<div dir="ltr">Would it be possible for you to open this as an issue on Github and include there your first email and the full logs?<div><br></div><div>Thanks,</div><div><br></div><div>Nicola Tuveri</div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, 18 Sep 2018 at 01:15, Paras Shah (parashah) via openssl-users <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-2110430064522934298WordSection1">
<p class="m_-2110430064522934298MsoPlainText">That is not it. It results in the same error for the EC key.<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"><u></u> <u></u></p>
<p class="m_-2110430064522934298MsoPlainText">It is not the URL or the ID. Because for a RSA key in the softhsm with id = 3333, it works fine with url containing id=%33%33<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"><u></u> <u></u></p>
<p class="m_-2110430064522934298MsoPlainText"><i>$ openssl pkey -in "pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=6a160d52b750862f;token=token%202.5.0-rc1;id=%33%33;object=rsa%20key;type=private" -engine pkcs11 -inform ENGINE<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>engine "pkcs11" set.<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>Enter PKCS#11 token PIN for token 2.5.0-rc1:<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>-----BEGIN PRIVATE KEY-----<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>MIIBJwIBADANBgkqhkiG9w0BAQEFAASCAREwggENAgEAAoIBAQDD3378F1XbXJvP<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>WP2GtZry0u6sL3eNYktQwJfhDMz5evDG+PahVjCMszV5CZvG+Kvap40xPBJoonqi<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>oMAQsoLu7/fTx82aEL3TbdjXNLFnQ2KKYmfG9ymx80sLHMmdmDXpNNE+bEKJz1dp<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>t1Q0cVduwmqSfB8JyIE6Udz7JX7HCXaVmxoK7z4Njh3dyHsqhdqKIx0dBuK0hCaq<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>4zPzGP/sORA3G9ZPxxpEvF3gvE/zsXj7ifihqbqr2eIFOpB/lQqAehsgQT5/6Iq+<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>9pAX2LCxNkaUHYYZpMkM8Oi37jzg8PX/FnHdm9HQU2IBqYhoqo7/VsNdUDln2QHN<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>dGAUprcbAgMBAAE=<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i>-----END PRIVATE KEY-----<u></u><u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText"><i><u></u> <u></u></i></p>
<p class="m_-2110430064522934298MsoPlainText">Coming back to EC key, looking at the error logs emitted, it does seem to recognize it to be EC (the logs contain EC_routines) somehow but then fails.
<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"><u></u> <u></u></p>
<p class="m_-2110430064522934298MsoPlainText">On 9/17/18, 2:22 PM, "openssl-users on behalf of Richard Levitte" <<a href="mailto:openssl-users-bounces@openssl.org" target="_blank">openssl-users-bounces@openssl.org</a> on behalf of <a href="mailto:levitte@openssl.org" target="_blank">levitte@openssl.org</a>> wrote:<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"><u></u> <u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> In message <<a href="mailto:4AC69FC3-BEC7-46F6-882A-671196FC0156@contoso.com" target="_blank">4AC69FC3-BEC7-46F6-882A-671196FC0156@contoso.com</a>> on Mon, 17 Sep 2018 20:59:59 +0000, "Paras Shah (parashah)" <<a href="mailto:parashah@cisco.com" target="_blank">parashah@cisco.com</a>> said:<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > 4. Import the key into softhsm<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > []:~$ softhsm2-util --import ~/tmp/secp256k1-key.pem.pkcs8 --label "ec key" --id 1111 --token<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > "token 2.5.0-rc1"<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> Ok, so here, the ID is "1111"<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > 5. Get the pkcs11 url for the private key<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > []:~$ p11tool --login --provider=/usr/local/lib/softhsm/libsofthsm2.so --set-pin=1111 --list-all<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > Object 0:<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > URL:<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> > pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=6a160d52b750862f;token=token%202.5.0-rc1;id=%11%11;object=ec%20key;type=private<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> But here, the ID is "%11%11", and since those get percent decoded,<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> that's actually two vertical tabs, or with C vector syntax,<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> { 0x0b, 0x0b }<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> I'm not sure what engine-pkcs11 asks of you otherwise, but one guess<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> could be to change 'id=%11%11' to 'id=1111' in that URL and try again.<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> Cheers,<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> Richard<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> -- <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> Richard Levitte <a href="mailto:levitte@openssl.org" target="_blank">levitte@openssl.org</a><u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> OpenSSL Project <a href="http://www.openssl.org/~levitte/" target="_blank">http://www.openssl.org/~levitte/</a><u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> -- <u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> openssl-users mailing list<u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><u></u><u></u></p>
<p class="m_-2110430064522934298MsoPlainText"> <u></u><u></u></p>
</div>
</div>
-- <br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
</blockquote></div>