Expected Performance for AES-256-CBC with Nitrokey HSM 2

saper · February 10, 2023, 1:13pm

Smart-Card HSM 4K 4.0 is a new thing. Getting SmartCardHSM 4.0? - #2 by daringer Probably no new “Nitrokey HSM” under the Nitrokey brand.

On the other hand, there are some initial problems:

github.com/OpenSC/OpenSC

SmartCard-HSM V4.0 occasionally fails to generate secp521r1 signature

opened 08:45AM - 25 Oct 21 UTC

closed 07:15AM - 27 Oct 21 UTC

CardContact

### Problem Description Signing with an EC key on secp521r1 fails occasionall…y with CKR_DATA_INVALID. This issue only occurs with V4.0 devices. ### Proposed Resolution Fix sc_hsm_decode_ecdsa_signature() to correctly separate 512 from 521 bit signatures. ### Steps to reproduce Generate secp521r1 key pkcs11-tool --login --pin 648219 --keypairgen --key-type EC:nistp521 --id a1 --label a1 --usage-sign Repeatably run echo "111111111111111111111111111111111111111111111111111111112345678" | pkcs11-tool --login --pin 648219 -s -o tmp until the error shows up.