About PKCS#11

Hi,
I have two questions re. the SDK and PKCS#11 that I hope someone will be able to help me with.
Firstly is it possible to register PKCS#11 drivers with Acrobat via the SDK and secondly, can I register CA certificates as trusted roots via the SDK?
Ideally, I am looking for a Windows/Mac solution as my application needs to be cross platform.
If the SDK isn't an option, can anyone suggest another way of doing this?
Thanks in Advance,
mal

Thanks - I appreciate such a quick reply.
It seems odd that these are both actions that can be performed from within the reader, but there is no way of automating this. Is this a deliberate design decision or is the Acrobat API not really designed as an automation interface?
Not complaining, just curious.
Thanks Again,
mal

Similar Messages

PKCS support in Java, especially PKCS#7 encoding and decoding

Hi,
Is there anybody knowing about PKCS support in JDK2 ?
I'd like to store a signature encoded in PKCS#7 format and read it back and decrypt it.
As far as I understood there is no such API I can use.
Thanx in advance
andras

hi ,
my problem that i have signed my file using MD5withRSA algorithm
i have stored the signature in another file (file signed) and the public key in another file too.
so a have 3 files: the source file which it was signed, the signature file and the public key file.
i want to store all this structure in ( only) one file in pkcs#7 format .
later i wuil verify the signature another time.
please if you can help me for the storage of the signed file in pkcs7 format ( the java code for storage, if possible)
thanks

Some clarification needed on PKCS #5 PBE

Hi all,
This is my first time posting on SUN Forums. Hope to be able to get your assistance in the programming field.
I have questions about PKCS #5, as I couldn't understand how it can help improve security when using salt and iteration count.
PKCS #5 states that salt and iteration count does not need to be kept secret as it is normally appended with the encrypted data.
To my understanding,
On encryption side, user will input a password and salt will be appended to the password, followed by a hashing algorithm.
key[1] = SHA-1(password+salt)
Iteration count addeds to key strengthening by:
Key [1] = SHA-1(password+salt)
key[2] = SHA-1(Key[1])
Key[i] = SHA-1 (Key[i-1]
Encrypted Data will then be obtained by:
Ciphertext = AES(Key[i] and Plaintext)
Hence the data payload will be as follows:
|| Encrypted Data+Salt+Iteration Count ||.
When the receiver receives the message, the decryption is similar.
key[1]= (password+obtained salt) from Payload
Key[i] will then be obtained depends on the Iteration Count,
and encrypted Data will be decrypted with Key.
My lack of understanding here is how does using salt increases security when the salt is public?
If a 56bit salt is used and only available to the receiver, any attacker who wants to decrypt the message might need to try 2^56 possible keys using a SINGLE password.
But if the salt is public, the only difference from adding salt and not adding salt is the key strengthening process.
How is password based encryption safer when comparing to AES-128 when the password the user input maybe commonly 48 bits?
Thank you all in advance! Hope to receive replies!
Regards,
Brandon

barnnod wrote:
Hi Sabre150,
Thank you for your suggestion. My application is enterprise based hence I think it is okay that the password is made known to employees only. (E.g one password per day, different department deploys different password each day). So each day each department has to distribute it's daily password to each department it needs to communicate with. So not just once every now and then do you have a key distribution problem you have one every day.
>
My actual scenario given by the school is:
"An organisation's daily operations involve frequent data messaging among mobile devices. The data transmitted are confidential and recently it has been observed that there is an increased number of incidents involving unauthorised tapping of data signals from unknown sources. Due to the sensitivity of data, the senior management has commissioned its IT security team to propose a prototype for a secured messaging application to enhance data transmittion security. The solution must also fufil operational needs such as response time and peak traffic tranmission."
I am very glad that you are helping me in this. What kind of encryption scheme do you think I can adopt? As I said. I would use Public Key cryptography probably using RSA.
What I have thought about is:
1) PBE I view PBE as suitable for personal use only. For example - if I want to encrypt data just for myself then using a password based approach makes sense since I don't have to distribute the key. I just keep it in my head.
2) PKCSYou would need to elaborate on this since PKCS is a broad brush.
3) Create a messaging server who can help distribute public keys. (But I left with 3 weeks upon completion and im not very confident of this because i dont know how to :( )Public Key distribution is fairly easy since you want everybody to have access to your public key. The public key could be broadcast as an SMS message or posted on a web server for people to download. I publish my public key on my web server.
So as what I derived from your post, the key distribution problem can be solved using asymmetric key algorithm. Pretty much so but not completely. One needs to be able to verify that a particular public key belongs to who you think it does. This process is normally done by distributing a certificate that contains the Public Key. The certificate is signed by a Certification Authority who does checks to make sure the purported owner is actually the owner. Since this is for internal use, rather than paying a fortune to a third party CA, one can use one of the free ones. You might want to take a look at [http://www.devx.com/Java/Article/10185|http://www.devx.com/Java/Article/10185] but there are others out there.
>
Meaning the Sender A uses Receiver A's public key and using RSA(randomly generated symmetric key), and send the ciphertext over to Receiver A. Receiver A uses it's own private key to decrypt the ciphertext, and obtain the private symmetric key between Sender A and Receiver A. Sender A and Receiver A .That is the way I would do it
then can securely do messaging from then on. The session keys would not be used more than once. Each message would use a different random session key.
But I do not know how can I derive the Receiver A's public key. I guess the use of a messaging server can solve this.Yes. Or a simple Web server. An admin person just publishes the public keys for each user and each user just sends his public key to the admin person just once.
>
Please advice!
Thank you :)You background makes doing the whole thing in 3 weeks a bit tight so you should leverage any third party software you can.
Since this is a school/university project you might just want to use PBE for the moment and then in your report explain the key distribution problem and explain how to a more comprehensive and secure system could be achieved. That way you get to do the work and to show your examiners that you have thought about the problems associated with your naive PBE based solution and can propose a better solution. In your position I would ask my Tutor for advice on this - it could save you a load of effort.
I don't work with Mobile devices so I don't know what libraries are available. I suspect you may need design your solution around what tools you have available.
Edited by: sabre150 on Sep 27, 2009 12:45 PM

