opensc/libp11

PKCS#11 wrapper library

OpenSC documentation

Manual pages for the OpenSC command line tools as well as for the OpenSC configuration files are available online and typically distributed along with your installation.

The OpenSC Wiki includes, among others, information for:

• Windows Quick Start
• macOS Quick Start
• Compiling and Installing on Unix flavors
• Frequently Asked Questions
• More user and developer provided documentation

Downloads

Latest release

The latest stable version of OpenSC is available on Github. It is available as

• Windows installer for 64 bit and 32 bit programs (OpenSC*_win64.msi and OpenSC*_win32.msi)
• macOS installer (OpenSC*.dmg)
• Source code distribution (opensc*.tar.gz)

Nightly build

The latest source code is available through GitHub. Nightly builds are available by their git hash in branches of OpenSC/Nightly.

Build and testing status

Build and test status of specific cards:

Cards	Status
CAC
virt_CACard
Coolkey
PivApplet
OpenPGP Applet
GidsApplet
IsoApplet
OsEID (MyEID)
SmartCardHSM
ePass2003

libp11's Issues

null pointer exception in libpkcs11.c

In C_UnloadModule mod->handle is used assuming it is valid.
If the dlopen() in C_LoadModule fails, C_UnloadModule is called with mod->handle == NULL

suggest library unload code at line 123 in libpkcs11.c becomes:

if (mod->handle)
#ifdef WIN32
FreeLibrary(mod->handle);
#else
dlclose(mod->handle);
#endif

Latest push does not compile with OpenSSL_1_0_2-stable

Mac OS X 10.10.5 Yosemite, Xcode 7.2, OpenSSL_1_0_2-stable (1.0.2f-dev)

$ ./configure --prefix=/opt/local
checking for a BSD-compatible install... /opt/local/bin/ginstall -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /opt/local/bin/gmkdir -p
checking for gawk... no
checking for mawk... no
checking for nawk... no
checking for awk... awk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-apple-darwin14.5.0
checking host system type... x86_64-apple-darwin14.5.0
checking for gcc... clang
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether clang accepts -g... yes
checking for clang option to accept ISO C89... none needed
checking whether clang understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of clang... gcc3
checking for pkg-config... /opt/local/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking how to run the C preprocessor... clang -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... clang -E
checking whether ln -s works... yes
checking for a sed that does not truncate output... /usr/bin/sed
checking whether make sets $(MAKE)... (cached) yes
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by clang... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld
checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no
checking for BSD- or MS-compatible name lister (nm)... /opt/local/bin/nm
checking the name lister (/opt/local/bin/nm) interface... BSD nm
checking the maximum length of command line arguments... 196608
checking how to convert x86_64-apple-darwin14.5.0 file names to x86_64-apple-darwin14.5.0 format... func_convert_file_noop
checking how to convert x86_64-apple-darwin14.5.0 file names to toolchain format... func_convert_file_noop
checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r
checking for objdump... no
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... no
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /opt/local/bin/nm output from clang object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking for dsymutil... dsymutil
checking for nmedit... nmedit
checking for lipo... lipo
checking for otool... otool
checking for otool64... no
checking for -single_module linker flag... yes
checking for -exported_symbols_list linker flag... yes
checking for -force_load linker flag... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if clang supports -fno-rtti -fno-exceptions... yes
checking for clang option to produce PIC... -fno-common -DPIC
checking if clang PIC flag -fno-common -DPIC works... yes
checking if clang static flag -static works... no
checking if clang supports -c -o file.o... yes
checking if clang supports -c -o file.o... (cached) yes
checking whether the clang linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... darwin14.5.0 dyld
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for windres... no
checking for ANSI C header files... (cached) yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking malloc.h usability... no
checking malloc.h presence... no
checking for malloc.h... no
checking for stdlib.h... (cached) yes
checking for inttypes.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking for dlfcn.h... (cached) yes
checking utmp.h usability... yes
checking utmp.h presence... yes
checking for utmp.h... yes
checking for doxygen... /opt/local/bin/doxygen
checking for library containing dlopen... none required
checking for __register_atfork... no
checking for OPENSSL... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/libp11.pc
config.status: creating src/versioninfo.rc
config.status: creating doc/Makefile
config.status: creating doc/doxygen.conf
config.status: creating examples/Makefile
config.status: creating tests/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands

libp11 has been configured with the following options:


Version:                 0.4.0_git
Libraries:               /opt/local/lib

api doc support:         no

Host:                    x86_64-apple-darwin14.5.0
Compiler:                clang
Preprocessor flags:      
Compiler flags:          -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4 -msse4.2
Linker flags:            
Libraries:               

PTHREAD_FLAGS:           
OPENSSL_CFLAGS:          -I/opt/local/include -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4 -msse4.2
OPENSSL_LIBS:            -L/opt/local/lib -lssl -lcrypto

$ make all && make check
Making all in src
/Applications/Xcode.app/Contents/Developer/usr/bin/make  all-am
  CC       libp11_la-libpkcs11.lo
  CC       libp11_la-p11_attr.lo
  CC       libp11_la-p11_cert.lo
  CC       libp11_la-p11_err.lo
  CC       libp11_la-p11_key.lo
  CC       libp11_la-p11_load.lo
  CC       libp11_la-p11_misc.lo
  CC       libp11_la-p11_ops.lo
  CC       libp11_la-p11_rsa.lo
  CC       libp11_la-p11_ec.lo
  CC       libp11_la-p11_slot.lo
  CC       libp11_la-atfork.lo
  CCLD     libp11.la
Undefined symbols for architecture x86_64:
  "_PKCS11_get_ec_key_method", referenced from:
     -exported_symbol[s_list] command line option
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [libp11.la] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
$ 

The problem is in src/lipb11.exports file that contains PKCS11_get_ec_key_method, which is defined (and used) only if OpenSSL version is 1.1 or newer.

Once that line is removed from src/libp11.exports, the linking still does not work:

$ ./bootstrap
autoreconf: Entering directory `.'
autoreconf: configure.ac: not using Gettext
autoreconf: running: /opt/local/bin/aclocal --force -I m4
autoreconf: configure.ac: tracing
autoreconf: running: /opt/local/bin/glibtoolize --copy --force
glibtoolize: putting auxiliary files in AC_CONFIG_AUX_DIR, '.'.
glibtoolize: copying file './ltmain.sh'
glibtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'.
glibtoolize: copying file 'm4/libtool.m4'
glibtoolize: copying file 'm4/ltoptions.m4'
glibtoolize: copying file 'm4/ltsugar.m4'
glibtoolize: copying file 'm4/ltversion.m4'
glibtoolize: copying file 'm4/lt~obsolete.m4'
glibtoolize: Remember to add 'LT_INIT' to configure.ac.
autoreconf: running: /opt/local/bin/autoconf --force
autoreconf: running: /opt/local/bin/autoheader --force
autoreconf: running: /opt/local/bin/automake --add-missing --copy --force-missing
configure.ac:35: installing './compile'
configure.ac:14: installing './missing'
examples/Makefile.am: installing './depcomp'
autoreconf: Leaving directory `.'
$ !./configu
./configure --prefix=/opt/local
checking for a BSD-compatible install... /opt/local/bin/ginstall -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /opt/local/bin/gmkdir -p
checking for gawk... no
checking for mawk... no
checking for nawk... no
checking for awk... awk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-apple-darwin14.5.0
checking host system type... x86_64-apple-darwin14.5.0
checking for gcc... clang
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether clang accepts -g... yes
checking for clang option to accept ISO C89... none needed
checking whether clang understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of clang... gcc3
checking for pkg-config... /opt/local/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking how to run the C preprocessor... clang -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... clang -E
checking whether ln -s works... yes
checking for a sed that does not truncate output... /usr/bin/sed
checking whether make sets $(MAKE)... (cached) yes
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by clang... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld
checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no
checking for BSD- or MS-compatible name lister (nm)... /opt/local/bin/nm
checking the name lister (/opt/local/bin/nm) interface... BSD nm
checking the maximum length of command line arguments... 196608
checking how to convert x86_64-apple-darwin14.5.0 file names to x86_64-apple-darwin14.5.0 format... func_convert_file_noop
checking how to convert x86_64-apple-darwin14.5.0 file names to toolchain format... func_convert_file_noop
checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r
checking for objdump... no
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... no
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /opt/local/bin/nm output from clang object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking for dsymutil... dsymutil
checking for nmedit... nmedit
checking for lipo... lipo
checking for otool... otool
checking for otool64... no
checking for -single_module linker flag... yes
checking for -exported_symbols_list linker flag... yes
checking for -force_load linker flag... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if clang supports -fno-rtti -fno-exceptions... yes
checking for clang option to produce PIC... -fno-common -DPIC
checking if clang PIC flag -fno-common -DPIC works... yes
checking if clang static flag -static works... no
checking if clang supports -c -o file.o... yes
checking if clang supports -c -o file.o... (cached) yes
checking whether the clang linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... darwin14.5.0 dyld
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for windres... no
checking for ANSI C header files... (cached) yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking malloc.h usability... no
checking malloc.h presence... no
checking for malloc.h... no
checking for stdlib.h... (cached) yes
checking for inttypes.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking for dlfcn.h... (cached) yes
checking utmp.h usability... yes
checking utmp.h presence... yes
checking for utmp.h... yes
checking for doxygen... /opt/local/bin/doxygen
checking for library containing dlopen... none required
checking for __register_atfork... no
checking for OPENSSL... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/libp11.pc
config.status: creating src/versioninfo.rc
config.status: creating doc/Makefile
config.status: creating doc/doxygen.conf
config.status: creating examples/Makefile
config.status: creating tests/Makefile
config.status: creating src/config.h
config.status: executing depfiles commands
config.status: executing libtool commands

libp11 has been configured with the following options:


Version:                 0.4.0_git
Libraries:               /opt/local/lib

api doc support:         no

Host:                    x86_64-apple-darwin14.5.0
Compiler:                clang
Preprocessor flags:      
Compiler flags:          -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4 -msse4.2
Linker flags:            
Libraries:               

PTHREAD_FLAGS:           
OPENSSL_CFLAGS:          -I/opt/local/include -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4 -msse4.2
OPENSSL_LIBS:            -L/opt/local/lib -lssl -lcrypto

