HSM2: pksc11-tool label and id issue

Nitrokeys HSM
1

Hi there,
… this is strange:
When creating a new key pair, label and id get screwed up. Here’s the command (Fedora 38):

$ pkcs11-tool --login --pin … --login-type user --keypairgen --id 12345678 --key-type EC:secp256k1 --label 34567890
Using slot 1 with a present token (0x4)
Key pair generated:
Private Key Object; EC
label: 34567890
ID: 12345678
Usage: sign, derive
Access: none
Public Key Object; EC EC_POINT 256 bits
EC_POINT: 04410426671a50ddac05c88fd29ec69c9f008608dde7080b3658cf4a17fc3b22b86aa5aec4c9e17a79193a1afbc0d347a5847fca7884dd6e3760d6d23d9d29a214a068
EC_PARAMS: 06052b8104000a
label: 34567890
ID: 12345678
Usage: verify, derive
Access: none

so far so good, however:

$ pkcs11-tool -O
Using slot 1 with a present token (0x4)
Public Key Object; EC EC_POINT 256 bits
EC_POINT: 044104e49985de8c10d6e2e2a06b37474a7124a9a0a87e0a58352a5a18e296085c938dfac39d3c877ffeb6d46c855d038d42781e88868be37759a4c085601898977a50
EC_PARAMS: 06052b8104000a
label: Private Key
ID: 10
Usage: verify
Access: none
Profile object 1892977856
profile_id: CKP_PUBLIC_CERTIFICATES_TOKEN (4)

2

Do you have OpenSC caching disabled ?

3

yep, with cache disabled it works. Thanks!

1 Like