HSM2 won't initialize

Nitrokeys
1

I just received the HSM2 and try to follow the instrctions at nitrokey.com/start

I run opensc 0.19 built a few days ago (works well with the Nitrokey start).

$ pkcs11-tool --module /usr/lib/opensc-pkcs11.so --init-token --init-pin --so-pin=3537363231383830 --new-pin=648219 --label="test" --pin=648219Using slot 0 with a present token (0x0)
error: PKCS11 function C_InitToken failed: rv = CKR_FUNCTION_NOT_SUPPORTED (0x54)
Aborting.

I tried a couple other commands like changing PIN, but that didn’t work either :

$ pkcs11-tool --login --pin 648219 --change-pin --new-pin 123456 --module /usr/lib/opensc-pkcs11.so 
Using slot 0 with a present token (0x0)
error: PKCS11 function C_Login failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

Some more error messages :

$ opensc-explorer 
OpenSC Explorer version 0.20.0
Using reader with a card: Nitrokey Nitrokey HSM (DENK02001740000         ) 00 00
OpenSC [3F00]> ls
FileID	Type  Size
 2F02 unable to select file, Incorrect parameters in APDU
 CC00 unable to select file, Incorrect parameters in APDU

and this :

$ sc-hsm-tool --initialize --so-pin 3537363231383830 --pin 648219
Using reader with a card: Nitrokey Nitrokey HSM (DENK02001740000         ) 00 00
Failed to connect to card: Card is invalid or cannot be handled
2

Hi!

Nothing comes to my mind unfortunately. Both device and the smart card are responding, since the serial number is presented in the USB descriptor (the DENK string).

Perhaps there is a problem with the OpenSC itself. I understood, that you are using your own build, is that right? It might be, that HSM cards need additional switch (edit: during build configuration). Nitrokey Start is based on OpenPGP, which is another format.
Can you try with SCSH3?

cc @nitroalex

3

I just tried another machine with also a fresh install of opensc 0.19.
This time ubuntu (vs. debian previously).
Things work a lot better, although I get the same error with opensc-explorer (but never mind, I presume it may not be supposed to work).

I should dig deeper my debian installation, maybe remove some of the old packages that may linger. I’m closing for now.

4

I think opensc-explorer is not designed to work with the HSM.
About the solution, I just want to clarify - have you used the distro original package, or built own from source on the Ubuntu?

5

I both cases I built opensc 0.19 from source, but everything else is debian packages (pcsclite, libiccid, etc…). I need to check if the distribution opensc packages have been removed, they may interfere somehow.