Recovery Nitrokey HSM firmware

Nitrokeys HSM
1

Hello! I can’t restore the firmware for the Nitrokey HSM 2. After installing the firmware from GitHub (via JTAG), pkcs11/15 doesn’t find the slots. Serial number is wrong after re-flashing.

$ pkcs11-tool -I
Cryptoki version 2.20
Manufacturer OpenSC Project
Library OpenSC smartcard framework (ver 0.20)
error: PKCS11 function C_GetSlotInfo failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.
$ pkcs15-tool -D
Using reader with a card: Nitrokey Nitrokey HSM (01A001000000000 ) 00 00
PKCS#15 binding failed: Transmit failed

Could you help me please to re-init it?

2

Which firmware did you try to modify and how? Can you provide the details?

3

Hello I’ve programmed Release HSM: support new hardware platform · Nitrokey/nitrokey-pro-firmware · GitHub this build through JTAG (using j-link), and after that pkcs dosn’t see the slots.

4

Well, maybe you should try to roll back. I’ve never done this before, as the SmartCard applet is much more interesting than this firmware.

5

What are the USB Vendor / Device IDs reported by the device?
Can you compare them to the old ones before the upgrade?

6

I didn’t check it before, but serial number was changed. I’ve googled Nitrokey HSM 2 logs and PID/VID looks the same. Also, I cannot update SmartCard applet as well.

7

I don’t know why are you even doing this, but if I read properly the newest firmware is meant for 4.0 devices. Maybe you should try something from the older branch GitHub - Nitrokey/nitrokey-pro-firmware at ci-hsm

8

Thanks, I will try, I’ve also programmed this one Release HSM2 release · Nitrokey/nitrokey-pro-firmware · GitHub but it was the same result.

9

Can you dump available USB descriptors? And please do not avoid putting actual data in your reply.
Besides, if you are a JTAG expert, you can probably try to debug the code via JTAG.

10

I think, that I’m really using a wrong version of firmware for my key. Also the another strange things:
on the original firmware the name was

Nitrokey Nitrokey HSM (DENKXXXXXXXXXXXXX ) 00 00

but now

Using reader with a card: Nitrokey Nitrokey HSM (01A001000000000 ) 00 00

Looks like that SmartCard-HSM doesn’t give a valid data.

11
12

I’ve checked this branch GitHub - Nitrokey/nitrokey-pro-firmware at ci-hsm it also doesn’t work for me (PC doesn’t find Nitrokey, as I understand STM32 don’t see smartcard?).

13

Sorry, I am out. I have no idea. Maybe this is related to the clock and the timing and other issues mentioned in

or maybe Nitrokey HSM: timeout on initialization after heavy use · Issue #78 · Nitrokey/nitrokey-pro-firmware · GitHub or Nitrokey HSM: invalid serial number after a heavy load · Issue #79 · Nitrokey/nitrokey-pro-firmware · GitHub