$ make all && make check
Making all in src
/Applications/Xcode.app/Contents/Developer/usr/bin/make  all-am
  CC       libp11_la-libpkcs11.lo
  CC       libp11_la-p11_attr.lo
  CC       libp11_la-p11_cert.lo
  CC       libp11_la-p11_err.lo
  CC       libp11_la-p11_key.lo
  CC       libp11_la-p11_load.lo
  CC       libp11_la-p11_misc.lo
  CC       libp11_la-p11_ops.lo
  CC       libp11_la-p11_rsa.lo
  CC       libp11_la-p11_ec.lo
  CC       libp11_la-p11_slot.lo
  CC       libp11_la-atfork.lo
  CCLD     libp11.la
Making all in doc
make[1]: Nothing to be done for `all'.
Making all in examples
  CC       auth.o
  CCLD     auth
  CC       decrypt.o
  CCLD     decrypt
  CC       getrandom.o
  CCLD     getrandom
  CC       listkeys.o
  CCLD     listkeys
  CC       rawrsasign.o
rawrsasign.c:198:9: warning: implicit declaration of function 'EVP_MD_CTX_new' is invalid in C99
      [-Wimplicit-function-declaration]
        mctx = EVP_MD_CTX_new();
               ^
rawrsasign.c:198:7: warning: incompatible integer to pointer conversion assigning to 'EVP_MD_CTX *'
      (aka 'struct env_md_ctx_st *') from 'int' [-Wint-conversion]
        mctx = EVP_MD_CTX_new();
             ^ ~~~~~~~~~~~~~~~~
rawrsasign.c:215:2: warning: implicit declaration of function 'EVP_MD_CTX_free' is invalid in C99
      [-Wimplicit-function-declaration]
        EVP_MD_CTX_free(mctx);
        ^
rawrsasign.c:259:7: warning: incompatible integer to pointer conversion assigning to 'EVP_MD_CTX *'
      (aka 'struct env_md_ctx_st *') from 'int' [-Wint-conversion]
        mctx = EVP_MD_CTX_new();
             ^ ~~~~~~~~~~~~~~~~
4 warnings generated.
  CCLD     rawrsasign
Undefined symbols for architecture x86_64:
  "_EVP_MD_CTX_free", referenced from:
      _main in rawrsasign.o
  "_EVP_MD_CTX_new", referenced from:
      _main in rawrsasign.o
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[1]: *** [rawrsasign] Error 1
make: *** [all-recursive] Error 1
$ 

Looks like we've been too aggressive moving towards openssl-1.1, abandoning 1.0.x in the process...?

Also, there's disparity in src/p11_ec.c between lines around 151, and around 355, where different OPENSSL_VERSION_NUMBER values are used as guards for the same update. Should it be 0x10100000L or 0x10100002L? I think it should be consistent throughout?

Compilation Error MacOS X (Yosemite)

p11_key.c:111:13: error: non-void function 'PKCS11_find_key_from_key' should return a value [-Wreturn-type]

build error with OpenSSL 1.0.2d

Hi,

Getting an error when attempting to build libp11 0.3.0 against openssl-1.0.2d:

make all-recursive
make[1]: Entering directory /root/libp11-master' Making all in src make[2]: Entering directory/root/libp11-master/src'
CC libp11_la-p11_ec.lo
p11_ec.c:54:7: warning: #warning "Both BUILD_WITH_ECS_LOCL_H and ECDSA_F_ECDSA_METHOD_NEW defined" [-Wcpp]
#warning "Both BUILD_WITH_ECS_LOCL_H and ECDSA_F_ECDSA_METHOD_NEW defined"
^
p11_ec.c:55:7: warning: #warning "Consider not using BUILD_WITH_ECS_LOCL_H" [-Wcpp]
#warning "Consider not using BUILD_WITH_ECS_LOCL_H"
^
p11_ec.c:59:6: warning: #warning "Consider not using BUILD_WITH_ECS_LOCL_H" [-Wcpp]
#warning "Consider not using BUILD_WITH_ECS_LOCL_H"
^
p11_ec.c:60:6: warning: #warning "newer version of OpenSSL >-1.0.2 does not need BUILD_WITH_ECS_LOCL_H" [-Wcpp]
#warning "newer version of OpenSSL >-1.0.2 does not need BUILD_WITH_ECS_LOCL_H"
^
p11_ec.c:61:26: fatal error: ecs_locl.h: No such file or directory
#include "ecs_locl.h"
^
compilation terminated.
make[2]: *** [libp11_la-p11_ec.lo] Error 1
make[2]: Leaving directory /root/libp11-master/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory/root/libp11-master'
make: *** [all] Error 2

libp11 mistreats public keys, and doesn't allow access to them without login PIN

PKCS11_enumerate_keys() returns anything only if private keys are available to it at the time of call. This breaks the use case when one wants to retrieve the public key from the token and perform "verify" or "encrypt" without having to unlock the token by entering the PIN.

There are work-arounds for this, but the correct solution should be either enumerating all the keys instead of just private keys, or better yet - adding PKCS11_enumerate_pubkeys() function.

It also does not allow direct access to the public keys from OpenSSL (using engine_pkcs11), currently forcing the user to extract the public key first using other tools (like pkcs11-tool or pkcs15-tool from OpenSC) and then run OpenSSL command using the extracted copy of the key rather than the key on the token.

Need an option to specify no PIN is required for login

Some HSM's that I am testing (Thales) with do not require entering a PIN when run with a wrapper command. In this scenario, all the application needs to do is call C_Login with an empty pin. Right now, however, when invoked with an empty pin, libp11 currently blocks on stdin waiting for the user to enter a PIN -- not ideal for a backend server. Can workaround for now by entering a dummy pin, but it would be good to have an openssl engine control command that tells the library not to prompt for a pin.

I'm thinking I would call it NO_PIN or NO_PROMPT_PIN, and would be a "no value" control command like VERBOSE is currently. Does that sound reasonable?

multithreading support in libp11

I am using libp11 and engine_pkcs11 code with openssl to access RSA private key operations with SafeNet HSMs. In multithreaded environment, running into CKR_OPERATION_ACTIVE error with C_SignInit call from pkcs11_private_decrypt.

I see that the CRYPTOKI_call is protected by the CRYPTO_THREAD_write_lock call, but the slot->rwlock member is 0. I see that rwlock is created via CRYPTO_THREAD_lock_new() call which is defined in libp11 code. Why does libp11 define it's own CRYPTO_THREAD_lock_new() instead of using openssl's implementation?

INIT_ARGS engine control command is broken

I am trying to initialize my HSM with threading support enabled, but see no way to do that with the current pkcs11 engine interface. If INIT_ARGS command is not specified at all and is left NULL, then pkcs11_CTX_load calls C_Initialize with NULL. However, if I specify a non-null value for INIT_ARGS, then it assigns that value to pReserved, which the PKCS11 spec specifies should always be NULL_PTR and thus returns with an error.

pkcs11 engine needs a way to set a flag that says "specify empty init args" without needing to set an invalid pReserved value. The reason for needing this is that some libraries (e.g. SoftHSMv2) requires that a non-NULL CK_C_INITIALIZE_ARGS value be passed to enable multi-threading.

Current github master causes Segmentation fault

Needless to say, it worked as late as last Monday. I tested commit f3ae17b, and it was OK.

Now I'm on 14cd0d3

$ openssl version
OpenSSL 1.0.2g  1 Mar 2016
$ openssl rsautl -engine pkcs11 -keyform engine -encrypt -pubin -inkey id_03 -pkcs -out t256.dat.enc -in t256.dat
engine "pkcs11" set.
openssl (lock_dbg_cb): already locked (mode=9, type=30) at eng_init.c:149
Segmentation fault: 11
$

Syslog:

Process:               openssl [10944]
Path:                  /opt/local/bin/openssl
Identifier:            openssl
Version:               0
Code Type:             X86-64 (Native)
Parent Process:        bash [68621]
Responsible:           iTerm [342]
User ID:               501

Date/Time:             2016-03-15 19:37:07.929 -0400
OS Version:            Mac OS X 10.11.3 (15D21)
Report Version:        11
Anonymous UUID:        B3544DF6-AE65-3AD0-0E52-DD6C16797F5A

Sleep/Wake UUID:       1186BD79-2A2E-4A50-9A27-BF002CB25182

Time Awake Since Boot: 470000 seconds
Time Since Wake:       940 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x00000010000000b0

VM Regions Near 0x10000000b0:
    Dispatch continuations 0000000100a00000-0000000101200000 [ 8192K] rw-/rwx SM=PRV  
--> 
    STACK GUARD            0000700000000000-0000700000001000 [    4K] ---/rwx SM=NUL  stack guard for thread 1

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libcrypto.1.0.0.dylib           0x00000001002b7721 ENGINE_finish + 49
1   libcrypto.1.0.0.dylib           0x00000001002d4929 EVP_PKEY_free + 105
2   libp11.2.dylib                  0x000000010065c26e pkcs11_destroy_keys + 78
3   libp11.2.dylib                  0x000000010065e059 pkcs11_release_slot + 153
4   libp11.2.dylib                  0x000000010065ed2b pkcs11_release_all_slots + 43
5   libpkcs11.dylib                 0x0000000100652cb2 pkcs11_finish + 34
6   libpkcs11.dylib                 0x00000001006529ed engine_finish + 109
7   libcrypto.1.0.0.dylib           0x00000001002b75dd engine_unlocked_finish + 109
8   libcrypto.1.0.0.dylib           0x00000001002b83e2 int_cleanup_cb_LHASH_DOALL + 34
9   libcrypto.1.0.0.dylib           0x00000001002c6b7a lh_doall + 74
10  libcrypto.1.0.0.dylib           0x00000001002b8388 engine_table_cleanup + 56
11  libcrypto.1.0.0.dylib           0x00000001002b6aab engine_cleanup_cb_free + 11
12  libcrypto.1.0.0.dylib           0x00000001002c6250 sk_pop_free + 48
13  libcrypto.1.0.0.dylib           0x00000001002b6a8c ENGINE_cleanup + 28
14  openssl                         0x000000010012b782 main + 1122
15  libdyld.dylib                   0x00007fff980135ad start + 1

Thread 1:
0   libsystem_kernel.dylib          0x00007fff8515d6de __workq_kernreturn + 10
1   libsystem_pthread.dylib         0x00007fff85b96729 _pthread_wqthread + 1283
2   libsystem_pthread.dylib         0x00007fff85b94365 start_wqthread + 13

