Hi,

Is NCryptoki compatible with Thales NShield Solo?
Is there known software emulator HSM that is compatible with NCryptoki for development purposes? Maybe with Mozilla NSS or OpenDNSSEC?

Thanks in advance, 
Pance

I compiled SoftHSM under windows in cygwin (windows 7, 64bit). I created tokens and initialized them through softhsm command under cygwin. Now, how can I connect to this HSM through NCryptoki? When I start your example (under visual studio 2008, C#, .NET 2.0) on the line Cryptoki cryptoki = new Cryptoki("smaoscki.dll"); it throws an exception BadImageFormatException with the following message:

Could not load file or assembly 'file:///C:\Users\mine\Desktop\NCryptoki\NCryptoki\examples\C#\TestNCryptoki\bin\Debug\NCryptokiMngd.dll' or one of its dependencies. An attempt was made to load a program with an incorrect format.

Thanks in advance, 
Pance

Can't find softhsm dll file, cygwin created exe files (softhsm and softhsm-keyconv). I can see that cygwin create dll files when I compiled sqlite3 for example, but for softhsm I can't find dll files. In the compiled dir I can find different c, o, am, po and the mentioned exe files.

Pance

I got the hardware hsm so I will continue testing with it. The HSM is NCipher NFast pcie module. I'm trying the code with the C# examples and on the line

Key[] keys = session.GenerateKeyPair(Mechanism.RSA_PKCS_KEY_PAIR_GEN, templatePub, templatePri);

it is giving me exception "Error n. 209". I tested the pkcs#11 through nfast test binaries, and it is creating rsa keys successfully. What can be the problem?

Thanks in advance,
Pance

I found the correct attributes to create key pair. Now when I created the keypair in hsm I need to get the private key, but the I get ATTRIBUTE_SENSITIVE exceptions for the private key parameters. These are the attributes used:

CryptokiCollection templatePub = new CryptokiCollection();
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PUBLIC_KEY));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_TOKEN, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_ENCRYPT, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_VERIFY, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_WRAP, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_LABEL, key_label));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_MODULUS_BITS, 1024));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_ID, "123"));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_PUBLIC_EXPONENT, "101"));

CryptokiCollection templatePri = new CryptokiCollection();
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_TOKEN, true));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_PRIVATE, true));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_SENSITIVE, false));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_ALWAYS_SENSITIVE, false));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_EXTRACTABLE, false));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_DECRYPT, true));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_SIGN, true));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_UNWRAP, true));
templatePri.Add(new ObjectAttribute(ObjectAttribute.CKA_LABEL, key_label));

When I set CKA_EXTRACTABLE to false then it gives me INCONSISTENT exception.

Thanks in advance, 
Pance

I managed to export the private keys from HSM by using security override.

What is the difference between C_Sign and C_SignRecover? As I read in the pkcs#11 docs, the second is a sign where the data can be recovered from the signature. I think I need this in my implementation, but the NCryptoki is returning code 112 from the SignRecoverInit operation (where I'm giving in the Mechanism.SHA1_RSA_PKCS and the private RSA key. If this method was successful, how can I recover the data from the signature? 

Thanks in advance, 
Pance