Verifying detached signature

Hi,
Im trying to verify the PKCS& detached signature.. Verification is working fine. But if i try to alter or delete certian characters in my signature file its still saying verification success can anybody have a look at this code and help me to sort out this issue. Is there any other way with which i can verify the signature.
Here is the code:
import java.security.Security;
import java.io.*;
import org.bouncycastle.jce.PKCS7SignedData;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import java.util.Arrays;
import java.util.*;
import java.text.SimpleDateFormat;
import java.util.Iterator;
import java.util.List;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.CertificateParsingException;
import java.io.FileInputStream;
import javax.security.auth.x500.X500Principal;
import java.lang.*;
import java.io.PrintWriter;
import java.security.cert.*;
import java.util.Vector;
import java.lang.*;
import java.io.IOException;
import java.util.Collection;
import javax.security.auth.x500.X500Principal;
import org.bouncycastle.cms.CMSSignedData;
import org.bouncycastle.cms.SignerInformation;
import org.bouncycastle.cms.SignerInformationStore;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
class VerifyP7s {
public static void main(String args[]) {
if (args.length < 2)
usage();
//Plug the Provider into the JCA/JCE
Security.addProvider(new BouncyCastleProvider());
FileInputStream freader = null;
//------ Get the content data from file -------------
File f = new File(args[1]) ;
int sizecontent = ((int) f.length());
byte[] bytes = new byte[sizecontent];
try {
freader = new FileInputStream(f);
System.out.print("\nContent Bytes: " + freader.read(bytes, 0, sizecontent));
freader.close();
catch(IOException ioe) {
System.out.println(ioe.toString());
return;
//------ Get the pkcs #7 data from file -------
File p7s = new File(args[0]) ;
int size = ((int) p7s.length());
byte[] bytessig = new byte[size];
try {
freader = new FileInputStream(p7s);
System.out.println(" PKCS#7 bytes: " + freader.read(bytessig, 0, size));
freader.close();
catch(IOException ioe) {
System.out.println(ioe.toString());
return;
// --- Use Bouncy Castle provider to attempt verification of p7s ---
if(isBase64Encoded(bytessig)){
System.out.println("Signature file is BASE64 encoded") ;
try{
sun.misc.BASE64Decoder dec = new sun.misc.BASE64Decoder() ;
byte[] bdecoded = dec.decodeBuffer(new String(bytessig));
if (isVerified(bdecoded, bytes))
System.out.println("Verified pkcs#7 data: \"" + args[0] + "\" as BASE64-encoded DER file\n" +
"against content file \"" + args[1] + "\"") ;
else
System.out.println("Failed to verify " + args[0] + " as valid pkcs#7 detached signature.");
catch(Exception exc) {
System.out.println("Failed to verify " + args[0] + " as valid pkcs#7 detached signature.");
return;
else { //if NOT base64 encoded
if (isVerified(bytessig, bytes))
System.out.println("Verified pkcs#7 data: \"" + args[0] + "\" as binary DER file\n" +
"against content file \"" + args[1] + "\"") ;
else
System.out.println("Failed to verify " + args[0] + " as valid pkcs#7 detached signature.");
private static byte[] toUnicode(byte[] bytes) {
byte[] ucbytes = new byte[2*bytes.length];
for (int j = 0; j< bytes.length; j++) {
ucbytes[2*j] = bytes[j];
ucbytes[2*j+1] = 0x00; //null byte for UNICODE encoding
return ucbytes;
private static final boolean isVerified(byte[] sig, byte[] content) {
try{
PKCS7SignedData pkcs7 = new PKCS7SignedData(sig);
pkcs7.update(content, 0, content.length); // Update checksum
boolean verified = pkcs7.verify(); // Does it add up?
if(!verified) { //see if original data was UNICODE byte encoding
//System.out.println("Original byte content not verified.\nTrying UNICODE encoding ...");
pkcs7 = new PKCS7SignedData(sig);
pkcs7.update(toUnicode(content), 0, 2*content.length);
verified = pkcs7.verify();
