6 Kvě
2022
6 Kvě
'22
16:12
I note that the key label is not set when Knot generates new keys via PKCS#11.
Invoking `p11tool --list-all' shows a key as
Object 449:
URL: pkcs11:model=;manufacturer=nCipher%20Corp.%20Ltd;serial=xxx;\
token=YYY;\
id=%04%66%D0%9C%0D%9E%24%D9%79%0A%17%D3%5D%A0%CC%5A%3F%E2%A3%26;\
type=public
Type: Public key (RSA-2048)
Label:
ID: 04:66:d0:9c:0d:9e:24:d9:79:0a:17:d3:5d:a0:cc:5a:3f:e2:a3:26
The ID is that which `keymgr list' displays (with colons in it), but the label
is empty.
Is this by design? Would it be possible for Knot to actually set the label
(e.g. zone name - key type: example.com-ksk)?
Best regards,
-JP
6 Kvě
6 Kvě
21:13
Hello JP,
It's by design as nobody cared yet :-) I think it's easy to implement it.
Unfortunately,
it requires a slight modification of the libdnssec API, so it won't be possible to
backport it to 3.1.
Daniel
On 5/6/22 16:12, Jan-Piet Mens wrote:
I note that the key label is not set when Knot
generates new keys via PKCS#11.
Invoking `p11tool --list-all' shows a key as
Object 449:
URL: pkcs11:model=;manufacturer=nCipher%20Corp.%20Ltd;serial=xxx;\
token=YYY;\
id=%04%66%D0%9C%0D%9E%24%D9%79%0A%17%D3%5D%A0%CC%5A%3F%E2%A3%26;\
type=public
Type: Public key (RSA-2048)
Label:
ID: 04:66:d0:9c:0d:9e:24:d9:79:0a:17:d3:5d:a0:cc:5a:3f:e2:a3:26
The ID is that which `keymgr list' displays (with colons in it), but the label
is empty.
Is this by design? Would it be possible for Knot to actually set the label
(e.g. zone name - key type: example.com-ksk)?
Best regards,
-JP
--
21:37
It's by design as nobody cared yet :-) I think
it's easy to implement it. Unfortunately,
it requires a slight modification of the libdnssec API, so it won't be possible to
backport it to 3.1.
Thanks, Daniel.
A bit of scripting might suffice; pseudo-code as I'm in relax mode away from the
scene
of the crime ;)
keymgr -l | while read z; do
keymgr $z list | while read cka_id rest; do
p11tool --set-label $z ...
done
done
Best,
-JP
3 Čen
3 Čen
17:58
Hello JP,
I've just realised that the maximum PKCS#11 key label length probably isn't enough
to cover all possible zone names.
Some devices are limited to 32 characters. And the theoretical maximum length of a textual
dname is more than 1000 characters!
Also, the additional key metadata (e.g. KSK, ZSK) can change or one key can be shared by
more zones. So I don't see
a universal format for key labels and I would prefer not to implement it :-)
Best,
Daniel
On 5/6/22 21:37, Jan-Piet Mens wrote:
It's by
design as nobody cared yet :-) I think it's easy to implement it. Unfortunately,
it requires a slight modification of the libdnssec API, so it won't be possible to
backport it to 3.1.
Thanks, Daniel.
A bit of scripting might suffice; pseudo-code as I'm in relax mode away from the
scene
of the crime ;)
keymgr -l | while read z; do
keymgr $z list | while read cka_id rest; do
p11tool --set-label $z ...
done
done
Best,
-JP
--
7 Čec
7 Čec
9:14
Hello Daniel,
I've just realised that the maximum PKCS#11 key
label length probably isn't enough to cover all possible zone names.
Understood.
I'm having a devil of a time (i.e. I'm finding it impossible) to associate key
files created on a Thales Security World with the zones they're used for. Admittedly
this is not often necessary, but I would like to be able to identify the key files
themselves.
Some devices are limited to 32 characters.
