<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Selva,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
i have found the cause of the problem. It is the Has<em>No</em>PrivateKey function which is in dotnet OpenSsl ./src/Native/Unix/System.Security.Cryptography.Native/pal_rsa.c implementation. The crux of the problem is in these lines:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
// The method has descibed itself as having the private key external to the structure.
<div> // That doesn't mean it's actually present, but we can't tell.</div>
<div>#pragma clang diagnostic push</div>
<div>#pragma clang diagnostic ignored "-Wcast-qual"</div>
<div> if (RSA_meth_get_flags((RSA_METHOD*)meth) & RSA_FLAG_EXT_PKEY)</div>
<div>#pragma clang diagnostic pop</div>
<div> {</div>
<div> return 0;</div>
<span> }</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>For some reason i suspect that i do not have this RSA_FLAG_EXT_PKEY flag set. Btw. when i am calling ENGINE_load_private_key method, the arguments i'm passing are the engine and the key. Both ui_method and callback_data are passed as NULLs. I talked with
guys from dotnet in here <a href="https://github.com/dotnet/runtime/issues/53345" id="LPlnk174761">https://github.com/dotnet/runtime/issues/53345</a> and i need to check RSA flags.But the thing that puzzles me is that shouldn't that flag be inserted by the
engine during the call of ENGINE_load_private_key?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>BR</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Piotr</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Od:</b> Selva Nair <selva.nair@gmail.com><br>
<b>Wysłane:</b> piątek, 28 maja 2021 20:47<br>
<b>Do:</b> Piotr Lobacz <piotr.lobacz@softgent.com><br>
<b>DW:</b> openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Temat:</b> Re: CSR creation using pkcs11 dynamic engine</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
On Fri, May 28, 2021 at 1:44 PM Piotr Lobacz <piotr.lobacz@softgent.com> wrote:<br>
><br>
> Ok, i have found out that dotnet OpenSsl library has it's own code for verification is key private. For this it needs the whole data of private key from which this method:<br>
><br>
> static int HasNoPrivateKey(RSA* rsa)<br>
><br>
> which is in ./src/Native/Unix/System.Security.Cryptography.Native/pal_rsa.c of dotnet verifies occurence of all private parameters. Unfortunately from what i know private keys are not extractable from tokens because of CKA_EXTRACTABLE=false parameter.<br>
><br>
> Correct me if i'm wrong but from what i know about openssl, when i'm switching to a closed engine the whole cryptography is being made by the engine module. I think that there should be some other method verifing if key is private. Maybe somebody could give
me a hint?<br>
<br>
Its not verifying, but signing operation that is failing. This sounds<br>
like something wrong in the way you are using the dotnet interface or<br>
possibly a bug in (or limitation of) that implementation itself. Like<br>
its not meant to be used when keys are "external". I have no idea<br>
having never used C#.<br>
<br>
But you are right, when the private key is loaded through the pkcs11<br>
engine the key is external (can stay non-extractable), and the signing<br>
operation gets delegated to the engine. Are you sure that the pkey<br>
returned by the ENGINE_get_private_key() and rsa handle generated from<br>
that pkey are valid? I see no error checks in your code unless dotnet<br>
will automatically trigger exceptions on error.<br>
<br>
You may get more relevant help in the dotnet community.<br>
<br>
<br>
Selva<br>
</div>
</span></font></div>
<a href="https://www.softgent.com" target="_blank"><img width="150" height="50" src="https://softgent.com/wp-content/uploads/2020/01/Zasob-14.png"></a>
<p style="color: gray; display: block; font-size: 9px; text-transform: uppercase; margin: 0; margin-top: 10px;">
<b>Softgent Sp. z o.o.</b>, Budowlanych 31d, 80-298 Gdansk, POLAND</p>
<p style="color: gray; display: block; font-size: 9px; text-transform: uppercase; margin: 0;">
KRS: 0000674406, NIP: 9581679801, REGON: 367090912</p>
<p style="color: gray; display: block; font-size: 9px; text-transform: uppercase; margin: 0;">
www.softgent.com</p>
<p style="color: gray; display: block; font-size: 9px; text-transform: uppercase; margin: 0; margin-top: 10px;">
Sąd Rejonowy Gdańsk-Północ w Gdańsku, VII Wydział Gospodarczy Krajowego Rejestru Sądowego</p>
<p style="color: gray; display: block; font-size: 9px; text-transform: uppercase; margin: 0;">
KRS 0000674406, Kapitał zakładowy: 25 000,00 zł wpłacony w całości.</p>
</body>
</html>