if(verified){
System.out.println("\nUNICODE-encoding of signed content was verified.");
return true;
else
//System.out.println("\nCould NOT verify signed detached content");
return false;
else
System.out.println("ANSI-encoding of signed content was verified.");
return true ;
catch(java.security.cert.CRLException crle) {
//System.out.println("crl " + crle.toString());
return false;
catch(java.security.SignatureException sigex) {
//System.out.println("sigexcept " + sigex.toString());
return false;
catch(Exception secex) {
//System.out.println("other exception " + secex.toString());
return false;
private static final boolean isBase64Encoded(byte[] data) {
Arrays.sort(Base64Map);
for (int i=0; i<data.length; i++){
//System.out.println("data[" + i + "] " + (char)data) ;
if( Arrays.binarySearch(Base64Map, (char)data)<0
&& !Character.isWhitespace((char)data) )
return false;
return true;
public String printX509Cert(X509Certificate cert){
try{
String discrt = cert.getPublicKey().toString();
return discrt;
catch(Exception exception)
System.err.println("Exception is: "+exception.getMessage());
String ex = exception.getMessage();
return ex;
private static char[] Base64Map =
{ 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H',
'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P',
'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X',
'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f',
'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n',
'o', 'p', 'q', 'r', 's', 't', 'u', 'v',
'w', 'x', 'y', 'z', '0', '1', '2', '3',
'4', '5', '6', '7', '8', '9', '+', '/', '='
private static void usage() {
System.out.println("Usage:\n java VerifyP7s <pkcs #7 signature file> <contentfile> ") ;
System.exit(1);
Here is my signature file:
MIIEoAYJKoZIhvcNAQcCoIIEkTCCBI0CAQExDjAMBggqhkiG9w0CBQUAMAsGCSqGSIb3DQEHAaCC
A3kwggN1MIICXaADAgECAhBjffJNbUvAx4VWV4qkdNLGMA0GCSqGSIb3DQEBBAUAMDExETAPBgNV
BAoTCFNJRlkgTHRkMRwwGgYDVQQDExNTSUZZIEx0ZCBQcml2YXRlIENBMB4XDTA0MDcyNjAwMDAw
MFoXDTA1MDcyNjIzNTk1OVowgZwxETAPBgNVBAoUCFNJRlkgTHRkMSIwIAYDVQQLFBlIdW1hbiBS
ZXNvdXJjZSBEZXBhcnRtZW50MRswGQYDVQQLFBJFbXBsb3llZUlEIC0gU0YwNjcxGzAZBgNVBAMT
ElN1ZGVlcCBLdW1hciBQLiBLLjEpMCcGCSqGSIb3DQEJARYac3VkZWVwa3VtYXJAc2FmZXNjcnlw
dC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANGOpSIhZEDQ5Z6cxLMpZssi5WWdD0h7
kFWkbXPQk842HqCBFPcClUUWWeT/LJ10VCC9Ff0KrI5lviGl9umnVW+LeCYiI/ksnea/p7tKfOgN
NO+UBoJ4PE5XnUEq03CFWdHhGNfukNqWZiMC+bUX8e6+blFU/6ipUtHmIkIrlNZBAgMBAAGjgaAw
gZ0wCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwEQYJYIZIAYb4QgEBBAQDAgeAMF0GA1UdHwRWMFQw
UqBQoE6GTGh0dHA6Ly9vbnNpdGVjcmwuc2FmZXNjcnlwdC5jb20vU0lGWUx0ZEh1bWFuUmVzb3Vy
Y2VEZXBhcnRtZW50L0xhdGVzdENSTC5jcmwwEQYKYIZIAYb4RQEGCQQDAQH/MA0GCSqGSIb3DQEB
BAUAA4IBAQBpFEGmTHOSfA/SkeC/bvZE3sYpBU0+RG8iSm+DTbP5tiCyWT+L0AidTWDk0ZuXz7yA
eF9NR0OZyxp3/v+OQYn3Q0a1awe+JKnDCD+zayehcPbvD+q79WYHO5Ibm5UA2VnGoBbV3CDhj1qC
lCyqllEKVWk11iB6wu24PzB31uARxkar3cynFNX4P6nxy6vb83W/Wnt8eOMQHI2SiVvJtjU5SwL6
ILrkZfrm7NLcCQY2w7w4/WeFgeb2Ko8hYHSRyvJWwBUyv2ExDGnv0eqHJn6HC+4IE8wzirWre0jY
Y0529u3MfIL0F7lrkuwYnpVa3zE/b2HwCaMrN+TuY/oNkf2YMYHtMIHqAgEBMEUwMTERMA8GA1UE
ChMIU0lGWSBMdGQxHDAaBgNVBAMTE1NJRlkgTHRkIFByaXZhdGUgQ0ECEGN98k1tS8DHhVZXiqR0
0sYwDAYIKoZIhvcNAgUFADANBgkqhkiG9w0BAQEFAASBgDUpkV5Zpi781vTmtydAdOVJ7cecnQ9v
8fdTZwMgz56Q3ZI0pj6+60e8lIafO3mo596eCF2mBsZm2wEO1PhnXPKAQFXWIseDp0GVdmwTp1tH
M2e9fC2bOppNhBKkpZAr26PE6/BIDittE1rM8nJOa+9lzJcDCBBpJM3MdlHjY+8v
My Content file is:
<table width=100%><TR align=center><TH COLSPAN=3>Transfer Funds Request</TH></TR><TR><TD ALIGN=RIGHT>TRANSFER FROM</TD><TD>..........</TD><TD>Money Market</TD></TR><TR><TD ALIGN=RIGHT>TRANSFER TO</TD><TD>..........</TD><TD>Cash</TD></TR><TR><TD ALIGN=RIGHT>AMOUNT</TD><TD>..........</TD><TD>/ \ & \n</TD></TR></table> I am authorizing the transfer of the above funds by digitally signing this request.
Thanx in advance.

