NCryptoki

Ugo, I´m very sorry, but I have to develop it in Visual Basic 6 and .Net. In case of Visual Basic 6, X509Certificate2 is not available. How can I load a certificate from a file and the photo? Thanks again.

Ugo, I have tested the snippet you sent to me to load a pfx file in a smart card. I have changed an argument of the function. I use Byval cert as string instead of ByVal cert as byte(), because I will send the full path with the name of pfx file. This is the modified snippet:

Function ImportKeyPair(ByVal Session As Session, ByVal cert As String, ByVal password As String, ByVal id As String, ByVal label As String, ByVal priv As Boolean, ByVal modifiable As Boolean) As PrivateKey
     Dim certificate As X509Certificate2
     certificate = New X509Certificate2(cert, password, X509KeyStorageFlags.Exportable)
     If (Not certificate.HasPrivateKey) Then
           Throw New Exception("Certificate doesn't have private key. Import failed!")
     End If
     Dim keyPair As RSA
     Dim keyParams As RSAParameters
     Dim template As CryptokiCollection
     Dim priKey As PrivateKey
     keyPair = certificate.PrivateKey
     keyParams = keyPair.ExportParameters(True)
    template = New CryptokiCollection()
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_SUBJECT, certificate.SubjectName.RawData))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_ID, id))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_LABEL, label))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_TOKEN, True))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODULUS, keyParams.Modulus))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_PUBLIC_EXPONENT, keyParams.Exponent))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE_EXPONENT, keyParams.D))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE, priv))
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, modifiable))
    priKey = Session.Objects.Create(template)
   ImportKeyPair = priKey
End Function

And this is line I use to call the function:

ImportKeyPair(sess, "c:\temp\consuelo.pfx", "12345", "", "", True, True)
 

This is the error I get in line "priKey = Session.Objects.Create(template):

ErrorCode=209
ErrorString="TEMPLATE_INCONSISTENT"

Do you know why?

Thanks a lot.

Thank you, Ugo. I will try it.

Ugo, I have been reading PKCS#11 technical document and there is something I don´t understand. This is the snippet you sent to me (with the change I did in parameter Byval cert As string in order to sent a path with the pfx file):

Function ImportKeyPair(ByVal Session As Session, ByVal cert As String, ByVal password As String, ByVal id As String, ByVal label As String, ByVal priv As Boolean, ByVal modifiable As Boolean) As PrivateKey
Try
Dim certificate As X509Certificate2
certificate = New X509Certificate2(cert, password, X509KeyStorageFlags.Exportable)
If (Not certificate.HasPrivateKey) Then
Throw New Exception("Certificate doesn't have private key. Import failed!")
End If
MessageBox.Show(certificate.GetExpirationDateString)
MessageBox.Show(certificate.Issuer)
Dim keyPair As RSA
Dim keyParams As RSAParameters
Dim template As CryptokiCollection
Dim priKey As PrivateKey
keyPair = certificate.PrivateKey
keyParams = keyPair.ExportParameters(True)
template = New CryptokiCollection()
template.Add(New ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_SUBJECT, certificate.SubjectName.RawData))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_ID, id))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_LABEL, label))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_TOKEN, True))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODULUS, keyParams.Modulus))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_PUBLIC_EXPONENT, keyParams.Exponent))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE_EXPONENT, keyParams.D))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE, priv))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, modifiable))
priKey = Session.Objects.Create(template)
ImportKeyPair = priKey
End Function

My doubt is the following: with the template you create, does the pfx file copy to smart card? I don´t understand why CKA_CLASS is CryptokiObject.CKO_PRIVATE_KEY instead of CryptokiObject.CKO_CERTIFICATE.

With the software tools the manufacturer gives, I can see in token the certificate and private key. I delete them from Manufacturer tools and I try again with this code, but I can´t... I give you more information. With Manufacturer Tools I have to select "Import digital ID" instead of "Import certificate". When I import digital ID I can see the certificate and private key.

I have not been able to avoid 209 error (TEMPLATE_INCONSISTENT) with this snippet.

Thanks again.

Rgds,

Ugo, this is crazy. I have tested with 3 different smart cards (HID Crescendo C700 (HID), ACOS5 (ACS) and Touch&Sign 2048 (bit4id)). With the first one (the smart card I want to work) I have commented one by one the attributes of your snippet and the problem is the same (Template_Inconsistent). I have added CKA_ALWAYS_SENSITIVE and CKA_EXTRACTABLE (one by one too) and the problem persists.

