NitroKey HSM 2 - read back key counter

Nitrokeys
1

Currently working with a NitroKey HSM 2 and using the key counter feature - i.e. a cap on how often a specific key can be used / how many signatures can be generated.

I cannot find a way to read back the remaining uses for a key. Is there no way to get this information? I don’t mind interacting with the device on a low level (APDU).

2

Our PKCS#11 module has a vendor specific attribute CKA_SC_HSM_KEY_USE_COUNTER.

The Key Manager also reports the key use counter, which is actually returned by the applet in the SELECT APDU:

5E C: 00 A4 00 04 - SELECT Lc=2 
      0005  CC 02                                            ..
      Le=0 
   R: SW1/SW2=9000 (Normal processing: No error) Lr=28
      0000  62 1A 80 02 00 00 82 01 01 83 02 CC 02 A5 0D 90  b...............
      0010  04 FF FF FF FF 91 02 99 92 92 01 00              ............

The File Identifier (FID) must be CC || keyid. The current key use counter is reported in the ‘90’ tag as unsigned long value. Above ‘FF FF FF FF’ means “No key use counter”. The Tag ‘91’ reports the supported algorithms and ‘92’ the key domain.