Nitrokey HSM, n-of-m scheme and XCA

Nitrokeys HSM
1

I’m trying to use a Nitrokey HSM2 with n-of-m public key auth in XCA.

It works the first time when I unlock the HSM with scsh3gui and generate the keys / certificates. But the next time I XCA does not find the private keys on the HSM anymore. I made sure the HSM is unlocked / authenticated, but I just get the error “could not find private key” when trying to use the key / certificate for anything.
I also tried to setup a new XCA database and reimport the keys from the HSM. Results in the same issue. Even if XCA just found and imported the key, I get the same error.

Any Ideas? It works fine If I use a PIN only for the private key. But thats not what I need.

2

A new session to the Nitrokey HSM will select a new application and this causes the existing “session” to be invalidated. While not necessarily a bug, I have described the drawbacks of this in

Unless XCA can support Nitrokey’s n-of-m scheme this might be hard to get working.

3

We are working on a Cloud-HSM integration for the sc-hsm-pkcs11 module. That way you can define an URL to which the PKCS#11 module will connect in the C_Login call. In the web-service at the other end you can perform public key authentication and enabled access to the device. When you disconnect the token from the web-service, the PKCS#11 processing will continue.

We will post here, when that function is available.

4

If I understand corrctly, openssl / XCA are currently unusable. - So what solution can be used to manage a PKI with n-of-m on Nitrokey HSM?

5

The PKI-as-a-Service software.

6

The sc-hsm-embedded now has support for remote login, which makes n-of-m Public Key Authentication and remote PIN entry possible when using PKCS#11.

Remote login means, that you can configure the PKCS#11 module so that it indicates CKF_PROTECTED_AUTHENTICATION_PATH to the application. The application then calls C_Login() without prompting for a PIN and the module connects to an URL configured in the PKCS11_LOGIN_URL environment variable using RAMOverHTTP.

The service listening at the URL endpoint can then connect to the SmartCard-HSM and perform whatever is required to login. When the service terminates the RAMOverHTTP session, the C_Login() resumes and passes back control to the application.

The user interface is similar to using a PIN-PAD reader. Such a device is also indicated to the calling application with CKF_PROTECTED_AUTHENTICATION_PATH. XCA for examples prompts “Please enter the PIN on the PIN-PAD” in that case. Instead you switch to the service and enter the PIN there.

The SmartCard-HSM Cloud Service supports a RAMOverHTTP endpoint that can be used for this.

To give this a try, you can run the SmartCard-HSM Cloud Service locally and call the sc-hsm-pkcs-test with

$ PKCS11_LOGIN_URL=http://localhost:8080/rt/hsm ./sc-hsm-pkcs11-test --module ../pkcs11/.libs/libsc-hsm-pkcs11.so
PKCS11 unit test running.
Calling C_GetFunctionList Calling C_Initialize - CKR_OK : Passed
Calling C_GetInfo - CKR_OK : Passed
Calling C_GetSlotList - CKR_OK : Passed
Calling C_GetSlotInfo for slot 1 - CKR_OK : Passed
Slot manufacturer: CardContact
Slot ID : Slot description: 1 : REINER SCT cyberJack RFID basis 00 00
Slot flags: 7
Calling C_GetTokenInfo - CKR_OK : Passed
Token label       : SmartCard-HSM
Token manufacturer: CardContact (www.cardcontact.de)
Token model       : SmartCard-HSM
Token flags       : 50d
Calling C_OpenSession - CKR_OK : Passed
Calling C_Login User to connect to http://localhost:8080/rt/hsm
- CKR_OK
Calling C_CloseSession - CKR_OK : Passed
Calling C_Finalize - CKR_OK : Passed
Unit test finished.
7 tests performed.
0 tests failed.

The same should work with XCA when using

$ PKCS11_LOGIN_URL=http://localhost:8080/rt/hsm xca

assuming that you configured the libsc-hsm-pkcs11.so module in XCA.

The actual login is done on the Cloud-HSM webpage. Once the module has connected, a refresh shows the SmartCard-HSM status page. You can there enter the PIN or perform PKA. When finished, you press Disconnect, but remember to select the “Stay logged in” option. Without that option, the disconnect will de-authenticate the online session.

Not all PKCS#11 applications support CKF_PROTECTED_AUTHENTICATION_PATH well. For example the PKI setup with OpenSSL still prompts for a User-PIN, but then calls C_Login() without that value. The module will then connect and allow remote login and things will work out. The issue requires further investigation with the OpenSSL PKCS11-Provider project.

We will further test other integrations and are happy to receive user feedback what works and what not.