<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Andale Mono";
panose-1:2 11 5 9 0 0 0 0 0 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:2115591742;
mso-list-type:hybrid;
mso-list-template-ids:-1855397666 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span style='font-size:12.0pt'>Given that ENGINE API is deprecated, I’m trying to port my stuff to Provider API. Starting with “openssl” CLI to get the hang of it.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'>I installed PKCS11 provider from <a href="https://github.com/latchset/pkcs11-provider.git">https://github.com/latchset/pkcs11-provider.git</a> (after ensuring it passes 19 out of 20 tests), and started experimenting.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'>Immediately hit several problems:<o:p></o:p></span></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'><span style='font-size:12.0pt'>OpenSSL does not seem to automatically load the PKCS11 provider, despite having it added to “openssl.cnf”<o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'><span style='font-size:12.0pt'>Forcing provider via “-provider-path /opt/local/lib/ossl-modules/pkcs11.dylib”, it fails to load/access the private key on my HW token.<o:p></o:p></span></li></ol><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'>Needless to say, it all works perfectly with ENGINE interface and current “libp11”.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'>Here’s what I have in “openssl.cnf” (relevant excerpt):<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[openssl_init]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>providers = provider_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>#engines = engines_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[provider_sect]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>default = default_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>legacy = legacy_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>pkcs11 = pkcs11_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>gost = gost_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>base = base_sect<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[default_sect]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>activate = 1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[legacy_sect]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>activate = 1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[pkcs11_sect]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>module = /opt/local/libexec/openssl3/lib/ossl_modules/pkcs11.dylib<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>pkcs11-module-allow-export<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>activate = 1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[gost_sect]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>module = /opt/local/libexec/openssl3/lib/ossl-modules/gostprov.dylib<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>activate = 1<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>[base_sect]<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Andale Mono"'>activate = 1</span><span style='font-size:12.0pt'><o:p></o:p></span></p><div><div><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>and here’s the error:<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>Decrypt CMS message in file /tmp/derive.97732.text.cms...<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>openssl cms -provider-path /opt/local/lib/ossl-modules/pkcs11.dylib -decrypt -aes256 -binary -inform PEM -in /tmp/derive.99252.text.cms -out /tmp/derive.99252.text.dec -inkey "pkcs11:id=%03;object-type=private"<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>Could not open file or uri for loading signing key from pkcs11:id=%03;object-type=private<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>40F6064DF87F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:crypto/store/store_register.c:237:scheme=file<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>40F6064DF87F0000:error:80000002:system library:file_open:No such file or directory:providers/implementations/storemgmt/file_store.c:267:calling stat(pkcs11:id=%03;object-type=private)<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>40F6064DF87F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:crypto/store/store_register.c:237:scheme=pkcs11<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>40F6064DF87F0000:error:1608010C:STORE routines:inner_loader_fetch:unsupported:crypto/store/store_meth.c:383:No store loader found. For standard store loaders you need at least one of the default or base providers available. Did you forget to load them? Info: Global default library context, Scheme (pkcs11 : 0), Properties (<null>)<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Andale Mono";color:black'>FAILED to create decrypted file /tmp/derive.97732.text.dec</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>The token is PIV-compliant.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>I tried several ways of specifying the key URI, none seemed to work. Please advise on how to address/name the key so that the Provider can access it. Or is the provider screwed up? But it seemed to work OK with NSS soft-token and with SoftHSM (except for one test)…<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Thanks!<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>--</span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>V/R,</span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>Uri Blumenthal Voice: (781) 981-1638 </span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>Secure Resilient Systems and Technologies Cell: (339) 223-5363</span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>MIT Lincoln Laboratory </span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>244 Wood Street, Lexington, MA 02420-9108 </span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'> </span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>Web: <a href="https://www.ll.mit.edu/biographies/uri-blumenthal" title="https://www.ll.mit.edu/biographies/uri-blumenthal"><span style='color:#713C56'>https://www.ll.mit.edu/biographies/uri-blumenthal</span></a></span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Andale Mono";color:black'>Root CA: <a href="https://www.ll.mit.edu/llrca2.pem" title="https://www.ll.mit.edu/llrca2.pem"><span style='color:#713C56'>https://www.ll.mit.edu/llrca2.pem</span></a></span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><i><span style='color:black'>There are two ways to design a system. One is to make it so simple there are obviously no deficiencies.</span></i><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><i><span style='color:black'>The other is to make it so complex there are no obvious deficiencies.</span></i><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p><p class=MsoNormal><i><span style='color:black'> - C. A. R. Hoare</span></i><span style='font-size:12.0pt;color:black'><o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>