1

I'm trying to sign some data using CKM_SHA256_RSA_PKCS mechanism... I'm having trouble with the lowlevel-API, as there is virtually no documentation and almost no examples. I'm attempting to do something almost identical to Sign/verify PyKCS11 library I can't seem to properly convert the code using the lowlevel(awful) API.

Here's some short snippets of my attempt.

a = CPKCS11Lib()
info = CK_INFO()
m = PyKCS11.LowLevel.CK_MECHANISM()
signature = ckbytelist()
m.mechanism = PyKCS11.LowLevel.CKM_SHA256_RSA_PKCS
key = PyKCS11.LowLevel.CK_OBJECT_HANDLE()
slotInfo = CK_SLOT_INFO()
lib='/opt/PTK/lib/libcryptoki.so'
session = CK_SESSION_HANDLE()
sessionInfo = CK_SESSION_INFO()
tokenInfo = CK_TOKEN_INFO()
slotList = ckintlist()
objects = ckobjlist()

binaryData = "XYZ"
sha256 = hashlib.sha256()
sha256.update(str(bytearray(binaryData)))
digest = sha256.digest()
binaryData2 = '\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65\x03\x04\x02\x01\x05\x00\x04\x20' + digest
signMechanism = PyKCS11.Mechanism(PyKCS11.LowLevel.CKM_SHA256_RSA_PKCS, None)
signedData = str(a.C_Sign(CKA_PRIVATE, binaryData2, signMechanism))
print(signedData)

Getting this traceback for signedData

def C_Sign(self, *args): return _LowLevel.CPKCS11Lib_C_Sign(self, *args) TypeError: in method 'CPKCS11Lib_C_Sign', argument 2 of type 'CK_SESSION_HANDLE'

Community
  • 1
  • 1
DJ2
  • 1,721
  • 3
  • 34
  • 74
  • Theoretically should I be able to use any pkcs11 interface? – DJ2 Jul 22 '16 at 17:31
  • Crypto notes: SHA1 != SHA256, it has a different output size. Not that it matters because SHA256_RSA_PKCS probably hashes the values itself, so you'd get a hash over the hash construction. – Maarten Bodewes Jul 23 '16 at 09:17
  • Is the different output size throwing the type error? @MaartenBodewes – DJ2 Jul 24 '16 at 15:10
  • Could you try giving it just the 32 byte hash value? – Maarten Bodewes Jul 24 '16 at 15:20
  • ahh the `sha256 = hashlib.sha1()` was a typo when i was attempting to figure out the problem. I'll try passing just the hash value. Can't access the sever due to my location. Thanks for the tip, i'll see if it works. @MaartenBodewes – DJ2 Jul 24 '16 at 15:39
  • So, `signedData = session.CKA_Sign(CKA_PRIVATE, binaryData2, signMechanism)` is giving this traceback. Doesn't like attribute `CKA_Sign` ............. `signedData = session.CKA_Sign(CKA_PRIVATE, binaryData2, signMechanism) File "/home/tanner/pylib/PyKCS11/LowLevel.py", line 299, in __getattr__ = lambda self, name: _swig_getattr(self, CK_SESSION_HANDLE, name) File "/home/tanner/pylib/PyKCS11/LowLevel.py", line 55, in _swig_getattr raise AttributeError(name) AttributeError: C_Sign` @MaartenBodewes – DJ2 Jul 26 '16 at 21:54
  • There's an underlying problem in the init.py file or the LowLevel.py file that is only allowing me to use the lowlevel API. The problem is with the call to the C_Initialize function. I can't seem to debug the problem. Any clue where this occurs and how it can be fixed? @MaartenBodewes – DJ2 Aug 03 '16 at 14:19
  • Did you already limit `binaryData2` to just the digest value, so without the `\x30\x31` SHA-256 identifier? – Maarten Bodewes Aug 03 '16 at 14:25
  • Correct. It's giving me the same trackeback for C_Sign as i stated in the orignial post. @MaartenBodewes – DJ2 Aug 03 '16 at 14:54
  • Do I need a call to `C_SignInit` ? @MaartenBodewes – DJ2 Aug 03 '16 at 15:02
  • Probably not when directly calling sign, no. `SignInit`, `SignUpdate` and `SignFinal` (if I remember the names correctly) are the streaming versions of `Sign`. – Maarten Bodewes Aug 03 '16 at 15:10
  • `print("\tC_Login(): " + hex(a.C_Login(session, CKU_SO, pin))) print "C_OpenSession(): " + hex(a.C_OpenSession(slotList[0], PyKCS11.LowLevel.CKF_SERIAL_SESSION, session)) print "C_Login(): " + hex(a.C_Login(session, PyKCS11.LowLevel.CKU_USER, pin))` From here I call `C_FindObjects` and it prints attributes that are unique to the token @MaartenBodewes – DJ2 Aug 03 '16 at 15:14
  • Got that one wrong: "After calling C_SignInit, the application can either call C_Sign to sign in a single part; or call C_SignUpdate one or more times, followed by C_SignFinal, to sign data in multiple parts.". Makes sense right, you need to indicate the private key. – Maarten Bodewes Aug 03 '16 at 15:23
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/119025/discussion-between-dj2-and-maarten-bodewes). – DJ2 Aug 03 '16 at 15:41

0 Answers0