Nitrokey HSM2 usage with espsecure.py (RSA-3072)

Nitrokeys HSM
1

Hello, I am trying to follow this blog post to image signing in using espsecure.py
https://docs.espressif.com/projects/esptool/en/latest/esp32/espsecure/index.html
(which uses python-pkcs11).

I ran into this exception when running the script (the other lines are included to show that other than the error everything else seems to be working)

espsecure.py v4.6.1
Trying to establish a session with the HSM.
Session creation successful with HSM slot 0.
Trying to extract public key from the HSM.
Got public key with label esp32-secure-boot.
Connection closed successfully
Trying to establish a session with the HSM.
Session creation successful with HSM slot 0.
Got private key metadata with label esp32-secure-boot.
Signing payload using the HSM.
<class 'pkcs11.exceptions.DataLenRange'> Mechanism.SHA256_RSA_PKCS_PSS
Payload Signing Failed

The failure seems to point to the supported mechanism so I queried the HSM using pkcs11-tool -M
Which returns:

  SHA256-RSA-PKCS-PSS, keySize={1024,4096}, sign, verify

My current (naive) understanding is that keySize needs to have 3072? If so, how do I add it?

I created the key like this:

pkcs11-tool --module /Library/OpenSC/lib/opensc-pkcs11.so -l --keypairgen --key-type RSA:3072 --label esp32-secure-boot

Is there an extra argument or a different mechanism to add 3072? or am I missing something completely different?

Thank you for everyone’s time!

2

Those are minimum and maximum key lengths. The problem must be with the length of the input data (or maybe the parameters?). According to the PKCS#11 standard the data length should be arbitrary.

I have managed to perform the PSS signature using the following command:

printf "To be signed.\n" | 
   openssl sha256 -binary | 
   /usr/local/bin/pkcs11-tool --module /usr/local/lib/opensc-pkcs11.so \
    -m RSA-PKCS-PSS --label esp32-secure-boot --sign \
    -l -p 648219 -y privkey --hash-algorithm SHA256 > pss.sign

Using slot 0 with a present token (0x0)
Using signature algorithm RSA-PKCS-PSS
PSS parameters: hashAlg=SHA256, mgf=MGF1-SHA256, salt_len=32 B

It even verifies:

printf "To be signed.\n" | openssl sha256 -binary |
     /usr/local/bin/pkcs11-tool \
    --module /usr/local/lib/opensc-pkcs11.so \
    -m RSA-PKCS-PSS --label esp32-secure-boot --verify \
    -l -p 648219 -y pubkey \
    --hash-algorithm SHA256 --signature-file pss.sign

Using slot 0 with a present token (0x0)
Using signature algorithm RSA-PKCS-PSS
PSS parameters: hashAlg=SHA256, mgf=MGF1-SHA256, salt_len=32 B
Signature is valid

3

What is interesting libsc-hsm-pkcs11.so
doesn’t get even that far:

printf "To be signed.\n" | openssl sha256 -binary |
   /usr/local/bin/pkcs11-tool \
   --module /usr/local/lib/libsc-hsm-pkcs11.so \
   -m RSA-PKCS-PSS --label esp32-secure-boot --sign \
   -l -p 648219 -y privkey --hash-algorithm SHA256 > pss.sign
Using slot 0 with a present token (0x1)
Using signature algorithm RSA-PKCS-PSS
PSS parameters: hashAlg=SHA256, mgf=MGF1-SHA256, salt_len=32 B
error: PKCS11 function C_SignFinal failed: rv = CKR_KEY_FUNCTION_NOT_PERMITTED (0x68)
Aborting.
4

Looks like libsc-hsm-pkcs11.so can do it, but I have to specify key ID instead of a label:

printf "To be signed.\n" | /usr/local/bin/pkcs11-tool \
    --module /usr/local/lib/libsc-hsm-pkcs11.so \
    -m SHA256-RSA-PKCS-PSS --id  05 \
    --sign -l -p 648219 -y privkey  > pss.sign
Using slot 0 with a present token (0x1)
Using signature algorithm SHA256-RSA-PKCS-PSS
PSS parameters: hashAlg=SHA256, mgf=MGF1-SHA256, salt_len=32 B

@sc-hsm I noticed the above command generates 80 68 05 43 APDU, while using --label esp32-secure-boot or any other label of the RSA key produces 80 68 01 43, which in my case points to the wrong key (EC).

opensc-pkcs11 with SHA256-RSA-PKCS-PSS prefers to do the hashing in the software and then sends this command resulting in 67 00:

80 68 05 40 
00 00 33 30 31 30 0D 06 09 60 86 48 01 65 03 04 02 01 05 00 04 
20 
3C 03 0D C4 AD E0 A1 C3 
E9 46 33 9A A1 7F 76 02
2E F4 14 89 2F 3B BE C0
46 33 A8 9E DF 93 4B 17 
02 00

If I ask sc-hsm-pkcs11 to do RSA-PKCS-PSS with SHA256 algorithm, I get the following, working APDU:

80 68 05 40 
20 
3C 03 0D C4 AD E0 A1 C3 
E9 46 33 9A A1 7F 76 02 
2E F4 14 89 2F 3B BE C0
46 33 A8 9E DF 93 4B 17 
00