Your PKCS#7 signature file is dumped by DUMPASN1 as follows:
The verifying code only checks the public key against the data.
If you change some byte of the PKCS#7 data that can "blow up" the ASN.1 structures, you cannot get the public key, so the data would not be verified OK.
But if you change some other byte in the PKCS#7 signature data, it could change some things that are not important to ASN.1 Parsing, like changing 'Human Resource Department' to 'Departamentos de Recursos' that is a string with the same length. So as you don't changed the Public key bytes it's all OK.
If you are concerned about PKCS#7 signature file modification, you can try verifying the signer certificates inside - an additional step, but not difficult to do.
 0 30 1184: SEQUENCE {
 4 06 9: OBJECT IDENTIFIER signedData (1 2 840 113549 1 7 2)
15 A0 1169: [0] {
19 30 1165: SEQUENCE {
23 02 1: INTEGER 1
26 31 14: SET {
28 30 12: SEQUENCE {
30 06 8: OBJECT IDENTIFIER md5 (1 2 840 113549 2 5)
40 05 0: NULL
42 30 11: SEQUENCE {
44 06 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
55 A0 889: [0] {
59 30 885: SEQUENCE {
63 30 605: SEQUENCE {
67 A0 3: [0] {
69 02 1: INTEGER 2
72 02 16: INTEGER
 : 63 7D F2 4D 6D 4B C0 C7 85 56 57 8A A4 74 D2 C6
90 30 13: SEQUENCE {
92 06 9: OBJECT IDENTIFIER
 : md5withRSAEncryption (1 2 840 113549 1 1 4)
103 05 0: NULL
105 30 49: SEQUENCE {
107 31 17: SET {
109 30 15: SEQUENCE {
111 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
116 13 8: PrintableString 'SIFY Ltd'
126 31 28: SET {
128 30 26: SEQUENCE {
130 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)
135 13 19: PrintableString 'SIFY Ltd Private CA'
156 30 30: SEQUENCE {
158 17 13: UTCTime 26/07/2004 00:00:00 GMT
173 17 13: UTCTime 26/07/2005 23:59:59 GMT
188 30 156: SEQUENCE {
191 31 17: SET {
193 30 15: SEQUENCE {
195 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
200 14 8: TeletexString 'SIFY Ltd'
210 31 34: SET {
212 30 32: SEQUENCE {
214 06 3: OBJECT IDENTIFIER
 : organizationalUnitName (2 5 4 11)
219 14 25: TeletexString 'Human Resource Department'
246 31 27: SET {
248 30 25: SEQUENCE {
250 06 3: OBJECT IDENTIFIER
 : organizationalUnitName (2 5 4 11)
255 14 18: TeletexString 'EmployeeID - SF067'
275 31 27: SET {
277 30 25: SEQUENCE {
279 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)
284 13 18: PrintableString 'Sudeep Kumar P. K.'
304 31 41: SET {
306 30 39: SEQUENCE {
308 06 9: OBJECT IDENTIFIER
 : emailAddress (1 2 840 113549 1 9 1)
319 16 26: IA5String '[email protected]'
347 30 159: SEQUENCE {
350 30 13: SEQUENCE {
352 06 9: OBJECT IDENTIFIER
 : rsaEncryption (1 2 840 113549 1 1 1)
363 05 0: NULL
365 03 141: BIT STRING, encapsulates {
369 30 137: SEQUENCE {
372 02 129: INTEGER
 : 00 D1 8E A5 22 21 64 40 D0 E5 9E 9C C4 B3 29 66
 : CB 22 E5 65 9D 0F 48 7B 90 55 A4 6D 73 D0 93 CE
 : 36 1E A0 81 14 F7 02 95 45 16 59 E4 FF 2C 9D 74
 : 54 20 BD 15 FD 0A AC 8E 65 BE 21 A5 F6 E9 A7 55
 : 6F 8B 78 26 22 23 F9 2C 9D E6 BF A7 BB 4A 7C E8
 : 0D 34 EF 94 06 82 78 3C 4E 57 9D 41 2A D3 70 85
 : 59 D1 E1 18 D7 EE 90 DA 96 66 23 02 F9 B5 17 F1
 : EE BE 6E 51 54 FF A8 A9 52 D1 E6 22 42 2B 94 D6
 : [ Another 1 bytes skipped ]
504 02 3: INTEGER 65537
509 A3 160: [3] {
512 30 157: SEQUENCE {
515 30 9: SEQUENCE {
517 06 3: OBJECT IDENTIFIER basicConstraints (2 5 29 19)
522 04 2: OCTET STRING, encapsulates {
524 30 0: SEQUENCE {}
526 30 11: SEQUENCE {
528 06 3: OBJECT IDENTIFIER keyUsage (2 5 29 15)
533 04 4: OCTET STRING, encapsulates {
535 03 2: BIT STRING 5 unused bits
 : '101'B
539 30 17: SEQUENCE {
541 06 9: OBJECT IDENTIFIER
 : netscape-cert-type (2 16 840 1 113730 1 1)
552 04 4: OCTET STRING, encapsulates {
554 03 2: BIT STRING 7 unused bits
 : '1'B (bit 0)
558 30 93: SEQUENCE {
560 06 3: OBJECT IDENTIFIER
 : cRLDistributionPoints (2 5 29 31)
565 04 86: OCTET STRING, encapsulates {
567 30 84: SEQUENCE {
569 30 82: SEQUENCE {
571 A0 80: [0] {
573 A0 78: [0] {
575 86 76: [6]
 : 'http://onsitecrl.safescrypt.com/SIFYLtdHumanReso'
 : 'urceDepartment/LatestCRL.crl'
653 30 17: SEQUENCE {
655 06 10: OBJECT IDENTIFIER '2 16 840 1 113733 1 6 9'
667 04 3: OCTET STRING, encapsulates {
669 01 1: BOOLEAN TRUE
672 30 13: SEQUENCE {
674 06 9: OBJECT IDENTIFIER
 : md5withRSAEncryption (1 2 840 113549 1 1 4)
685 05 0: NULL
687 03 257: BIT STRING
 : 69 14 41 A6 4C 73 92 7C 0F D2 91 E0 BF 6E F6 44
 : DE C6 29 05 4D 3E 44 6F 22 4A 6F 83 4D B3 F9 B6
 : 20 B2 59 3F 8B D0 08 9D 4D 60 E4 D1 9B 97 CF BC
 : 80 78 5F 4D 47 43 99 CB 1A 77 FE FF 8E 41 89 F7
 : 43 46 B5 6B 07 BE 24 A9 C3 08 3F B3 6B 27 A1 70
 : F6 EF 0F EA BB F5 66 07 3B 92 1B 9B 95 00 D9 59
 : C6 A0 16 D5 DC 20 E1 8F 5A 82 94 2C AA 96 51 0A
 : 55 69 35 D6 20 7A C2 ED B8 3F 30 77 D6 E0 11 C6
 : [ Another 128 bytes skipped ]
948 31 237: SET {
951 30 234: SEQUENCE {
954 02 1: INTEGER 1
957 30 69: SEQUENCE {
959 30 49: SEQUENCE {
961 31 17: SET {
963 30 15: SEQUENCE {
965 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
970 13 8: PrintableString 'SIFY Ltd'
980 31 28: SET {
982 30 26: SEQUENCE {
984 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)
989 13 19: PrintableString 'SIFY Ltd Private CA'
1010 02 16: INTEGER
 : 63 7D F2 4D 6D 4B C0 C7 85 56 57 8A A4 74 D2 C6
1028 30 12: SEQUENCE {
1030 06 8: OBJECT IDENTIFIER md5 (1 2 840 113549 2 5)
1040 05 0: NULL
1042 30 13: SEQUENCE {
1044 06 9: OBJECT IDENTIFIER
 : rsaEncryption (1 2 840 113549 1 1 1)
1055 05 0: NULL
1057 04 128: OCTET STRING
 : 35 29 91 5E 59 A6 2E FC D6 F4 E6 B7 27 40 74 E5
 : 49 ED C7 9C 9D 0F 6F F1 F7 53 67 03 20 CF 9E 90
 : DD 92 34 A6 3E BE EB 47 BC 94 86 9F 3B 79 A8 E7
 : DE 9E 08 5D A6 06 C6 66 DB 01 0E D4 F8 67 5C F2
 : 80 40 55 D6 22 C7 83 A7 41 95 76 6C 13 A7 5B 47
 : 33 67 BD 7C 2D 9B 3A 9A 4D 84 12 A4 A5 90 2B DB
 : A3 C4 EB F0 48 0E 2B 6D 13 5A CC F2 72 4E 6B EF
 : 65 CC 97 03 08 10 69 24 CD CC 76 51 E3 63 EF 2F
 : }

