Sign Message using NitroKey Storage 2

Nitrokeys
1

Hello,

I am trying to use NitroKey Storage 2 as a simple ECDSA signer. I want it to simply sign a “challenge” message to authenticate the dongle holder. I tried the “gnupg” but i found that gpg adds some data to the received message before hashing and signing it. Then, I tried the “pkcs11-tool” but i was unable to generate ECC:prime256v1 keys and got the following output:

C:\Program Files\OpenSC Project\OpenSC\tools> .\pkcs11-tool.exe --module …\pkcs11\opensc-pkcs11.dll -l --pin 123456 --keypairgen --key-type EC:prime256v1 --id 02
Using slot 0 with a present token (0x0)
error: PKCS11 function C_GenerateKeyPair failed: rv = CKR_GENERAL_ERROR (0x5)
Aborting.

I am using Windows 10 with OpenSC-0.20.0. I have installed the " OpenSC-0.20.0_win64.msi" from this page: https://github.com/OpenSC/OpenSC/releases/tag/0.20.0

Am i doing something wrong? Is there a way to simply sign messages with the NitroKey Storage 2 without adding data? and if so, how?

Your help is much appreciated.

2

Hi @Nizar!

You can generate the keys with the GnuPG, and later use them via the OpenSC, so actual key generation with the latter is not needed. Could you try this?
The data might still be padded while using OpenSC.

3

Hi @szszszsz

Thank you for your quick reply !
I have created a NIST P-256 key pair using “gpg --expert --full-gen-key” which is supposed to create me a keypair at ID 01, right?
Then, I tried to sign the hash of my data using pkcs11-tool command : .\pkcs11-tool --sign --id 01 -m ECDSA --signature-format rs --pin 123456 --input-file .\data.bin.hash --output-file .\data.bin.sig
but i get the following error: error: Private key not found

Any ideas on why is the generated key not visible by pkcs11-tool?
Thank you in advance

4

Hi!

From your description you are missing the keytocard step, which moves PC-generated key to smart card. If that would be the case, the private keys indeed would not be available on the device. To generate keys on the device you need to run:

gpg2 --card-edit

and then:

$ admin
$ generate
5

Regarding the actual problem, it was not working for me on OpenSC v0.19. Will check with v0.20, since it contains some improvements in the ECC field.
Another thing: the ID01 key is in a separate slot, so you need to add --slot 1 parameter to the commands. Slot 0 contains only keys 02 and 03.

Edit: same happens for OpenSC v0.20 (current master:dc29b0) unfortunately:

$ pkcs11-tool --sign --id 01 -m ECDSA  --signature-format rs  --pin 123456 --input-file test.input --output-file pkcstest --slot 1
Using signature algorithm ECDSA
error: PKCS11 function C_SignFinal failed: rv = CKR_FUNCTION_NOT_SUPPORTED (0x54)
Aborting.
6

Registered this as OpenSC#1982.

7

Hi @Nizar!

I am happy to report that work is in progress over this issue. Could you make a retest with the following beta version? It seems signing with P384 key is working, and perhaps for other keys as well. Please remove the currently installed OpenSC version first. Binaries with the patch is under following direct URL:

PS This binary could be found on (in case the previous link would stop working):

8

I tested the proposed patch and it worked for me. This will eventually be published in OpenSC 0.21 I guess (for future visitors of this issue). Until the OP states otherwise, I assume this is solved.