kcv with SafeNet hsm about pkcs11interop

[jariq]

Hello Armando,
you did not provide any code so I can only guess that you are referring to the CKA_CHECK_VALUE attribute of the secret key. PKCS#11 implementation is not required to support this attribute so it may not be supported by the SafeNet PKCS#11 implementation. You should consult HSM documentation or contact vendor support to check if this is the case.

Anyway it seems that alternatively the value of this attribute can be easily acquired by encrypting single block of null bytes. There is following statement about the value of CKA_CHECK_VALUE attribute in PKCS#11 specification:

Unless otherwise specified for the object definition, the value of this attribute is derived from the key object by taking the first three bytes of an encryption of a single block of null (0x00) bytes, using the default cipher and mode (e.g. ECB) associated with the key type of the secret key object.

More detailed explanation can also be found at stackoverflow.com. Please let me know if this helped.

[inorton]

On 4 June 2014 21:29, Jaroslav Imrich [email protected] wrote:

CKA_CHECK_VALUE

I think you can prevent CKA_CHECK_VALUE from being created by setting a
template value.

[inorton]

Yes, if you set CKA_CHECK_VALUE to nothing in the template when
creating the key, or set it using C_SetAttributeValue() then it will
be wiped out.

The CKA_CHECK_VALUE for symmetric operations is the first three bytes
of an ECB encrypt, for certificate objects i think it the first three
bytes of the sha1 hash of the object data.

On 5 June 2014 20:14, Ian Norton [email protected] wrote:

On 4 June 2014 21:29, Jaroslav Imrich [email protected] wrote:

CKA_CHECK_VALUE

I think you can prevent CKA_CHECK_VALUE from being created by setting a
template value.

[inorton]

Another possibility is that the safenet box doesn't support it (it was
introduced in v2.20) I just tested my ncipher card and it doesn't
support CKA_CHECK_VALUE yet either but responds with
CKR_ATTRIBUTE_TYPE_INVALID. Some vendors simply return nothing if they
don't support the attribute fully.

On 5 June 2014 20:17, Ian Norton [email protected] wrote:

Yes, if you set CKA_CHECK_VALUE to nothing in the template when
creating the key, or set it using C_SetAttributeValue() then it will
be wiped out.

The CKA_CHECK_VALUE for symmetric operations is the first three bytes
of an ECB encrypt, for certificate objects i think it the first three
bytes of the sha1 hash of the object data.

On 5 June 2014 20:14, Ian Norton [email protected] wrote:

On 4 June 2014 21:29, Jaroslav Imrich [email protected] wrote:

CKA_CHECK_VALUE

I think you can prevent CKA_CHECK_VALUE from being created by setting a
template value.

[armando-basile]

thanks to all :) i added check value generation in my class, so i don't use CKA_CHECK_VALUE anymore.