Certificate in Windows

Normally, when we enter in a SSL page, the navigator will request for a certificate, and this certificate is stocked in the database og the navigator. I want to ask if there are a Java open source that allows to redirect the navigator to look up the certificate in a floppy or CD or even a Smart Card. Any ideas? Thank you

read about PKCS#11 on RSA Labs. Keep in mind, reading a certificate off a floppy/CD without any authentication will create repudiation issues.
That's why tokes like USB Tokens or Smart Card tokens are best methods.

An doubt about Sun PKCS#11

Hi , everyone
I had an doubt when I read "Sun PKCS#11 Reference Guide". here is the url: http://java.sun.com/j2se/1.5.0/docs/guide/security/p11guide.html
I found these codes:
KeyStore.Builder builder = new KeyStore.Builder("PKCS11"); the question is I cannot found such a constructor in class KeyStore.Builder. so, why? is that a mistake ? or something I don`t know?
is there anybody know about this? please tell me, thank you.

Can I ask you one question?
Which driver did you specify? I mean the smarcard reader driver or the smartcard itself driver?
If the second, does it come along with the card? because as far as I know I just got the smart card but no software at all (apart the smartcard reader driver).
Can you help me out with this?
thanks in advance,
Marco

Question about the personalization of BueZ PKCS#15

hi, i use the IBM JCOP31 Card, with the Eclipse, now in the card , there is an app , named BlueZ PKCS#15, now i have transited its life cycle state to selectable , and next , i want to make it transite to personalized, but but when i send the command ,the reponse is 6A 85(security conditions of use not satisfied!), what wrong ?
any help would be appreciated!
thanks!!!

and i also dowload a tool ,opensc ,which can be used for the pkcs#15 personalized, but I run the command pkcs15-init -E, the response is 'the card can't be erased', and the command 'pkcs15-init -C so-pin 123456 so-puk 123456,the response is 'the condition of use not satisfied', what wrong with me? if i want to do that , need the card be erasible?
any help woud be appreciated! thanks!!!!!

