Nitrokey M-of-N wrapped backup

Nitrokeys
1

Hello,

I’m trying to export a wrapped backup of my keys generated within an HSM which is configured to use M-of-N authentication and an M-of-N DKEK domain. The command that I am trying to run is the following:

sc-hsm-tool --wrap-key privKey.bin --key-reference 1 --pin env:USERPIN

The error that I am getting is the following:

PIN verification failed with Data object not found

Full OPENSC debug output is here:

Is there an issue with using sc-hsm-tool to export a wrapped key?

2

How do you normally login to the token? This attempts only to login with a plain User PIN if I see that correctly.

What does pkcs15-tool --list-pins say?

3

PIN [UserPIN]
Object Flags : [0x3], private, modifiable
Auth ID : 02
ID : 01
Flags : [0x812], local, initialized, exchangeRefData
Length : min_len:6, max_len:15, stored_len:0
Pad char : 0x00
Reference : 129 (0x81)
Type : ascii-numeric
Path : e82b0601040181c31f0201::
Tries left : 3

PIN [SOPIN]
Object Flags : [0x1], private
ID : 02
Flags : [0x9A], local, unblock-disabled, initialized, soPin
Length : min_len:16, max_len:16, stored_len:0
Pad char : 0x00
Reference : 136 (0x88)
Type : bcd
Path : e82b0601040181c31f0201::
Tries left : 15

4

What kind of authentication scheme has been selected when initializing the device ? Public Key Authentication, Public Key Authentication or User-PIN, Public Key Authentication and User-PIN ? Something else?

5

I have selected Public Key Authentication from within the SCSH3 GUI.

Also worth noting that I get the same issue when trying to create a wrapped backup even without SSS enabled (i.e., with $ sc-hsm-tool -X --dkek-shares 2 )

Also, to answer your question, we are trying to login to the HSM via scsh3 with public-key authentication (total shares 5, required shares 3)

6

I presume that sc-hsm-tool cannot login to the token using Public Key Authentication, since there is no real User-PIN object.

7

That is correct. Is there an update to sc-hsm-tool that supports Public-key authN? I have seen this PR: https://github.com/OpenSC/OpenSC/pull/1711 but it does not support a method for authentication.

8

I purchased few Nitrokeys to play with public key authentication recently, but I haven’t got round to it yet. I think the fastest way now is to write some JavaScript for the scsh. I have written few scripts for myself there and it is not very complicated.

https://github.com/OpenSC/OpenSC/issues/594 is the issue to watch anyway.

1 Like