{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSC/libp11/issues/101","repository_url":"https://api.github.com/repos/OpenSC/libp11","labels_url":"https://api.github.com/repos/OpenSC/libp11/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/libp11/issues/101/comments","events_url":"https://api.github.com/repos/OpenSC/libp11/issues/101/events","html_url":"https://github.com/OpenSC/libp11/issues/101","id":176109217,"number":101,"title":"Support CKU_CONTEXT_SPECIFIC PINs","user":{"login":"matthauck","id":1308591,"avatar_url":"https://avatars.githubusercontent.com/u/1308591?v=3","gravatar_id":"","url":"https://api.github.com/users/matthauck","html_url":"https://github.com/matthauck","followers_url":"https://api.github.com/users/matthauck/followers","following_url":"https://api.github.com/users/matthauck/following{/other_user}","gists_url":"https://api.github.com/users/matthauck/gists{/gist_id}","starred_url":"https://api.github.com/users/matthauck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthauck/subscriptions","organizations_url":"https://api.github.com/users/matthauck/orgs","repos_url":"https://api.github.com/users/matthauck/repos","events_url":"https://api.github.com/users/matthauck/events{/privacy}","received_events_url":"https://api.github.com/users/matthauck/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"mtrojnar","id":13538198,"avatar_url":"https://avatars.githubusercontent.com/u/13538198?v=3","gravatar_id":"","url":"https://api.github.com/users/mtrojnar","html_url":"https://github.com/mtrojnar","followers_url":"https://api.github.com/users/mtrojnar/followers","following_url":"https://api.github.com/users/mtrojnar/following{/other_user}","gists_url":"https://api.github.com/users/mtrojnar/gists{/gist_id}","starred_url":"https://api.github.com/users/mtrojnar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtrojnar/subscriptions","organizations_url":"https://api.github.com/users/mtrojnar/orgs","repos_url":"https://api.github.com/users/mtrojnar/repos","events_url":"https://api.github.com/users/mtrojnar/events{/privacy}","received_events_url":"https://api.github.com/users/mtrojnar/received_events","type":"User","site_admin":false},"assignees":[{"login":"mtrojnar","id":13538198,"avatar_url":"https://avatars.githubusercontent.com/u/13538198?v=3","gravatar_id":"","url":"https://api.github.com/users/mtrojnar","html_url":"https://github.com/mtrojnar","followers_url":"https://api.github.com/users/mtrojnar/followers","following_url":"https://api.github.com/users/mtrojnar/following{/other_user}","gists_url":"https://api.github.com/users/mtrojnar/gists{/gist_id}","starred_url":"https://api.github.com/users/mtrojnar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtrojnar/subscriptions","organizations_url":"https://api.github.com/users/mtrojnar/orgs","repos_url":"https://api.github.com/users/mtrojnar/repos","events_url":"https://api.github.com/users/mtrojnar/events{/privacy}","received_events_url":"https://api.github.com/users/mtrojnar/received_events","type":"User","site_admin":false}],"milestone":null,"comments":67,"created_at":"2016-09-09T20:59:20Z","updated_at":"2016-10-01T14:14:48Z","closed_at":"2016-09-30T07:34:36Z","body":"Currently, if I understand correctly, there are two ways to specify a PIN for a key using pkcs11 engine:\r\n1. Setting the `PIN` global engine configuration\r\n2. Setting the `pin-value` on the pkcs11 key URI\r\n\r\nThis is rather limiting for a situation where one may want to support loading several different keys, each perhaps coming from different slots, each with different passwords. I don't really feel comfortable putting the pin value on the key URI since this is something likely to get printed out to the screen or logged. Setting the global PIN is also not super ideal, since then the application loses control over the lifetime of the PIN living in memory as plain text. \r\n\r\nWhat if libp11 instead offered a configuration option for a `PIN_CALLBACK` - a function that libp11 would call to grab the pin from the application as a `const char*`, which it could feed directly into `C_Login` and not have to manage the lifetime of at all? Seems like this would accomplish both the multiple PIN problem and the password-in-memory problem."},"comment":{"url":"https://api.github.com/repos/OpenSC/libp11/issues/comments/250914614","html_url":"https://github.com/OpenSC/libp11/issues/101#issuecomment-250914614","issue_url":"https://api.github.com/repos/OpenSC/libp11/issues/101","id":250914614,"user":{"login":"dengert","id":865329,"avatar_url":"https://avatars.githubusercontent.com/u/865329?v=3","gravatar_id":"","url":"https://api.github.com/users/dengert","html_url":"https://github.com/dengert","followers_url":"https://api.github.com/users/dengert/followers","following_url":"https://api.github.com/users/dengert/following{/other_user}","gists_url":"https://api.github.com/users/dengert/gists{/gist_id}","starred_url":"https://api.github.com/users/dengert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dengert/subscriptions","organizations_url":"https://api.github.com/users/dengert/orgs","repos_url":"https://api.github.com/users/dengert/repos","events_url":"https://api.github.com/users/dengert/events{/privacy}","received_events_url":"https://api.github.com/users/dengert/received_events","type":"User","site_admin":false},"created_at":"2016-10-01T14:14:48Z","updated_at":"2016-10-01T14:14:48Z","body":"What is missing from PKCS#11 but is left up to the card issuer in PKCS#15 is the ability to detect if a private key is present on the card without presenting the PIN. OpenSC was originally written to support PKCS#15 cards. PKCS#15 has a directory structure and the private key directory file (PrKDF) **MAY** have  Read: always. (I don't have any PKCS#15 cards. PIV cards are not PKCS#15. There is not directory structure in PIV, The mapping of objects is defined in the the specs.)     \r\n\r\nOne possibility to address this in a PKCS#11 module without defining any new attributes is to allow a C_FindObject even without authentication search for:\r\nCKA_CLASS=CKO_PRIVATE_KEY\r\nCKA_ALWAYS_AUTHENTICATE=TRUE\r\nor \r\nCKA_ALWAYS_AUTHENTICATE=FALSE \r\n(may need to do two searches to fine all private keys.)\r\n\r\nThe returned attributes should at least have CKA_CLASS, CKA_ID, CKA_PRIVATE and CKA_ALWAYS_AUTHENTICATE\r\nIt could return other attributes if needed. \r\n\r\nlibp11 would first read without the pin all certificates and pubkeys. The try the above. \r\nIf the C_FindObject fails, libp11 does what it does today. If it worked and returned one or more private keys, it would remember them. Having the CKA_ID would associate the pubkey or certificate with th private key, to get the key type and parmameters.  \r\n\r\nSo if the user wanted to use one of the  CKA_ALWAYS_AUTHENTICATE=TRUE private key, The first C_login would be done and the an attempt to use the key would be made without doing the context specific login. If it fails, then do what you do now, and and get the pin and do the context specific login\r\n\r\nI believe I could get this to work with the OpenSC PIV card driver, as it already reads all the certificates before hand to parse for the public keys so it can get the type and parameters for the private keys If there is a certificate on the card (on accessible via the History Object) there is a private key on the card. \r\n\r\nThe above is  \"carefully crafted\" software. It may only work for OpenSC PIV cards, but other OpenSC developers could say if it could work for other cards. \r\n\r\nThis does not violate the policy as specified in NIST 800-73, as the first VERIFY is serving to authenticate to the card and do the first crypto operation. \r\n\r\nAny interest?\r\n\r\n\r\n\r\n\r\n "}}
{"actor":{"display_login":"dengert"}}