Need Help about Certificate based Authentication

Hi friends..
Currently, i'm trying to develop an applet that using Certificate Based Authentication..
i have looked at this thread : http://forums.sun.com/thread.jspa?threadID=5433603
these is what Safarmer says about steps to generate CSR :
0. Generate key pair on the card.
1. Get public key from card
2. Build CSR off card from the details you have, the CSR will not have a signature
3. Decide on the signature you want to use (the rest assumes SHA1 with RSA Encryption)
4. Generate a SHA1 hash of the CSR (without the signature section)
5. Build a DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) that contains the message digest generated in the previous step
6. Send DigestInfo to the card
7. On the card, the matching private key to encrypt the DigestInfo
8. Return the encrypted digest info to the host
9. Insert the response into the CSR as the signature
Sorry, i'm a little bit confused about those steps.. (Sorry i'm pretty new in X509Certificate)..
on step 4,
Generate a SHA1 hash of the CSR (without the signature section)
Does it mean we have to "build" CSR looks like :
Data:
Version: 0 (0x0)
Subject: C=US, ST=California, L=West Hollywood, O=ITDivision, OU=Mysys, CN=leonardo.office/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:be:a0:5e:35:99:1c:d3:49:ba:fb:2f:87:6f:d8:
ed:e4:61:f2:ae:6e:87:d0:e2:c0:fd:c1:0f:ed:d7:
84:04:b5:c5:66:cd:6b:f0:27:a2:cb:aa:3b:d7:ad:
fa:f4:72:10:08:84:88:19:24:d0:b0:0b:a0:71:6d:
23:5e:53:4f:1b:43:07:98:4d:d1:ea:00:d1:e2:29:
ea:be:a9:c5:3e:78:f3:5e:30:1b:6c:98:16:60:ba:
61:57:63:5e:6a:b5:99:17:1c:ae:a2:86:fb:5b:8b:
24:46:59:3f:e9:84:06:e2:91:b9:2f:9f:98:04:01:
db:38:2f:5b:1f:85:c1:20:eb
Exponent: 65537 (0x10001)
Attributes:
a0:00
on step 5, Build a DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) that contains the message digest generated in the previous step
How DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) looks like?
And what is the DigestInfo Contains, and what is TAG for DigestInfo?..
Please help me regarding this..
Thanks in advance..
Leonardo Carreira

Hi,
Leonardo Carreira wrote:
Sorry, Encode the Public Key is handled by On Card Application or Off Card Application?..
I think its' easier to encode the public key by Off Card app..
Could you guide me how to achieve this?, i think Bouncy Castle can do this, but sorry, i don't know how to write code for it.. :( All you need to do is extract the modulus and exponent of the public key. These will be in a byte array (response from your card) that you can use to create a public key object in your host application. You can then use this key to create a CSR with bouncycastle.
I have several some questions :
1. Does Javacard provide API to deal with DER data format?JC 2.2.1 does not buy JC 2.2.2 does, however I believe this is an optional package though. You can implement this in your applet though.
2. Regarding the Certificate Based Authentication, what stuff that need to be stored in the Applet?..
- I think Applet must holds :
- its Private Key,
- its Public Key Modulus and its Public Key Exponent,
- its Certificate,
- Host Certificate
i think this requires too much EEPROM to store only the key..This depends on what you mean by Certificate Based Authentication. If you want your applet to validate certificates it is sent against a certificate authority (CA) then you need the public keys for each trust point to the root CA. To use the certificate for the card, you need the certificate and corresponding private key. You would not need to use the public key on the card so this is not needed. You definitely need the private key.
Here is a rough estimate of data storage requirements for a 2048 bit key (this is done off the top of my head so is very rough):
~800 bytes for your private key
~260 bytes per public key for PKI hierarchy (CA trust points)
~1 - 4KB for the certificate. This depends on the amount of data you put in your cert
3. What is the appropriate RSA key length that appropriate, because we have to take into account that the buffer, is only 255 bytes (assume i don't use Extended Length)..You should not base your key size on your card capabilities. You can always use APDU chaining to get more data onto the card. Your certificate is guaranteed to be larger than 256 bytes anyway. You should look at the NIST recommendations for key strengths. These are documented in NIST SP 800-57 [http://csrc.nist.gov/publications/PubsSPs.html]. You need to ensure that the key is strong enough to protect the data for a long enough period. If the key is a transport key, it needs to be stronger than the key you are transporting. As you can see there are a lot of factors to consider when deciding on key size. I would suggest you use the strongest key your card supports unless performance is not acceptable. Then you would need to analyse your key requirements to ensure your key is strong enough.
Cheers,
Shane

Is PKCS#7 format supported by Mac OS X 10.6 server or above?

Couple of questions on Mac OS X 10.6 server or above.
1) Can a Mac OS X 10.6 server or above version supports PKCS#7 format for SSL certificate installation?
2) If PKCS#7 format is supported, is the file extension .p7b file?
Thank you!
J

Try it. Unfortunately, sometimes certificates can be mis-generated or can become corrupted.
X.509 is the overarching standard, and comprises various formats including PKCS7. I'd usually want a PEM format certificate file, though OS X 10.6 does support various formats. Including PKCS7.
Depending on exactly what you're up to here with OS X and OS X Server and these certificates, there might be Server Admin.app or Server.app service-specific steps required; additional general info here here or here.
If these are your own servers, clients and your own family and friends accessing these systems, then there's no need for a purchased certificate. Self-generated certificates work just as well and are just as secure as purchased certificates (if you have a trusted and secure way to perform the initial load), and — if you're inclined, and want to learn a little about OS X and certificates — you can set up your own certificate authority and load your own root certificate, and then your own client certificates are automatically honored.

Pkcs#11 certificate does not appear with Tomcat / IIS ok

Hi all,
I am trying to use SmartCard client authentication (pkcs#11, JDK 1.5.0_3, SafeSign for Starcos 1.0.9, SCR531 card controller, Tomcat 5.5.12 with clientAuth=true).
When I access the protected site, the browser plugin (which is installed by SafeSign) shows a window that allows to choose one of the certificates that are installed.
The problem is that the SmartCard (correctly inserted in the controller) certificate is not showed at this window.
All JSSE (java.security file entries and so on) and JVM configurations (-Dsecurity.manager, -Djavax.net.ssl.keyStore=NONE, -Djavax.net.ssl.keyStoreType=pkcs11, -Djavax.net.ssl.keyStoreProvider=SunPKCS11-StarCOS) are in place (in fact, the command "keytool ... -list" works just fine).
P.S.: the certificate shows ok on IIS 5.1/6.0 configured to ask for client authentication.
Has someone got the same problem?
Thanks for your attention.