Thread 2:: Dispatch queue: com.apple.libdispatch-manager
0   libsystem_kernel.dylib          0x00007fff8515dff6 kevent_qos + 10
1   libdispatch.dylib               0x00007fff85e37099 _dispatch_mgr_invoke + 216
2   libdispatch.dylib               0x00007fff85e36d01 _dispatch_mgr_thread + 52

Thread 3:
0   libsystem_kernel.dylib          0x00007fff8515d6de __workq_kernreturn + 10
1   libsystem_pthread.dylib         0x00007fff85b96729 _pthread_wqthread + 1283
2   libsystem_pthread.dylib         0x00007fff85b94365 start_wqthread + 13

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x000000000000004a  rbx: 0x0000001000000000  rcx: 0x0000010000000203  rdx: 0x0000020000000200
  rdi: 0x00007fff755031e8  rsi: 0x0000000000012068  rbp: 0x00007fff5fad4a70  rsp: 0x00007fff5fad4a50
   r8: 0x0000000000000040   r9: 0x00007fff755031e0  r10: 0xffffffffffffffff  r11: 0x0000000000000246
  r12: 0x0000000000000000  r13: 0x0000000000000000  r14: 0x00007f8ea160a5d8  r15: 0x00007f8ea1506a70
  rip: 0x00000001002b7721  rfl: 0x0000000000010202  cr2: 0x00000010000000b0

Logical CPU:     2
Error Code:      0x00000006
Trap Number:     14


Binary Images:
       0x10012a000 -        0x100195fff +openssl (0) <8963B755-DE06-351E-A627-4AA2FD07CC7E> /opt/local/bin/openssl
       0x1001b5000 -        0x1001f8fff +libssl.1.0.0.dylib (0) <DEA78E1A-8863-33E3-BF1C-CC861B5B47D2> /opt/local/lib/libssl.1.0.0.dylib
       0x100216000 -        0x10039765f +libcrypto.1.0.0.dylib (0) <66C6C7BD-83F2-3028-87C4-E334EF97A9C7> /opt/local/lib/libcrypto.1.0.0.dylib
       0x100410000 -        0x100420fff +libz.1.dylib (0) <5FCFF38B-5983-3590-B5E9-074CF0950676> /opt/local/lib/libz.1.dylib
       0x100652000 -        0x100655ff7 +libpkcs11.dylib (0) <FCC68CB7-90B9-3722-8C01-711F3749C1CE> /opt/local/lib/*/libpkcs11.dylib
       0x100659000 -        0x100661fff +libp11.2.dylib (0) <848551D4-0AE3-33A1-A367-F10F448D1248> /opt/local/lib/libp11.2.dylib
       0x100666000 -        0x100692ff7 +opensc-pkcs11.so (0) <329E04D7-36BC-3632-99D9-E5CE17DA5475> /Library/OpenSC/*/opensc-pkcs11.so
       0x10069f000 -        0x1008c1ff7 +libopensc.4.dylib (0) <C4E5661F-AA63-3732-967E-E411BF9EA6D1> /Library/OpenSC/*/libopensc.4.dylib
       0x100903000 -        0x100912fff +libgost.dylib (0) <F4F0C018-1BF1-3086-80BF-E429BD54A131> /opt/local/lib/*/libgost.dylib
    0x7fff60b90000 -     0x7fff60bc7007  dyld (360.19) <9D05FDF4-65CE-3B53-86D4-ABE1A5BF35F3> /usr/lib/dyld
    0x7fff83a8e000 -     0x7fff83b05fe7  libcorecrypto.dylib (335.20.1) <C6BD205F-4ECE-37EE-BCAB-A76F39CDCFFA> /usr/lib/system/libcorecrypto.dylib
    0x7fff83e66000 -     0x7fff83e67ffb  libremovefile.dylib (41) <B8D1A5FC-CFD5-3AAB-8A10-14DDC129710A> /usr/lib/system/libremovefile.dylib
    0x7fff8429b000 -     0x7fff8429dff7  libsystem_configuration.dylib (802.20.7) <5FD79070-36CC-3D02-BEA7-BB5D2AE97D5D> /usr/lib/system/libsystem_configuration.dylib
    0x7fff85146000 -     0x7fff85164fff  libsystem_kernel.dylib (3248.30.4) <9CEB6C3B-1CAF-3C32-A9FD-93BC72CBCEA1> /usr/lib/system/libsystem_kernel.dylib
    0x7fff85251000 -     0x7fff8526dff7  libsystem_malloc.dylib (67) <9EECAB18-F025-34C4-8E32-7EFFA6720EFC> /usr/lib/system/libsystem_malloc.dylib
    0x7fff85b93000 -     0x7fff85b9cff7  libsystem_pthread.dylib (138.10.4) <327CECD0-B881-3153-8FCC-4FD4818B7F16> /usr/lib/system/libsystem_pthread.dylib
    0x7fff85e2f000 -     0x7fff85e5cfff  libdispatch.dylib (501.20.1) <324C9189-2AF3-3356-847F-6F4CE1C6E901> /usr/lib/system/libdispatch.dylib
    0x7fff861c8000 -     0x7fff861c9fff  libsystem_blocks.dylib (65) <49D42329-7DE9-3413-92C3-A473A7E9CF35> /usr/lib/system/libsystem_blocks.dylib
    0x7fff86f3a000 -     0x7fff86f63fff  libxpc.dylib (756.20.4) <61AB4610-9304-354C-9E9B-D57198AE9866> /usr/lib/system/libxpc.dylib
    0x7fff886ab000 -     0x7fff888b8ffb  libicucore.A.dylib (551.41) <CFFD7342-A7D6-323A-AC14-B9EECF6EFFED> /usr/lib/libicucore.A.dylib
    0x7fff888b9000 -     0x7fff888caff7  libsystem_trace.dylib (201.10.3) <B485369F-E3A1-319E-998C-89AAF606079E> /usr/lib/system/libsystem_trace.dylib
    0x7fff89165000 -     0x7fff89194ffb  libsystem_m.dylib (3105) <26655445-CA97-321E-B221-801CB378D1AA> /usr/lib/system/libsystem_m.dylib
    0x7fff89440000 -     0x7fff89469fff  libsystem_info.dylib (477.20.1) <6513635B-4ADE-3B45-BF63-ED7AC565B0C9> /usr/lib/system/libsystem_info.dylib
    0x7fff894eb000 -     0x7fff894eeff7  libsystem_sandbox.dylib (460.30.1) <3E0036AF-FC64-3352-8DA4-6B550C2C2562> /usr/lib/system/libsystem_sandbox.dylib
    0x7fff8a370000 -     0x7fff8a378ffb  libsystem_dnssd.dylib (625.20.4) <945B5FB1-DA91-3D45-A961-A8FAD53C1E7E> /usr/lib/system/libsystem_dnssd.dylib
    0x7fff8af69000 -     0x7fff8af69ff7  libkeymgr.dylib (28) <09397E01-6066-3179-A50C-2CE666FDA929> /usr/lib/system/libkeymgr.dylib
    0x7fff8b0b5000 -     0x7fff8b0ccff7  libsystem_asl.dylib (322.30.1) <9B500E4E-E462-321E-828E-5524DC984C1B> /usr/lib/system/libsystem_asl.dylib
    0x7fff8cbb4000 -     0x7fff8cbbfff7  libcommonCrypto.dylib (60075.20.1) <766BC3F5-41F3-3315-BABC-72718A98EA92> /usr/lib/system/libcommonCrypto.dylib
    0x7fff8d336000 -     0x7fff8d347ff7  libz.1.dylib (61.20.1) <B3EBB42F-48E3-3287-9F0D-308E04D407AC> /usr/lib/libz.1.dylib
    0x7fff8d63f000 -     0x7fff8d63fff7  libunc.dylib (29) <1D0F8265-F026-3CBD-93D3-F8DF14FFCE68> /usr/lib/system/libunc.dylib
    0x7fff8df43000 -     0x7fff8df45ff7  libquarantine.dylib (80) <163CF63A-7455-3D1F-AE57-8C4475A9204C> /usr/lib/system/libquarantine.dylib
    0x7fff8df52000 -     0x7fff8e3c8fff  com.apple.CoreFoundation (6.9 - 1256.14) <768A7FB7-9143-3148-8591-7C6ED3162D35> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
    0x7fff8e3c9000 -     0x7fff8e3d1fff  libsystem_networkextension.dylib (385.20.6) <DC8A102A-BF02-31A4-8914-65C34DF6B592> /usr/lib/system/libsystem_networkextension.dylib
    0x7fff8e7bf000 -     0x7fff8e7c7fe7  libsystem_platform.dylib (74.10.3) <D3A27E10-7F08-3603-ACC8-7A92B2C04BAB> /usr/lib/system/libsystem_platform.dylib
    0x7fff8e7c8000 -     0x7fff8e7c9fff  libDiagnosticMessagesClient.dylib (100) <4243B6B4-21E9-355B-9C5A-95A216233B96> /usr/lib/libDiagnosticMessagesClient.dylib
    0x7fff8f1d0000 -     0x7fff8f1dafff  com.apple.pcsc (8.0 - 1) <A6974721-8A6A-361B-8CC5-C57809E1B985> /System/Library/Frameworks/PCSC.framework/Versions/A/PCSC
    0x7fff8fc4e000 -     0x7fff8fc55ff7  libcompiler_rt.dylib (62) <D3C4AB40-23B4-3BC6-8C38-5B8758D14E80> /usr/lib/system/libcompiler_rt.dylib
    0x7fff9159a000 -     0x7fff915b0ff7  libsystem_coretls.dylib (83.20.8) <75C97D88-0A63-3093-AE83-DE33EB7405CE> /usr/lib/system/libsystem_coretls.dylib
    0x7fff916a0000 -     0x7fff916a8fff  libcopyfile.dylib (127) <F5133269-0B22-388C-A57C-079667B6291E> /usr/lib/system/libcopyfile.dylib
    0x7fff91755000 -     0x7fff917b6ff7  libsystem_network.dylib (583.20.10) <865FE79A-A22D-3733-A14F-FC7B37F3AECD> /usr/lib/system/libsystem_network.dylib
    0x7fff917b7000 -     0x7fff91844fff  libsystem_c.dylib (1082.20.4) <EAB38A6C-8671-3B13-B500-90EC1B912063> /usr/lib/system/libsystem_c.dylib
    0x7fff91b22000 -     0x7fff91b24fff  libsystem_coreservices.dylib (19.2) <1B3F5AFC-FFCD-3ECB-8B9A-5538366FB20D> /usr/lib/system/libsystem_coreservices.dylib
    0x7fff91e79000 -     0x7fff91e7dfff  libcache.dylib (75) <6B245C0A-F3EA-383B-A542-5B0D0456A41B> /usr/lib/system/libcache.dylib
    0x7fff9394e000 -     0x7fff93cb0f3f  libobjc.A.dylib (680) <9F45830D-F1D5-3CDF-9461-1A5477ED7D1E> /usr/lib/libobjc.A.dylib
    0x7fff958ff000 -     0x7fff95952ff7  libc++.1.dylib (120.1) <8FC3D139-8055-3498-9AC5-6467CB7F4D14> /usr/lib/libc++.1.dylib
    0x7fff95b3a000 -     0x7fff95b3fff3  libunwind.dylib (35.3) <124E0F05-2350-3774-A32C-7F5BF38EDE73> /usr/lib/system/libunwind.dylib
    0x7fff9615f000 -     0x7fff96188fff  libc++abi.dylib (125) <DCCC8177-3D09-35BC-9784-2A04FEC4C71B> /usr/lib/libc++abi.dylib
    0x7fff97bbf000 -     0x7fff97bc4ff7  libmacho.dylib (875.1) <CB745E1F-4885-3F96-B38B-2093DF488FD5> /usr/lib/system/libmacho.dylib
    0x7fff97db8000 -     0x7fff97dfeff7  libauto.dylib (186) <999E610F-41FC-32A3-ADCA-5EC049B65DFB> /usr/lib/libauto.dylib
    0x7fff98010000 -     0x7fff98013ffb  libdyld.dylib (360.19) <AA629043-C6F6-32FE-8007-E3478E99ACA7> /usr/lib/system/libdyld.dylib
    0x7fff9833a000 -     0x7fff9833bffb  libSystem.B.dylib (1226.10.1) <5A4257EF-3145-3BB3-87A4-0D2404A9462D> /usr/lib/libSystem.B.dylib
    0x7fff98e64000 -     0x7fff98e6dff3  libsystem_notify.dylib (150.20.3) <243FADE1-255A-3B78-8033-F336CD64B817> /usr/lib/system/libsystem_notify.dylib
    0x7fff994dc000 -     0x7fff994ddfff  libsystem_secinit.dylib (20) <FD6ECF2C-1489-32CA-981B-9045B5EB1FAA> /usr/lib/system/libsystem_secinit.dylib
    0x7fff9950f000 -     0x7fff9950fff7  liblaunch.dylib (756.20.4) <EDF719D6-D2BB-38DD-8C94-4272BEFDA2CD> /usr/lib/system/liblaunch.dylib

