34:02.137901842 +1000
--- Info.plist	2025-08-25 12:50:28.539190710 +1000
***************
*** 664,669 ****
--- 664,670 ----
  		<string>0x08C3</string>
  		<string>0x15E1</string>
  		<string>0x062D</string>
+ 		<string>0xFEFF</string>
  	</array>
  
  	<key>ifdProductID</key>
***************
*** 1230,1235 ****
--- 1231,1237 ----
  		<string>0x0402</string>
  		<string>0x2007</string>
  		<string>0x0001</string>
+ 		<string>0xfcfd</string>
  	</array>
  
  	<key>ifdFriendlyName</key>
***************
*** 1796,1801 ****
--- 1798,1804 ----
  		<string>Precise Biometrics Precise 200 MC</string>
  		<string>RSA RSA SecurID (R) Authenticator</string>
  		<string>THRC Smart Card Reader</string>
+ 		<string>Pico Key</string>
  	</array>
  
  	<key>Copyright</key>

After that, the output of pcsc_scan looks more promising:

# pcsc_scan 
PC/SC device scanner
V 1.6.2 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
0: Pico Key [Pico Key HID Interface] (9646D23F044C8C48) 00 00
 
Mon Aug 25 15:39:28 2025
 Reader 0: Pico Key [Pico Key HID Interface] (9646D23F044C8C48) 00 00
  Event number: 0
  Card state: Card inserted, 
  ATR: 3B FE 18 00 00 81 31 FE 45 80 31 81 54 48 53 4D 31 73 80 21 40 81 07 FA

ATR: 3B FE 18 00 00 81 31 FE 45 80 31 81 54 48 53 4D 31 73 80 21 40 81 07 FA
+ TS = 3B --> Direct Convention
+ T0 = FE, Y(1): 1111, K: 14 (historical bytes)
  TA(1) = 18 --> Fi=372, Di=12, 31 cycles/ETU
    129032 bits/s at 4 MHz, fMax for Fi = 5 MHz => 161290 bits/s
  TB(1) = 00 --> VPP is not electrically connected
  TC(1) = 00 --> Extra guard time: 0
  TD(1) = 81 --> Y(i+1) = 1000, Protocol T = 1 
-----
  TD(2) = 31 --> Y(i+1) = 0011, Protocol T = 1 
-----
  TA(3) = FE --> IFSC: 254
  TB(3) = 45 --> Block Waiting Integer: 4 - Character Waiting Integer: 5
+ Historical bytes: 80 31 81 54 48 53 4D 31 73 80 21 40 81 07
  Category indicator byte: 80 (compact TLV data object)
    Tag: 3, len: 1 (card service data byte)
      Card service data byte: 81
        - Application selection: by full DF name
        - EF.DIR and EF.ATR access services: by GET RECORD(s) command
        - Card without MF
    Tag: 5, len: 4 (card issuer's data)
      Card issuer data: 48 53 4D 31
    Tag: 7, len: 3 (card capabilities)
      Selection methods: 80
        - DF selection by full DF name
      Data coding byte: 21
        - Behaviour of write functions: proprietary
        - Value 'FF' for the first byte of BER-TLV tag fields: invalid
        - Data unit in quartets: 2
      Command chaining, length fields and logical channels: 40
        - Extended Lc and Le fields
        - Logical channel number assignment: No logical channel
        - Maximum number of logical channels: 1
    Tag: 8, len: 1 (status indicator)
      LCS (life card cycle): 07
+ TCK = FA (correct checksum)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B FE 18 00 00 81 31 FE 45 80 31 81 54 48 53 4D 31 73 80 21 40 81 07 FA
	Smartcard-HSM
	http://www.cardcontact.de/products/sc-hsm.html

So, now we go on to pkcs11-tool. Things are starting to look more promising:

# pkcs11-tool -L
Available slots:
Slot 0 (0x0): Pico Key [Pico Key HID Interface] (9646D23F044C8C48) 00 00
  token label        : Pico-HSM (UserPIN)
  token manufacturer : Pol Henarejos
  token model        : PKCS#15 emulated
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 24.13
  firmware version   : 5.6
  serial num         : ESPICOHSMTR
  pin min/max        : 6/15

And now for trying to change the pin:

# pkcs11-tool --login --pin 648219 --change-pin --new-pin 123456
Using slot 0 with a present token (0x0)
PIN successfully changed

It looks like I am on the right track!