I have two Nitrokey HSM 2 tokens (firmware 4.1), serials DENK0400133 and
DENK0400273, previously initialized for testing. The SO-PINs were lost, and
both the SO-PIN and user PIN are now blocked on each token.
I attempted the forum guidance here ( Re-initialize NitroKey HSM 2 ), through pki-as-a-service.net. Both tokens show “SO-PIN locked” and “User PIN locked” in sc-hsm-tool. The portal authenticates the device (green tick) but then Requires the user PIN to log in and reports “SmartCard-HSM User-PIN blocked (6983)” and goes into a loop.
Is there any way to reload the firmware or otherwise recover these tokens when
both PINs are blocked? They hold only test keys, and erasing them is the goal.
Firmware can only be reloaded via the PKIaaS, as the process not only loads the firmware but also creates a new device certificate. However you need to have access to the portal to do that and you can not login with a blocked token for security reason.
You can of course register a new token for your account and then use that token for login. This allows you to reload the firmware on any of the token you have at hand.
It is not required to register the token with your account that you want update. You can do that with any token in your possession.
There is a reason why we recommend to start with a well-known SO-PIN and change to a private SO-PIN value once you go into production. We also recommend to use a Managed SO-PIN, as this drastically reduces the risk of loosing the SO-PIN, while still maintaining a good level of security.