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 1
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 30723232
    thread_create: 0
    thread_set_state: 30

VM Region Summary:
ReadOnly portion of Libraries: Total=110.5M resident=0K(0%) swapped_out_or_unallocated=110.5M(100%)
Writable regions: Total=55.5M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=55.5M(100%)

                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
Activity Tracing                  2048K        2 
Dispatch continuations            8192K        2 
Kernel Alloc Once                    4K        2 
MALLOC                            36.2M        8 
MALLOC guard page                   16K        4 
STACK GUARD                       56.0M        5 
Stack                             9304K        5 
VM_ALLOCATE                         20K        3 
__DATA                            3244K       58 
__LINKEDIT                        91.7M       12 
__TEXT                            18.8M       55 
__UNICODE                          552K        2 
shared memory                       12K        4 
===========                     =======  ======= 
TOTAL                            225.5M      149 

opens-debug.log at debug=9:

.........
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473745920: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:358:C_FindObjectsInit: Object with handle 0x7febe3c339b0
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473744976: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:358:C_FindObjectsInit: Object with handle 0x7febe3c33b30
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473744592: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:358:C_FindObjectsInit: Object with handle 0x7febe3c33b90
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473744496: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:358:C_FindObjectsInit: Object with handle 0x7febe3c33bf0
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473744400: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:358:C_FindObjectsInit: Object with handle 0x7febe3c33c50
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473744304: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:358:C_FindObjectsInit: Object with handle 0x7febe3c33cb0
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:4087:pkcs15_dobj_get_attribute: pkcs15_dobj_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:377:C_FindObjectsInit: Object 0/-473744208: Attribute 0x0 does NOT match.
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:406:C_FindObjectsInit: 4 matching objects
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] misc.c:276:session_get_operation: called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260752: CKA_KEY_TYPE = CKK_RSA
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32b50) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260752: CKA_LABEL = <size inquiry>
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32b50) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260752: CKA_LABEL = PIV AUTH pubkey
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32b50) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260752: CKA_ID = <size inquiry>
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32b50) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260752: CKA_ID = 01
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32b50) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260752: CKA_ID = 01
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32b50) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] misc.c:276:session_get_operation: called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260848: CKA_KEY_TYPE = CKK_RSA
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32bb0) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260848: CKA_LABEL = <size inquiry>
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32bb0) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260848: CKA_LABEL = SIGN pubkey
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32bb0) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260848: CKA_ID = <size inquiry>
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32bb0) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260848: CKA_ID = 02
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32bb0) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260848: CKA_ID = 02
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32bb0) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] misc.c:276:session_get_operation: called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_KEY_TYPE = CKK_RSA
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_LABEL = <size inquiry>
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.998 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_LABEL = KEY MAN pubkey
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_ID = <size inquiry>
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_ID = 03
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_ID = 03
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] misc.c:276:session_get_operation: called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115261040: CKA_KEY_TYPE = CKK_RSA
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c70) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115261040: CKA_LABEL = <size inquiry>
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c70) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115261040: CKA_LABEL = CARD AUTH pubkey
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c70) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115261040: CKA_ID = <size inquiry>
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c70) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115261040: CKA_ID = 04
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c70) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115261040: CKA_ID = 04
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c70) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] misc.c:276:session_get_operation: called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] misc.c:276:session_get_operation: called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:59:sc_find_release: freeing 32 handles used 4  at 0x7febe3d09b70
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_MODULUS = <size inquiry>
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_MODULUS = AB9BF41C92FD23DE9DDF82EB50BA377E3A7EA3EC5DFD8252A0D79668B521E94E
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_PUBLIC_EXPONENT = <size inquiry>
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] framework-pkcs15.c:3824:pkcs15_pubkey_get_attribute: pkcs15_pubkey_get_attribute() called
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:237:C_GetAttributeValue: Object 140651115260944: CKA_PUBLIC_EXPONENT = 010001
0x7fff739f3000 19:40:19.999 [opensc-pkcs11] pkcs11-object.c:259:C_GetAttributeValue: C_GetAttributeValue(hSession=0x7febe3d09ac0, hObject=0x7febe3c32c10) = CKR_OK
0x7fff739f3000 19:40:20.001 [opensc-pkcs11] pkcs11-session.c:164:C_CloseAllSessions: C_CloseAllSessions(0x0)
0x7fff739f3000 19:40:20.001 [opensc-pkcs11] slot.c:397:slot_get_token: Slot(id=0x0): get token
0x7fff739f3000 19:40:20.001 [opensc-pkcs11] slot.c:415:slot_get_token: Slot-get-token returns OK
0x7fff739f3000 19:40:20.001 [opensc-pkcs11] pkcs11-session.c:129:sc_pkcs11_close_all_sessions: real C_CloseAllSessions(0x0) 1
0x7fff739f3000 19:40:20.001 [opensc-pkcs11] pkcs11-session.c:98:sc_pkcs11_close_session: real C_CloseSession(0x7febe3d09ac0)

latest master does not compile with the latest 1.1-pre4?

$ git pull
remote: Counting objects: 34, done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 34 (delta 23), reused 23 (delta 23), pack-reused 7
Unpacking objects: 100% (34/34), done.
From https://github.com/mouse07410/libp11
   70a0087..ebb474e  master     -> origin/master
Merge made by the 'recursive' strategy.
 NEWS          |   8 ++++-
 src/p11_ec.c  |   5 +--
 src/p11_rsa.c | 181 ++++++++++++++++++++++++++++++++++++++++---------------------------------------------------------------
 3 files changed, 80 insertions(+), 114 deletions(-)
$ git fetch upstream
From https://github.com/OpenSC/libp11
   85fc97a..eea3700  master     -> upstream/master
$ git merge upstream/master
Already up-to-date.
$ git push
Counting objects: 9, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (9/9), done.
Writing objects: 100% (9/9), 1.20 KiB | 0 bytes/s, done.
Total 9 (delta 5), reused 0 (delta 0)
To https://github.com/mouse07410/libp11.git
   ebb474e..e883dbe  master -> master
$ OPENSSL_CFLAGS="-I/Users/ur20980/src/openssl-1.1/include" OPENSSL_LIBS="-L/Users/ur20980/src/openssl-1.1/lib -lssl -lcrypto"  ./configure --prefix=/Users/ur20980/src/openssl-1.1 --with-pkcs11-module="/Library/OpenSC/lib/opensc-pkcs11.so" --with-enginesdir=/Users/ur20980/src/openssl-1.1/lib/engines
checking for a BSD-compatible install... /opt/local/bin/ginstall -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /opt/local/bin/gmkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-apple-darwin14.5.0
checking host system type... x86_64-apple-darwin14.5.0
checking for gcc... clang
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether clang accepts -g... yes
checking for clang option to accept ISO C89... none needed
checking whether clang understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of clang... gcc3
checking for pkg-config... /opt/local/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking how to run the C preprocessor... clang -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... clang -E
checking whether ln -s works... yes
checking for a sed that does not truncate output... /usr/bin/sed
checking whether make sets $(MAKE)... (cached) yes
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by clang... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld
checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no
checking for BSD- or MS-compatible name lister (nm)... /opt/local/bin/nm
checking the name lister (/opt/local/bin/nm) interface... BSD nm
checking the maximum length of command line arguments... 196608
checking how to convert x86_64-apple-darwin14.5.0 file names to x86_64-apple-darwin14.5.0 format... func_convert_file_noop
checking how to convert x86_64-apple-darwin14.5.0 file names to toolchain format... func_convert_file_noop
checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r
checking for objdump... no
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... no
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /opt/local/bin/nm output from clang object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking for dsymutil... dsymutil
checking for nmedit... nmedit
checking for lipo... lipo
checking for otool... otool
checking for otool64... no
checking for -single_module linker flag... yes
checking for -exported_symbols_list linker flag... yes
checking for -force_load linker flag... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if clang supports -fno-rtti -fno-exceptions... yes
checking for clang option to produce PIC... -fno-common -DPIC
checking if clang PIC flag -fno-common -DPIC works... yes
checking if clang static flag -static works... no
checking if clang supports -c -o file.o... yes
checking if clang supports -c -o file.o... (cached) yes
checking whether the clang linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... darwin14.5.0 dyld
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for windres... no
checking for ANSI C header files... (cached) yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking malloc.h usability... no
checking malloc.h presence... no
checking for malloc.h... no
checking for stdlib.h... (cached) yes
checking for inttypes.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking for dlfcn.h... (cached) yes
checking utmp.h usability... yes
checking utmp.h presence... yes
checking for utmp.h... yes
checking for doxygen... /opt/local/bin/doxygen
checking for library containing dlopen... none required
checking for __register_atfork... no
checking for OPENSSL... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/libp11.pc
config.status: creating src/libp11.rc
config.status: creating src/pkcs11.rc
config.status: creating doc/Makefile
config.status: creating doc/doxygen.conf
config.status: creating examples/Makefile
config.status: creating tests/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands

libp11 has been configured with the following options:

Version:                 0.4.0_git
libp11 directory:        /Users/ur20980/src/openssl-1.1/lib
Engine directory:        /Users/ur20980/src/openssl-1.1/lib/engines
Default PKCS11 module:   /Library/OpenSC/lib/opensc-pkcs11.so
API doc support:         no

Host:                    x86_64-apple-darwin14.5.0
Compiler:                clang
Preprocessor flags:      
Compiler flags:          -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4 -msse4.2
Linker flags:            
Libraries:               

OPENSSL_CFLAGS:          -I/Users/ur20980/src/openssl-1.1/include
OPENSSL_LIBS:            -L/Users/ur20980/src/openssl-1.1/lib -lssl -lcrypto

$ make all && make check
Making all in src
/Applications/Xcode.app/Contents/Developer/usr/bin/make  all-am
  CC       pkcs11_la-eng_front.lo
  CC       pkcs11_la-eng_back.lo
  CC       pkcs11_la-eng_parse.lo
  CC       libp11_la-libpkcs11.lo
  CC       libp11_la-p11_attr.lo
  CC       libp11_la-p11_cert.lo
p11_cert.c:50:3: warning: implicit declaration of function 'CRYPTO_lock' is invalid in C99 [-Wimplicit-function-declaration]
                pkcs11_w_lock(cpriv->lockid);
                ^
./libp11-int.h:142:11: note: expanded from macro 'pkcs11_w_lock'
        if(type) CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
                 ^
p11_cert.c:50:3: error: use of undeclared identifier 'CRYPTO_LOCK'
./libp11-int.h:142:23: note: expanded from macro 'pkcs11_w_lock'
        if(type) CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
                             ^
p11_cert.c:50:3: error: use of undeclared identifier 'CRYPTO_WRITE'
./libp11-int.h:142:35: note: expanded from macro 'pkcs11_w_lock'
        if(type) CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
                                         ^
p11_cert.c:52:3: error: use of undeclared identifier 'CRYPTO_UNLOCK'
                pkcs11_w_unlock(cpriv->lockid);
                ^
./libp11-int.h:144:23: note: expanded from macro 'pkcs11_w_unlock'
        if(type) CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
                             ^
p11_cert.c:52:3: error: use of undeclared identifier 'CRYPTO_WRITE'
./libp11-int.h:144:37: note: expanded from macro 'pkcs11_w_unlock'
        if(type) CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
                                           ^
1 warning and 4 errors generated.
make[2]: *** [libp11_la-p11_cert.lo] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
$ 

Destroying valid sessions

Trying to access a non existing object results in all sessions to the token getting closed.

https://github.com/OpenSC/libp11/blob/master/src/p11_slot.c#L331

PKCS11_release_all_slots
pkcs11_release_slot
CRYPTOKI_call(ctx, C_CloseAllSessions(priv->id));

Closing only the current session as proposed here commonism@86a9429 (part of #7) is proposed therefore.

Loading multiple keys invalidates previous key references

I am able to reproduce this extremely consistently. I am loading pkcs11.so dynamically in my application and registering as an OpenSSL engine, then using the openssl engine interface to load the keys and sign stuff with it. Everything works splendidly until I load a key twice.

1. Generate an EC key inside HSM (testing with SoftHSMv2, with secp112r1 EC key)
2. Initialize pkcs11 as OpenSSL engine
3. Load the key: EVP_PKEY* key1 = ENGINE_load_private_key(...)
4. Load the key again: EVP_PKEY* key2 = ENGINE_load_private_key(...)
5. Start thread1 which uses key1 to sign something
6. Start thread2 which uses key2 to sign something

thread1 seems to consistently setgfault inside pkcs11.so when exercised in this pattern. If threads are taken out of the equation and the above steps are run synchronously, the behavior is (strangely) less predictable but still mostly fails -- sometimes a segfault, sometimes an OpenSSL error, sometimes it works fine. The segfault is always on the KEY2SLOT(key) call inside pkcs11_ecdsa_sign, due to the key->_private member being invalid.

The failure appears to be due to the pkcs11_login call inside pkcs11_load_key, which results in the reset of some global state, including destroying keys libp11 knows about for that slot.

It looks like the loading of key2 in between the loading and the use of key1 has caused libp11 to forgot about key1 in that the internal data that was stored on the EVP_PKEY was deleted or something. This is where my understanding of the problem comes short.

I have tested modifying pkcs11_load_key to only login if not already logged in (using PKCS11_is_logged_in). Avoid the unneeded login fixes the above use case for me. I can post that as a PR if it is something you would like to take upstream. But I wonder if that doesn't really solve the heart of the issue. My fear is that there may be other places where some global state gets reset and other key references become invalidated.

If that is indeed the case, then I would not have confidence that any key reference I have is still valid and hasn't been invalidated by some other thread.

Questions:

• Is the above usage pattern expected to be supported by libp11?
• Is the above concern about global state being reset in some other way a valid fear?
• Are long-standing key references not a good idea based on the internal design of libp11?

pkcs11_get_ec() assumes DER encodig of pubkeys - fix proposed

Apparently due to some misconception, pkcs11_get_ec() assumes that the PCKS#11 device returns EC_POINT data of public keys in ASN.1 encoding. At least my CardOS v5.0 test card does not work this way, and I suspect that also other cards return plain binary data instead.

In my fix given both as attachment: p11_ec_point_no_asn1.patch.txt and in my pull request #80
I improve error handling and disable that part of the code in pkcs11_get_ec() used to convert from ASN.1 (by using #ifdef PKCS11_EC_POINT_ASN1).

Generate keys on the token

libp11 currently generates keys in software and then stores them on the PKCS#11 hardware.
This is potentially less secure than generating the keys directly on the device.

request to support RSA OAEP padding

The title says it all: it would be great if libp11 (p11_rsa.c and p11_ops.c in particular) could support RSA_PKCS1_OAEP_PADDING in addition to RSA_PKCS1_PADDING.

Support CKU_CONTEXT_SPECIFIC PINs

Currently, if I understand correctly, there are two ways to specify a PIN for a key using pkcs11 engine:

1. Setting the PIN global engine configuration
2. Setting the pin-value on the pkcs11 key URI

This is rather limiting for a situation where one may want to support loading several different keys, each perhaps coming from different slots, each with different passwords. I don't really feel comfortable putting the pin value on the key URI since this is something likely to get printed out to the screen or logged. Setting the global PIN is also not super ideal, since then the application loses control over the lifetime of the PIN living in memory as plain text.

What if libp11 instead offered a configuration option for a PIN_CALLBACK - a function that libp11 would call to grab the pin from the application as a const char*, which it could feed directly into C_Login and not have to manage the lifetime of at all? Seems like this would accomplish both the multiple PIN problem and the password-in-memory problem.

atfork handler breaks engine initialization

Commit ecb83da breaks applications that fork after engine initialization. Unless "foreground = yes" is specified in stunnel.conf, stunnel returns the following errors:

[0]: error queue: 14179006: error:14179006:SSL routines:tls_construct_server_key_exchange:EVP lib
[0]: SSL_accept: 80004003: error:80004003:PKCS11 library:PKCS11_open_session:Invalid slot ID
[1]: error queue: 14179006: error:14179006:SSL routines:tls_construct_server_key_exchange:EVP lib
[1]: error queue: 800280B3: error:800280B3:PKCS11 library:PKCS11_get_attribute:Session handle invalid
[1]: SSL_accept: 800060B3: error:800060B3:PKCS11 library:PKCS11_enum_keys:Session handle invalid
[2]: error queue: 14179006: error:14179006:SSL routines:tls_construct_server_key_exchange:EVP lib
[2]: SSL_accept: 800280B3: error:800280B3:PKCS11 library:PKCS11_get_attribute:Session handle invalid
[3]: error queue: 14179006: error:14179006:SSL routines:tls_construct_server_key_exchange:EVP lib
[3]: SSL_accept: 800280B3: error:800280B3:PKCS11 library:PKCS11_get_attribute:Session handle invalid
...

Commenting out the attempted context reloading in the PKCS11_CTX_reload() function fixes the problem.

"make check" fails with openssl-1.1-pre4?

Mac OS X 10.10.5, Xcode-7.2.1.