I have tried with ACOS5 card and the error is different (ATTIBUTE_TYPE_INVALID). I have commented one by one the attributes and the problem is the same.

I have tried with Touch&Sign 2048 and "it works", but this is not the card we want to use. Anyway, do you have the snippet to load the certificate once the private key is loaded?

I think the only solution I have is talking to HID in order to get necessary attributes for private key and certificate.

Thank you.

Thank you, Ugo. This is very frustrating. Everybody says I must Use CryptoAPI instead of PKCS#11, because it is very difficult to manage if you don´t use C++.  You have helped me a lot, so I think we are next to the solution. I will wait.

Thank you, again.

Rgds,

Thank you, Ugo. Yes, I have an example HID sent to me. Can you give me your e-mail address?

I have just sent it source code. Thank you.

  Ugo, one step more. Now the error is TEMPLATE_INCOMPLETE. I have been reading PKCS#11 technical document and I have tested to add CKA_SIGN_RECOVER attribute, but the message is the same. I have tested to add CKA_NEVER_EXTRACTABLE and CKA_ALWAYS_SENSITIVE as you said before. I think is an attibute in relation to new attributes you have added. This is the snippet I have at this moment:

Function ImportKeyPair(ByVal Session As Session, ByVal cert As String, ByVal password As String, ByVal id As String, ByVal label As String, ByVal priv As Boolean, ByVal modifiable As Boolean) As PrivateKey
    Dim certificate As X509Certificate2
    certificate = New X509Certificate2(cert, password, X509KeyStorageFlags.Exportable)
    If (Not certificate.HasPrivateKey) Then
         Throw New Exception("Certificate doesn't have private key. Import failed!")
    End If
    Dim keyPair As RSA
    Dim keyParams As RSAParameters
    Dim template As CryptokiCollection
    Dim priKey As PrivateKey
    keyPair = certificate.PrivateKey
    keyParams = keyPair.ExportParameters(True)
    template = New CryptokiCollection()
    template.Add(New ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY))
   ' ******** Para HID Crescendo C700
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_KEY_TYPE, Key.CKK_RSA))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_SIGN, True))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_SIGN_RECOVER, True))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_DECRYPT, True))
   ' ********

   template.Add(New ObjectAttribute(ObjectAttribute.CKA_SUBJECT, certificate.SubjectName.RawData))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_ID, id))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_LABEL, label))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_TOKEN, True))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODULUS, keyParams.Modulus))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_PUBLIC_EXPONENT, keyParams.Exponent))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE_EXPONENT, keyParams.D))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE, priv))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, modifiable))

   template.Add(New ObjectAttribute(ObjectAttribute.CKA_NEVER_EXTRACTABLE, True))
   template.Add(New ObjectAttribute(ObjectAttribute.CKA_ALWAYS_SENSITIVE, True))
   priKey = Session.Objects.Create(template)
   ImportKeyPair = priKey

End Function
 

Ugo, we are not lucky either. With this new attribute the error is the same, TEMPLATE_INCOMPLETE. I hope HID can give more information. Thanks a lot.

Ugo, I was wrong. It doesn´t give any error, but the private key is not loaded in smart card. I supposte CKA_TOKEN must be True in order the private key is loaded in smart card.  In relation to Certificate I have been able to download it adding another attribute (CKA_CERTIFICATE_TYPE):

template.Add(New ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_CERTIFICATE))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_CERTIFICATE_TYPE, Certificate.CKC_X_509))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_SUBJECT, cert.SubjectName.RawData))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_ISSUER, cert.Issuer))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_SERIAL_NUMBER, cert.SerialNumber))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_ID, id))
'template.Add(New ObjectAttribute(ObjectAttribute.CKA_LABEL, label))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_TOKEN, tRUE))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_VALUE, cert.RawData))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, True))
 

I will wait until HID says something.

Thanks.

Ugo, I have tried you have said to me, but the error is the same (TEMPLATE_INCOMPLETE). I have removed CKA_PUBLIC_EXPONENT and the same problem. I have tried adding CKA_PRIME_1 and CKA_PRIME_2 attributes and the same... I have resent an e-mail to HID remembering the problem and giving more information. Thanks a lot. Once I received an e-mail I will contact with you. Rgds.