Object 449:
URL: pkcs11:model=;manufacturer=nCipher%20Corp.%20Ltd;serial=xxx;\
token=YYY;\
id=%04%66%D0%9C%0D%9E%24%D9%79%0A%17%D3%5D%A0%CC%5A%3F%E2%A3%26;\
type=public
Type: Public key (RSA-2048)
Label:
ID: 04:66:d0:9c:0d:9e:24:d9:79:0a:17:d3:5d:a0:cc:5a:3f:e2:a3:26
The ID is that which `keymgr list' displays (with colons in it), but the label
is empty.
Would it be possible for Knot to actually set the label so the key identifier used by
Knot, i.e. for above example set it to: 0466d09c0d9e24d9790a17d35da0cc5a3fe2a326, maybe
truncating it on devices which limit the field to a smaller number of characters?
Best regards,
-JP
13 Čec
13 Čec
19:29
Hello JP,
Your suggestion seems simple but you don't know the label length limit
of the device and
you don't know what happens when you try to set a longer label than
supported. Is it trimmed or an error is returned?
Another problem is that the key id is a result of the key generation so
you cannot set the label when generating the key :-)
I'm considering alternatives...
Daniel
On 07. 07. 22 9:14, Jan-Piet Mens wrote:
Hello Daniel, > >> I've just realised
that the maximum PKCS#11 key label length >>
probably isn't enough to
cover all possible zone names. > > Understood.
> I'm having a devil of a time (i.e. I'm
finding it impossible) to >
associate key files created on a Thales Security
World with the > zones
they're used for. Admittedly this is not often necessary, but I > would
like to be able to identify the key files themselves. > >> Some devices
are limited to 32 characters. > > Object 449: URL: >
pkcs11:model=;manufacturer=nCipher%20Corp.%20Ltd;serial=xxx;\ >
token=YYY;\ >
id=%04%66%D0%9C%0D%9E%24%D9%79%0A%17%D3%5D%A0%CC%5A%3F%E2%A3%26;\ >
type=public Type: Public key (RSA-2048) Label: ID: >
04:66:d0:9c:0d:9e:24:d9:79:0a:17:d3:5d:a0:cc:5a:3f:e2:a3:26 > > The ID
is that which `keymgr list' displays (with colons in it), but > the
label is empty. > > Would it be possible for Knot to actually set the
label so the key > identifier used by Knot, i.e. for above example set
it to: > 0466d09c0d9e24d9790a17d35da0cc5a3fe2a326, maybe truncating it
on > devices which limit the field to a smaller number of characters? >
Best regards, > > -JP
1 Úno
1 Úno
12:40
It's been a bit, and I don't know whether I actually thanked you for the
feature, but I've just successfully tested generating a key and finding the key
label in the HSM:
$ keymgr -c knot.conf example.com generate ...
72325c...dba92591a
$ cklist -n --cka-label "example.com. KSK"
...
Public objects only (don't use PIN) CKA_CLASS CKO_PUBLIC_KEY
CKA_TOKEN true
CKA_PRIVATE false
CKA_MODIFIABLE true
CKA_LABEL "example.com. KSK"
CKA_NFKM_APPNAME "pkcs11"
CKA_ID length 20
{ 72325C...D BA92591A }
Thank you very much!
-JP
13:35
Perfect! Thanks for the feedback.
Daniel
On 2/1/23 12:40, Jan-Piet Mens wrote:
It's been a bit, and I don't know whether I
actually thanked you for the
feature, but I've just successfully tested generating a key and finding the key
label in the HSM:
$ keymgr -c knot.conf example.com generate ...
72325c...dba92591a
$ cklist -n --cka-label "example.com. KSK"
...
Public objects only (don't use PIN) CKA_CLASS CKO_PUBLIC_KEY
CKA_TOKEN true
CKA_PRIVATE false
CKA_MODIFIABLE true
CKA_LABEL "example.com. KSK"
CKA_NFKM_APPNAME "pkcs11"
CKA_ID length 20
{ 72325C...D BA92591A }
Thank you very much!
-JP
--
542
days inactive
813
days old
7 comments
2 participants
participants (2)
-
Daniel Salzman -
Jan-Piet Mens