$ OPENSSL_CFLAGS="-I/Users/ur20980/include" OPENSSL_LIBS="-L/Users/ur20980/lib -lssl -lcrypto" ./configure --prefix=/Users/ur20980 --with-pkcs11-module="/Library/OpenSC/lib/opensc-pkcs11.so" --with-enginesdir=/Users/ur20980/lib/engines
checking for a BSD-compatible install... /opt/local/bin/ginstall -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /opt/local/bin/gmkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-apple-darwin14.5.0
checking host system type... x86_64-apple-darwin14.5.0
checking for gcc... clang
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether clang accepts -g... yes
checking for clang option to accept ISO C89... none needed
checking whether clang understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of clang... gcc3
checking for pkg-config... /opt/local/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking how to run the C preprocessor... clang -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... clang -E
checking whether ln -s works... yes
checking for a sed that does not truncate output... /usr/bin/sed
checking whether make sets $(MAKE)... (cached) yes
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by clang... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld
checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no
checking for BSD- or MS-compatible name lister (nm)... /opt/local/bin/nm
checking the name lister (/opt/local/bin/nm) interface... BSD nm
checking the maximum length of command line arguments... 196608
checking how to convert x86_64-apple-darwin14.5.0 file names to x86_64-apple-darwin14.5.0 format... func_convert_file_noop
checking how to convert x86_64-apple-darwin14.5.0 file names to toolchain format... func_convert_file_noop
checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r
checking for objdump... no
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... no
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /opt/local/bin/nm output from clang object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking for dsymutil... dsymutil
checking for nmedit... nmedit
checking for lipo... lipo
checking for otool... otool
checking for otool64... no
checking for -single_module linker flag... yes
checking for -exported_symbols_list linker flag... yes
checking for -force_load linker flag... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if clang supports -fno-rtti -fno-exceptions... yes
checking for clang option to produce PIC... -fno-common -DPIC
checking if clang PIC flag -fno-common -DPIC works... yes
checking if clang static flag -static works... no
checking if clang supports -c -o file.o... yes
checking if clang supports -c -o file.o... (cached) yes
checking whether the clang linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... darwin14.5.0 dyld
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for windres... no
checking for ANSI C header files... (cached) yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking malloc.h usability... no
checking malloc.h presence... no
checking for malloc.h... no
checking for stdlib.h... (cached) yes
checking for inttypes.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking for dlfcn.h... (cached) yes
checking utmp.h usability... yes
checking utmp.h presence... yes
checking for utmp.h... yes
checking for doxygen... doxygen
checking for library containing dlopen... none required
checking for __register_atfork... no
checking for OPENSSL... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/libp11.pc
config.status: creating src/libp11.rc
config.status: creating src/pkcs11.rc
config.status: creating doc/Makefile
config.status: creating doc/doxygen.conf
config.status: creating examples/Makefile
config.status: creating tests/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands

libp11 has been configured with the following options:

Version:                 0.4.0_git
libp11 directory:        /Users/ur20980/lib
Engine directory:        /Users/ur20980/lib/engines
Default PKCS11 module:   /Library/OpenSC/lib/opensc-pkcs11.so
API doc support:         no

Host:                    x86_64-apple-darwin14.5.0
Compiler:                clang
Preprocessor flags:      
Compiler flags:          -maes -mpclmul -msse2 -mssse3 -msse4 -msse4.2 -mrdrnd -mrdseed
Linker flags:            
Libraries:               

OPENSSL_CFLAGS:          -I/Users/ur20980/include
OPENSSL_LIBS:            -L/Users/ur20980/lib -lssl -lcrypto

$ make clean && make all && make check
......... <uneventful stuff> .........
/Applications/Xcode.app/Contents/Developer/usr/bin/make  check-TESTS
PASS: rsa-testpkcs11.softhsm
PASS: rsa-testfork.softhsm
PASS: rsa-testlistkeys.softhsm
FAIL: rsa-evp-sign.softhsm
PASS: ec-testfork.softhsm
============================================================================
Testsuite summary for libp11 0.4.0_git
============================================================================
# TOTAL: 5
# PASS:  4
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0
============================================================================
See tests/test-suite.log
============================================================================
make[3]: *** [test-suite.log] Error 1
make[2]: *** [check-TESTS] Error 2
make[1]: *** [check-am] Error 2
make: *** [check-recursive] Error 1
$ cat tests/test-suite.log 
============================================
   libp11 0.4.0_git: tests/test-suite.log
============================================

# TOTAL: 5
# PASS:  4
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: rsa-evp-sign.softhsm
==========================

Current directory: /Users/ur20980/src/libp11-1.1/tests
Source directory: .
Output directory: output.18886
-n * Initializing smart card... 
ok
Using slot 0 with a present token (0x0)
Using slot 0 with a present token (0x0)
Using slot 0 with a present token (0x0)
***************
Listing objects
***************
Using slot 0 with a present token (0x0)
Private Key Object; RSA 
  label:      server-key
  ID:         00010203
  Usage:      decrypt, sign, unwrap
Certificate Object, type = X.509 cert
  label:      server-key
  ID:         00010203
Public Key Object; RSA 2048 bits
  label:      server-key
  ID:         00010203
  Usage:      encrypt, verify, wrap
At main.c:193:
- SSL error:25066067:DSO support routines:dlfcn_load:could not load the shared library: crypto/dso/dso_dlfcn.c:172
- SSL error:25070067:DSO support routines:DSO_load:could not load the shared library: crypto/dso/dso_lib.c:220
- SSL error:260B6084:engine routines:dynamic_load:dso not found: crypto/engine/eng_dyn.c:456
- SSL error:2606A074:engine routines:ENGINE_by_id:no such engine: crypto/engine/eng_list.c:372
Basic PKCS #11 test, using ctrl failed
FAIL rsa-evp-sign.softhsm (exit status: 1)

$ 

SoftHSMv2 has been installed in /opt/local from today's Github. Worth noting that SoftHSMv2 has been built against OpenSSL-1.0.2f. Running make check in libp11 configured for OpenSSL-1.0.2 works fine:

......
/Applications/Xcode.app/Contents/Developer/usr/bin/make  check-TESTS
PASS: rsa-testpkcs11.softhsm
PASS: rsa-testfork.softhsm
PASS: rsa-testlistkeys.softhsm
PASS: rsa-evp-sign.softhsm
PASS: ec-testfork.softhsm
============================================================================
Testsuite summary for libp11 0.4.0_git
============================================================================
# TOTAL: 5
# PASS:  5
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
============

SEGV with EC key

On Fedora 24 using the packaged versions of OpenSSL (1.0.2h) and libp11 (0.3.0).
I have added some certificate torture tests to OpenConnect and they fail with EC keys:

Found 3 certs in slot 'SoftHSM slot 0'
Using PKCS#11 certificate pkcs11:token=openconnect-test;id=%03
Found 0 keys in slot 'SoftHSM slot 0'
Logging in to PKCS#11 slot 'SoftHSM slot 0'
Logged in to PKCS#11 slot 'SoftHSM slot 0'
Found 2 keys in slot 'SoftHSM slot 0'
Using PKCS#11 key pkcs11:token=openconnect-test;id=%03

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5d77888 in EC_POINT_cmp (group=0x6dd670, a=0x6dc030, b=0x0, ctx=0x0)
    at ec_lib.c:1001
1001        if ((group->meth != a->meth) || (a->meth != b->meth)) {
Missing separate debuginfos, use: dnf debuginfo-install gnome-keyring-3.20.0-1.fc24.x86_64 libp11-0.3.0-2.fc24.x86_64 libpskc-2.6.1-2.fc24.x86_64 libtool-ltdl-2.4.6-11.fc24.x86_64 libxslt-1.1.28-12.fc24.x86_64 xmlsec1-1.2.20-3.fc24.x86_64
(gdb) bt
#0  0x00007ffff5d77888 in EC_POINT_cmp (group=0x6dd670, a=0x6dc030, b=0x0, 
    ctx=0x0) at ec_lib.c:1001
#1  0x00007ffff5d81a0c in eckey_pub_cmp (a=<optimized out>, b=0x6d6e20)
    at ec_ameth.c:224
#2  0x00007ffff5df5fb1 in X509_check_private_key (x=<optimized out>, 
    k=k@entry=0x6d6e20) at x509_cmp.c:333
#3  0x00007ffff6144a00 in ssl_set_pkey (c=0x6496b0, pkey=0x6d6e20)
    at ssl_rsa.c:223
#4  0x00007ffff6145c96 in SSL_CTX_use_PrivateKey (ctx=<optimized out>, 
    pkey=<optimized out>) at ssl_rsa.c:616
#5  0x00007ffff7bba3b1 in load_pkcs11_key (vpninfo=vpninfo@entry=0x643a70)
    at ../openssl-pkcs11.c:574
#6  0x00007ffff7bb7fdb in load_certificate (vpninfo=0x643a70)
    at ../openssl.c:889
#7  openconnect_open_https (vpninfo=vpninfo@entry=0x643a70)
    at ../openssl.c:1633
#8  0x00007ffff7b9bc08 in do_https_request (vpninfo=vpninfo@entry=0x643a70, 
    method=method@entry=0x7ffff7bbde11 "POST", 
    request_body_type=request_body_type@entry=0x7ffff7bbe2a8 "application/x-www-form-urlencoded", request_body=request_body@entry=0x644630, 
    form_buf=form_buf@entry=0x7fffffffdb70, 
    fetch_redirect=fetch_redirect@entry=0) at ../http.c:875
#9  0x00007ffff7bac91f in cstp_obtain_cookie (vpninfo=<optimized out>)

problem with tests/evp-sign.c

@mtrojnar very possibly (likely) this is not a libp11 bug (and I posted it to openssl-users list). Especially since all the tests run by make check pass fine (with the current release of SoftHSMv2). Also, my shell scripts that use openssl CLI for all the operations on the token, all work fine.

Still, it might be somehow related, and I'd love some guidance/help in any case.

I am trying to write code that uses OpenSSL EVP to sign/verify and/or encrypt/decrypt stuff. My code works when I use functions defined in openssl/apps/apps.c, but fails when I try to use EVP methods directly.

So I tried to run tests/.libs/evp-sign (since it presumably makes the EVP calls correctly and in the right sequence, and it's been proven to work at least with SoftHSMv2) to sanity-check. When I try tests/.libs/evp-sign on my RSA hardware token, it fails:

$ tests/.libs/evp-sign default xxxxxxxx /opt/local/etc/openssl/openssl.cnf "pkcs11:object=SIGN%20key;object-type=private" "pkcs11:object=SIGN%20pubkey;object-type=public" /Library/OpenSC/lib/opensc-pkcs11.dylib 
At main.c:261:
- SSL error:FFFFFFFF8000A001:Vendor defined:PKCS11_rsa_sign:Cancel: p11_rsa.c:148
$ tests/.libs/evp-sign ctrl xxxxxxxx /opt/local/etc/openssl/openssl.cnf "pkcs11:object=SIGN%20key;object-type=private" "pkcs11:object=SIGN%20pubkey;object-type=public" /Library/OpenSC/lib/opensc-pkcs11.dylib 
At main.c:261:
- SSL error:FFFFFFFF8000A001:Vendor defined:PKCS11_rsa_sign:Cancel: p11_rsa.c:148
$

In both cases the opensc-debug.log shows authentication problem:

......
 [opensc-pkcs11] reader-pcsc.c:389:pcsc_detect_card_presence: returning with: 5
 [opensc-pkcs11] sec.c:206:sc_pin_cmd: returning with: 0 (Success)
 [opensc-pkcs11] card-piv.c:2221:piv_set_security_env: called
 [opensc-pkcs11] card-piv.c:2252:piv_set_security_env: returning with: 0 (Success
)
 [opensc-pkcs11] sec.c:72:sc_set_security_env: returning with: 0 (Success)
 [opensc-pkcs11] card-piv.c:2352:piv_compute_signature: called
 [opensc-pkcs11] card-piv.c:2281:piv_validate_general_authentication: called
 [opensc-pkcs11] card-piv.c:454:piv_general_io: called
 [opensc-pkcs11] card-piv.c:2410:piv_compute_signature: returning with: -1211 (Security status not satisfied)
 [opensc-pkcs11] sec.c:58:sc_compute_signature: returning with: -1211 (Security status not satisfied)
 [opensc-pkcs11] card-piv.c:2221:piv_set_security_env: called
 [opensc-pkcs11] card-piv.c:2252:piv_set_security_env: returning with: 0 (Success)
 [opensc-pkcs11] sec.c:72:sc_set_security_env: returning with: 0 (Success)
......