If you are sure it is not a client side problem, as your statement about deployment on IIS suggests, do some debugging on the client side and compare the trust store and supported Ciphersuites from successful and failed deployments.
Maybe your configuration on the servers (resp. the default conf of servers) is different in a sort that the key on the card will not meet the requirements proposed by the server (e.g. trusted set ).

PKCS#11 - JAVA - Hardware crypto with custom algorithm!??

Hello!
I'm wondering if it is possible to use the SUN provider in JDK1.5.0 for PKCS#11 with a hardware based crypto card which does not use any of the algorithms specified in the field guide of PKCS#11 for jdk1.5.0. Instead a custom algorithm that is implemented on this card will be used for encryption/decryption.
It should be transparent for the application what kind of algorithm that is used to encrypt/decrypt since I will send the data that will be encrypted/decrypted to this hardware card.
If it is not supported by the sun provider. What would be necessary to do to get this to work?
The card I'm about to use has an PKCS#11 API.

At this moment I don't really know the specifics on these hardware accelerators, hence my question. If it not is an algorithm that is in the refrence guide for PKCS#11, then I would like to know if there's any way to use the algorithm anyway using the PKCS#11 "wrapper" in jdk1.5.0.....
And a follow question, If it is not supported what would be the easiest way to use the PKCS#11 API of the hw -card.... I suppose to write some JNI code to send in the data to be encrypted and get the encrypted answer back?
/Henrik

PKCS#11 driver dll and Java

Hello!
I'm trying to use a smartcard to do some signing and this needs to be done using Java. I have read about the SUN PKCS#11 provider and thought that this would work. However as it turns out my card vendor refuses to provide me with a pkcs#11 .dll and without a dll the sun provider won't work. I have although recieved a .lib and a couple of .h files for this specific PKCS#11 implementation. The vendor also has provided me with a windows service to communicate with the card, I have tested this application and it works fine however I need to do this communication with Java, if it is not possible maybe I will have to resort to JNI?
What I'm courios about is if there is some generic .dll for PKCS#11 operations? The card is a Java Card which has applets conforming to standards. Would it for instance be possible to use a completly different vendors .dll for the operations that I would like to perform.
I really really need an answer.
P.S switching card vendor is not an option D.S
Kind regards
Henrik Grankvist

Hi ejp, thank you for answering.
The problem for me could be a little more easier: I mean, actually my card provider ships the dll, but I would like to cover as many kinds of cards as I can with the application on which I'm working.
I may use several ways to download the specific dll to the user's PC, but still I should know if I can redistribute this dlls. Is there a way to know which drivers I can redistribute without having licensing problems? Do you know any sort of drivers database on which I could look for?
Thank you everybody,
regards.

EPass2000 token + Sun PKCS#11 JCE provider

Hello,
I am trying to programatically control ePass2000 USB crypto token: http://www.ftsafe.com/products/viewproduct.php?p=epass2k
Unfortunately, I am having serious problems communicating with
ePass2000 token from Java. I have found no documentation on doing it
properly, but I have tried using Sun's PKCS11 JCE interface and
ep2pk11.dll like this:
in java.security:
security.provider.7=sun.security.pkcs11.SunPKCS11
${java.home}/lib/security/pkcs11.cfg
pkcs11.cfg:
name = epass_token
library = c:\windows\system32\ep2pk11.dll
Now using
keytool -keystore NONE -storetype PKCS11 �list
or
keytool -keystore NONE -storetype PKCS11 -storepass 1234 �list
should show me list of certificates on token. (if this works, that
means, that JCE API sees the token and can communicate with it). I got only:
keytool error: java.security.ProviderException: Initialization failed
What is a proper way of accessing and using ePass2000 from Java?
Does the error mean, that there's something wrong with the dll? The dll itself
works from firefox as PKCS#11 provider, so I believe it should work with Java
too. I am using Java 1.5.0_06.
If anyone has played with this or similiar token from Java, I'd be glad to hear
about your experiences. Right now, I can only try to write my own JNI wrapper for
the native library :(.
Juraj.

I've never tried that token, but I'm accessing a smart card using SunPKCS11 ( never with the keytool, but from code)
The problem could be the backslashes with which you specify the library: try \\ or / instead, so something like
c:/windows/system32/ep2pk11.dll

PKCS#11 provider - ECDSA key pair generation on token

Hello,
I want to generate ECDSA key pair on HSM (nCipher's netHSM) using SunPKCS11 provider and Java 6.
After generation for all supported curve names (e.g. secp256r1) I try to call getEncoding method from PublicKey object (keyPair.getPublic().getEncoded()) and
I get RuntimeException
caused by java.io.IOException: "Point does not match field size"
at sun.security.ec.ECParameters.decodePoint(ECParameters.java:75)
at sun.security.pkcs11.P11ECKeyFactory.decodePoint(P11ECKeyFactory.java:61)
at sun.security.pkcs11.P11Key$P11ECPublicKey.fetchValues(P11Key.java:1002)
Keys are accessible on HSM.
Everything is well configured and works fine with RSA keys.
Using IAIK PKCS#11 provider I got proper values. Is it any bug in SunPKCS11 provider?
Regards,
MarcinP

