Nitrokey HSM, n-of-m scheme and XCA

Nitrokeys HSM
1

I’m trying to use a Nitrokey HSM2 with n-of-m public key auth in XCA.

It works the first time when I unlock the HSM with scsh3gui and generate the keys / certificates. But the next time I XCA does not find the private keys on the HSM anymore. I made sure the HSM is unlocked / authenticated, but I just get the error “could not find private key” when trying to use the key / certificate for anything.
I also tried to setup a new XCA database and reimport the keys from the HSM. Results in the same issue. Even if XCA just found and imported the key, I get the same error.

Any Ideas? It works fine If I use a PIN only for the private key. But thats not what I need.

2

A new session to the Nitrokey HSM will select a new application and this causes the existing “session” to be invalidated. While not necessarily a bug, I have described the drawbacks of this in

Unless XCA can support Nitrokey’s n-of-m scheme this might be hard to get working.

3

We are working on a Cloud-HSM integration for the sc-hsm-pkcs11 module. That way you can define an URL to which the PKCS#11 module will connect in the C_Login call. In the web-service at the other end you can perform public key authentication and enabled access to the device. When you disconnect the token from the web-service, the PKCS#11 processing will continue.

We will post here, when that function is available.

4

If I understand corrctly, openssl / XCA are currently unusable. - So what solution can be used to manage a PKI with n-of-m on Nitrokey HSM?

5

The PKI-as-a-Service software.