I recently had a problem with ECDSA and the PKCS#11 library of nCipher. Here's info from one of their engineers about the PKCS11 library:
"There are two separate issues - one is that our current pkcs11
release doesn't support ECDSA signature with SHA-2 hashes
(the v11.00 firmware adds support for it, but the main release version of
the pkcs11 library hasn't been updated to take advantage of it yet).
There is a hotfix version that does support SHA-2 hashes with some
restrictions, talk to [email protected] for details, and V11.10
should be out soon and have that merged in.
But the issue with setting CKA_SIGN is that our underlying HSM API
allows elliptic curve keys to be either key exchange (ECDH) or
signature (ECDSA) keys, but not both at one.
At the PKCS #11 level, if you specify CKA_DERIVE=true and let
CKA_SIGN default, it will default to false, and vice versa.
If you specify both CKA_DERIVE=true and CKA_SIGN=true, then we
return CKR_TEMPLATE_INCONSISTENT because we can't do both with
the same key. (However, the tests using C_GetMechanismInfo will
show that we can do both mechanisms, because we can - so long
as you use different keys, even though they have the same PKCS#11
type.)
I can't comment on when or how that will be changed."
I was using the PKCS#11 library through NSS when I ran into the problem, but I imagine Java would run into similar problems also using the PKCS#11 library. I was able to generate keypairs but not create a CSR (which required making a signature, which required SHA-2).
Can you just use the java classes to speak to the netHSM? I've never directly written code to do so myself, but I have used Corestreet's OCSP product that uses the java classes to speak to the nCipher HSMs (though not using EC). It might work better than going through the PKCS#11 layer. There should be a java directory under NFAST_HOME that contains some jars.
Please post back if you figure anything out as I'll probably be playing with this stuff myself soon.
Dave

PKCS#11 Provider unable to fetch asymmetric keys and certificates

Hi,
I'm facing a problem while getting keys and certificate from Eracom HSM (ProtectServer Orange:38039 Model: PSO:PL50) using Sun PKCS#11 Provider. It gets only the symmetric keys but NEVER gets the asymmetric keys.
My code snippet and configuration file are:
     Java Code:
     java.io.InputStream is = new java.io.FileInputStream("pkcs11.cfg");
sun.security.pkcs11.SunPKCS11 pkcs11_provider = new sun.security.pkcs11.SunPKCS11(is);
System.out.println("Provider Name : " + pkcs11_provider.getName());
java.security.Security.addProvider(pkcs11_provider);
KeyStore ks = KeyStore.getInstance("PKCS11", pkcs11_provider);
ks.load(null, "password".toCharArray());
java.util.Enumeration obj_enumeration = ks.aliases();
while (obj_enumeration.hasMoreElements()) {
String str_certAlias = (String) obj_enumeration.nextElement();
System.out.println("Alias : " + str_certAlias);
     pkcs11.cfg:
     name = Eracom
     library = G:\Eracom\cryptoki.dll
     slot = 0
     attributes(*, CKO_PRIVATE_KEY, *) = {
     CKA_TOKEN = false
     CKA_SENSITIVE = false
     CKA_EXTRACTABLE = true
     CKA_DECRYPT = true
     CKA_SIGN = true
     CKA_SIGN_RECOVER = true
     CKA_UNWRAP = true
     attributes(*, CKO_PUBLIC_KEY, *) = {
     CKA_ENCRYPT = true
     CKA_VERIFY = true
     CKA_VERIFY_RECOVER = true
     CKA_WRAP = true
I also ran my program without specifying any attributes in configuration file, also tried many other combination, but in all cases (with or without attributes) only symmetric keys are loaded from HSM. I am able to get all keys (symmteric and asymmteric) and certificates from the same HSM using IAIK PKCS#11 Provider. Though, the Sun PKCS#11 Provider is working fine with SmartCard tokens (Rainbow, Alladin etc.)
Any help to resolve my problem would be highly appreciated.
Thanks in advance.

I recently had a problem with ECDSA and the PKCS#11 library of nCipher. Here's info from one of their engineers about the PKCS11 library:
"There are two separate issues - one is that our current pkcs11
release doesn't support ECDSA signature with SHA-2 hashes
(the v11.00 firmware adds support for it, but the main release version of
the pkcs11 library hasn't been updated to take advantage of it yet).
There is a hotfix version that does support SHA-2 hashes with some
restrictions, talk to [email protected] for details, and V11.10
should be out soon and have that merged in.
But the issue with setting CKA_SIGN is that our underlying HSM API
allows elliptic curve keys to be either key exchange (ECDH) or
signature (ECDSA) keys, but not both at one.
At the PKCS #11 level, if you specify CKA_DERIVE=true and let
CKA_SIGN default, it will default to false, and vice versa.
If you specify both CKA_DERIVE=true and CKA_SIGN=true, then we
return CKR_TEMPLATE_INCONSISTENT because we can't do both with
the same key. (However, the tests using C_GetMechanismInfo will
show that we can do both mechanisms, because we can - so long
as you use different keys, even though they have the same PKCS#11
type.)
I can't comment on when or how that will be changed."
I was using the PKCS#11 library through NSS when I ran into the problem, but I imagine Java would run into similar problems also using the PKCS#11 library. I was able to generate keypairs but not create a CSR (which required making a signature, which required SHA-2).
Can you just use the java classes to speak to the netHSM? I've never directly written code to do so myself, but I have used Corestreet's OCSP product that uses the java classes to speak to the nCipher HSMs (though not using EC). It might work better than going through the PKCS#11 layer. There should be a java directory under NFAST_HOME that contains some jars.
Please post back if you figure anything out as I'll probably be playing with this stuff myself soon.
Dave

About PKCS#11

Similar Messages

Maybe you are looking for