There is no record of successful authentication. My code uses encrypt/decrypt, but the failure is the same, and in a similar place. evp-sign fails in pkcs11_private_encrypt() (to sign with a private key, an operation that requires PIN-unlock), and my code fails in `pkcs11_private_decrypt() (again, an operation with a private key that requires unlock)...

For comparison, here's what in the log when I use my code linked with compiled apps.c (and libcrypto, of course):

 [opensc-pkcs11] reader-pcsc.c:389:pcsc_detect_card_presence: returning with: 5
 [opensc-pkcs11] sec.c:206:sc_pin_cmd: returning with: 0 (Success)
 [opensc-pkcs11] sec.c:206:sc_pin_cmd: returning with: 0 (Success)
 [opensc-pkcs11] card-piv.c:2221:piv_set_security_env: called
 [opensc-pkcs11] card-piv.c:2252:piv_set_security_env: returning with: 0 (Success)
 [opensc-pkcs11] sec.c:72:sc_set_security_env: returning with: 0 (Success)
 [opensc-pkcs11] card-piv.c:2417:piv_decipher: called
 [opensc-pkcs11] card-piv.c:2281:piv_validate_general_authentication: called
 [opensc-pkcs11] card-piv.c:454:piv_general_io: called
 [opensc-pkcs11] card-piv.c:2419:piv_decipher: returning with: 256
 [opensc-pkcs11] sec.c:44:sc_decipher: returning with: 256
 [opensc-pkcs11] card-piv.c:2819:piv_finish: called
 [opensc-pkcs11] ctx.c:818:sc_release_context: called

In case it helps, here's the offending code:

int unwrap(const unsigned char *in, const size_t inlen, unsigned char **out, size_t *olen, ENGINE **e) {
    int rv = -1;
    EVP_PKEY *privkey = NULL;
    EVP_PKEY_CTX *ctx = NULL;
    PW_CB_DATA cb_data;
    char *key_pass = NULL;

    cb_data.password = NULL;
    cb_data.prompt_info = "pkcs11:object=KEY%20MAN%20key;object-type=private";

    setup_ui();

    ui_method = ui_console_with_default;
    ui_extra = key_pass;

    /* Load engine */
    if (*e == NULL) {
        *e = load_engine("pkcs11");
        if (*e == NULL) {
            fprintf(stderr, "unwrap: failed to instantiate pkcs11 engine\n");
            goto end;
        }
    }

    privkey = ENGINE_load_private_key(*e, "id_03", ui_method, ui_extra);
    if (privkey == NULL) {
        fprintf(stderr, "unwrap: failed to get handle to privkey id_03\n");
        goto end;
    }
    printf("unwrap: loaded privkey of size %1d\n", EVP_PKEY_size(privkey));

    /* Create context */
    ctx = EVP_PKEY_CTX_new(privkey, NULL);
    EVP_PKEY_free(privkey);
    if (ctx == NULL) {
        fprintf(stderr, "unwrap: failed to create context\n");
        goto end;
    }
    rv = EVP_PKEY_decrypt_init(ctx);
    EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING);
    if (rv <= 0) {
        fprintf(stderr, "unwrap: failed to initialize decrypt_ctx (rv=%d\n", rv);
        goto end;
    }

    /* Unwrap the encrypted key */
    *olen = 0;
    rv = EVP_PKEY_decrypt(ctx, NULL, olen, in, inlen);
    if ((rv <= 0) || (*olen == 0)) {
        fprintf(stderr, "unwrap: failed to get required output buf len (rv=%d)\n", rv);
        goto end;
    }
    printf("unwrap: allocating %1lu bytes...\n", *olen);
    *out = OPENSSL_malloc(*olen);
    if (*out == NULL) {
        fprintf(stderr, "unwrap: failed to allocate output buf (%1lu bytes)\n", *olen);
        rv = -1;
        goto end;
    }
    rv = EVP_PKEY_decrypt(ctx, *out, olen, in, inlen);
    if (rv <= 0) {
        OPENSSL_free(*out);
        *out = NULL;
        fprintf(stderr, "unwrap: failed to decrypt (rv=%d)\n", rv);
        goto end;
    }
    printf("unwrap: decrypt returned %d (%1lu bytes)\n", rv, *olen);

    /* Cleanup - tear down OpenSSL constructs used */
end:
    ERR_print_errors_fp(stderr);
    if (ctx == NULL)
        EVP_PKEY_CTX_free(ctx);
    //unload_engine(e);
    //clean_openssl();

    return rv;
}

and its output:

unwrap: loaded privkey of size 256
unwrap: allocating 256 bytes...
unwrap: decrypt returned 1 (0 bytes)
unwrapping returned 1
Decrypted symmetric key (0 bytes):

140735154045776:error:80008001:Vendor defined:PKCS11_rsa_decrypt:Cancel:p11_rsa.c:181:

In case it matters, here's the rsa-evp-sign.softhsm.log:

Current directory: /Users/ur20980/src/libp11/tests
Source directory: .
Output directory: output.40351
-n * Initializing smart card... 
ok
Using slot 0 with a present token (0x0)
Using slot 0 with a present token (0x0)
Using slot 0 with a present token (0x0)
***************
Listing objects
***************
Using slot 0 with a present token (0x0)
Public Key Object; RSA 2048 bits
  label:      server-key
  ID:         00010203
  Usage:      encrypt, verify, wrap
Certificate Object, type = X.509 cert
  label:      server-key
  ID:         00010203
Private Key Object; RSA 
  label:      server-key
  ID:         00010203
  Usage:      decrypt, sign, unwrap
Signature created
Signature verified
Signature created
Signature verified
Signature created
Signature verified
Signature created
Signature verified
Signature created
Signature verified
Signature created
Signature verified
PASS rsa-evp-sign.softhsm (exit status: 0)

Request for installation instructions

Since libp11-QuickStart has no content yet can you provide basic instructions on how to build and install libp11 and engine_pkcs11? This will help new folks avoid basic environment issues.

Cert request generation fails with ECDSA_do_sign error

Hi,

I'm attempting to generate a csr via openssl:

openssl req -engine pkcs11 -new -key slot_492971157-label_myecdsa -keyform engine -out req.pem -x509 -subj "/CN=John Smith"

The error is:

engine "pkcs11" set.
139637347223200:error:2A065043:lib(42):ECDSA_do_sign:passed a null parameter:ecs_ossl.c:253:
139637347223200:error:0D0DC006:asn1 encoding routines:ASN1_item_sign_ctx:EVP lib:a_sign.c:306:

[pid 2086] ERR_load_crypto_strings(0x469a01, 0x7fff82159856, 0x7fff821589e8, 0) = 0x7f0ca9d34cb8
[pid 2086] OPENSSL_load_builtin_modules(0xcbe010, 0xcd83a0, 0, 0x7fff82157dd0) = 1
[pid 2086] CONF_modules_load(0xcd83a0, 0, 0, 2) = 1
[pid 2086] NCONF_get_string(0xcd83a0, 0, 0x469b27, 0) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] NCONF_get_string(0xcd83a0, 0, 0x47736a, 0) = 0xcd8d00
[pid 2086] NCONF_get_section(0xcd83a0, 0xcd8d00, 11, 0) = 0xcd90b0
[pid 2086] sk_num(0xcd90b0, 0xcd8d00, 8, 0) = 3
[pid 2086] sk_value(0xcd90b0, 0, 8, 0) = 0xcd94a0
[pid 2086] OBJ_create(0xcd9500, 0xcd94c0, 0xcd94c0, 0) = 958
[pid 2086] sk_num(0xcd90b0, 0xffffffff, 0x7f0ca9b47768, 0xcdf040) = 3
[pid 2086] sk_value(0xcd90b0, 1, 0x7f0ca9b47768, 0xcdf040) = 0xcd9520
[pid 2086] OBJ_create(0xcd9580, 0xcd9540, 0xcd9540, 0xcdf040) = 959
[pid 2086] sk_num(0xcd90b0, 0xffffffff, 0x7f0ca9b47768, 0xcdf040) = 3
[pid 2086] sk_value(0xcd90b0, 2, 0x7f0ca9b47768, 0xcdf040) = 0xcd95a0
[pid 2086] OBJ_create(0xcd9600, 0xcd95c0, 0xcd95c0, 0xcdf040) = 960
[pid 2086] sk_num(0xcd90b0, 0xffffffff, 0x7f0ca9b47768, 0xcdf040) = 3
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b30, 0xcdf040) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b3b, 0) = 0xcdaf00
[pid 2086] X509V3_set_ctx(0x7fff82157e00, 0, 0, 0) = 0xcdaf00
[pid 2086] X509V3_set_nconf(0x7fff82157e00, 0xcd83a0, 0, 0) = 0x7f0ca9f93f00
[pid 2086] X509V3_EXT_add_nconf(0xcd83a0, 0x7fff82157e00, 0xcdaf00, 0) = 1
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b4b, 0xcdf060) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b5a, 0) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b6a, 0) = 0xcdaf80
[pid 2086] ASN1_STRING_set_default_mask_asc(0xcdaf80, 0x469b6a, 11, 0) = 1
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x4699c0, 0) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b76, 0) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] BIO_s_file(0, 0xffffffff, 0x7f0ca9b47788, 0) = 0x7f0ca9f908a0
[pid 2086] BIO_new(0x7f0ca9f908a0, 0xffffffff, 0x7f0ca9b47788, 0) = 0xcdf720
[pid 2086] BIO_s_file(0xcdf720, 436, 0x7f0ca9ce9436, 4) = 0x7f0ca9f908a0
[pid 2086] BIO_new(0x7f0ca9f908a0, 436, 0x7f0ca9ce9436, 4) = 0xcdf7a0
[pid 2086] ENGINE_by_id(0x7fff821597fd, 0x7fff821597fe, 0, 4) = 0xcddf50
[pid 2086] ENGINE_ctrl_cmd(0xcddf50, 0x477486, 0, 0xcd81c0) = 1
[pid 2086] ENGINE_set_default(0xcddf50, 0xffff, 0x7f0ca9d2ae33, 8) = 1
[pid 2086] ENGINE_get_id(0xcddf50, 187, 0x7f0ca9d296f4, 8) = 0x7f0ca9382368
[pid 2086] BIO_printf(0xcbe010, 0x4774b0, 0x7f0ca9382368, 8engine "pkcs11" set.
) = 21
[pid 2086] ENGINE_free(0xcddf50, 274, 0x7f0ca9ce91ba, 0) = 1
[pid 2086] ENGINE_load_private_key(0xcddf50, 0x7fff8215980e, 0xcd81c0, 0x7fff82157c00) = 0xcf3fe0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469b85, 0xcfc4b0) = 0xcd8c80
[pid 2086] RAND_egd(0xcd8c80, 0xcbe010, 0, 0) = 0
[pid 2086] RAND_load_file(0xcd8c80, -1, 12, 0) = 0
[pid 2086] RAND_status(0xcd8c80, 0x7fff82157660, 0, -1) = 1
[pid 2086] X509_REQ_new(0x689160, 0x46a830, 0x7f0ca9d2ac53, 1) = 0xcfcb10
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469c01, 0x7f0ca9b47760) = 0
[pid 2086] ERR_clear_error(0, 473, 1, 15) = 0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x469c08, 0xcfd170) = 0xcdada0
[pid 2086] NCONF_get_section(0xcd83a0, 0xcdada0, 2, 0) = 0xcd9da0
[pid 2086] NCONF_get_string(0xcd83a0, 0x471490, 0x4778d8, 0) = 0xcdae30
[pid 2086] NCONF_get_section(0xcd83a0, 0xcdae30, 10, 0) = 0xcdabf0
[pid 2086] X509_REQ_set_version(0xcfcb10, 0, 14, 0) = 1
[pid 2086] strlen("/CN=Ivan Wallis") = 15
[pid 2086] CRYPTO_malloc(16, 0x4772dc, 2134, 2134) = 0xcfc5f0
[pid 2086] CRYPTO_malloc(72, 0x4772dc, 2136, 0x7f0ca9b47760) = 0xcfd000
[pid 2086] CRYPTO_malloc(72, 0x4772dc, 2137, 0x7f0ca9b47760) = 0xcf4040
[pid 2086] CRYPTO_malloc(36, 0x4772dc, 2138, 0x7f0ca9b47760) = 0xcfc8a0
[pid 2086] X509_NAME_new(1, 0xcfc5ff, 0, 0xcfc5fe) = 0xcfc870
[pid 2086] OBJ_txt2nid(0xcfc5f0, 0x7f0ca9b47760, 0xcfc0a0, 0x7f0ca9b47760) = 13
[pid 2086] X509_NAME_add_entry_by_NID(0xcfc870, 13, 4097, 0xcfc5f3) = 1
[pid 2086] CRYPTO_free(0xcf4040, 0xffffffff, 0x7f0ca9b47768, 0xcfc130) = 0
[pid 2086] CRYPTO_free(0xcfd000, 0xffffffff, 0x7f0ca9b47780, 0xce6cd0) = 0
[pid 2086] CRYPTO_free(0xcfc5f0, 0xffffffff, 0x7f0ca9b47780, 0xcf4030) = 0
[pid 2086] CRYPTO_free(0xcfc8a0, 0xffffffff, 0x7f0ca9b47768, 0xcfc0e0) = 0
[pid 2086] X509_REQ_set_subject_name(0xcfcb10, 0xcfc870, 0x7f0ca9b47770, 0xcfd1d0) = 1
[pid 2086] X509_NAME_free(0xcfc870, 0xffffffff, 0x7f0ca9b47770, 0xcfcb30) = 0
[pid 2086] X509_REQ_set_pubkey(0xcfcb10, 0xcf3fe0, 0x7f0ca9b47770, 0xcfc830) = 1
[pid 2086] X509_new(1, 0xffffffff, 0x7f0ca9b47768, 0xcfc600) = 0xcfd4b0
[pid 2086] X509_set_version(0xcfd4b0, 2, 0x7f0ca9ce9436, 4) = 1
[pid 2086] X509_get_serialNumber(0xcfd4b0, 2, 0, 0xffffffff) = 0xcfc570
[pid 2086] BN_new(0, 0xcfc570, 0, 0xffffffff) = 0xcfc630
[pid 2086] BN_pseudo_rand(0xcfc630, 64, 0, 0) = 1
[pid 2086] BN_to_ASN1_INTEGER(0xcfc630, 0xcfc570, 1, 0) = 0xcfc570
[pid 2086] BN_free(0xcfc630, 0xcfd758, 1, 0) = 0
[pid 2086] X509_set_issuer_name(0xcfd4b0, 0xcfc430, 0x7f0ca9b47768, 0xcfd560) = 1
[pid 2086] X509_gmtime_adj(0xcfc0a0, 0, 0x7f0ca9b47770, 0xcfc860) = 0xcfc0a0
[pid 2086] X509_time_adj_ex(0xcfc4c0, 30, 0, 0) = 0xcfc4c0
[pid 2086] X509_set_subject_name(0xcfd4b0, 0xcfc430, 0xe000, 96) = 1
[pid 2086] X509_REQ_get_pubkey(0xcfcb10, 0xffffffff, 0x7f0ca9b47770, 0xcfc980) = 0xcfd050
[pid 2086] X509_set_pubkey(0xcfd4b0, 0xcfd050, 0x7f0ca9d2c813, 8) = 1
[pid 2086] EVP_PKEY_free(0xcfd050, 0xffffffff, 0x7f0ca9b47768, 0xcfce30) = 1
[pid 2086] X509V3_set_ctx(0x7fff82157e00, 0xcfd4b0, 0xcfd4b0, 0) = 1
[pid 2086] X509V3_set_nconf(0x7fff82157e00, 0xcd83a0, 0xcfd4b0, 0) = 0x7f0ca9f93f00
[pid 2086] X509V3_EXT_add_nconf(0xcd83a0, 0x7fff82157e00, 0xcdaf00, 0xcfd4b0) = 1
[pid 2086] EVP_MD_CTX_init(0x7fff82157bd0, 0xcfd4b0, 0xcf3fe0, 0) = 0
[pid 2086] EVP_MD_CTX_init(0x7fff82157bd0, 0xcfd4b0, 0, 0) = 0
[pid 2086] EVP_DigestSignInit(0x7fff82157bd0, 0x7fff82157bc0, 0, 0) = 1
[pid 2086] sk_num(0, 0, 0xcfe080, 0) = 0xffffffff
[pid 2086] X509_sign_ctx(0xcfd4b0, 0x7fff82157bd0, 0xcfe080, 0) = 0
[pid 2086] EVP_MD_CTX_cleanup(0x7fff82157bd0, 0xffffffff, 0x7f0ca9b47780, 0xcfd1b0) = 1
[pid 2086] ERR_print_errors(0xcbe010, 0xffffffff, 0, 0139692372833952:error:2A065043:lib(42):ECDSA_do_sign:passed a null parameter:ecs_ossl.c:253:
139692372833952:error:0D0DC006:asn1 encoding routines:ASN1_item_sign_ctx:EVP lib:a_sign.c:306:
) = 0
[pid 2086] ERR_print_errors(0xcbe010, 473, 0x7f0ca9d2ae33, 8) = 0
[pid 2086] BIO_free(0xcdf720, 473, 0x7f0ca9d2ae33, 8) = 1
[pid 2086] BIO_free_all(0xcdf7a0, 0xffffffff, 1, 0xcfe070) = 1
[pid 2086] EVP_PKEY_free(0xcf3fe0, 0xffffffff, 1, 0xcdf710) = 0
[pid 2086] X509_REQ_free(0xcfcb10, 0xffffffff, 0x7f0ca9b47778, 0xcfbc90) = 0
[pid 2086] X509_free(0xcfd4b0, 0xffffffff, 0x7f0ca9b47770, 0xcfc420) = 0
[pid 2086] ASN1_INTEGER_free(0, 0, 0, 0x7f0ca9c93be0) = 2
[pid 2086] OBJ_cleanup(0, 0x7f0ca9f80b60, 2, 0x7f0ca9c93be0) = 0
[pid 2086] NCONF_free(0xcd83a0, 0, 0, 0xcdf170) = 1
[pid 2086] lh_free(0xcd88e0, 0xffffffff, 0x7f0ca9b47770, 0xcda3c0) = 0
[pid 2086] CONF_modules_unload(1, 0, 0, 0xcdd650) = 0
[pid 2086] UI_destroy_method(0xcd81c0, 0xffffffff, 0x7f0ca9b47770, 0xcddd80) = 0
[pid 2086] OBJ_cleanup(0, 0xffffffff, 0x7f0ca9b47778, 0xcdddb0) = 0x7f0ca9f98480
[pid 2086] EVP_cleanup(0, 0xffffffff, 0, 0xcdddb0) = 0x7f0ca9f98480
[pid 2086] ENGINE_cleanup(0, 0x7f0ca9c7b650, 0, 0xcd7570) = 1
[pid 2086] CRYPTO_cleanup_all_ex_data(0, 0xffffffff, 0x7f0ca9b47770, 0xcd7f00) = 0
[pid 2086] ERR_remove_thread_state(0, 0, 0, 0xcbe150) = 0
[pid 2086] RAND_cleanup(0x7f0ca9b47760, 0, 0, 8) = 1
[pid 2086] ERR_free_strings(0, 0, 0, 8) = 8
[pid 2086] COMP_zlib_cleanup(0x689160, 380, 0x7f0ca9d2ae33, 8) = 8
[pid 2086] CRYPTO_mem_leaks(0xcbe010, 380, 0x7f0ca9d2ae33, 8) = 1
[pid 2086] BIO_free(0xcbe010, 274, 0x7f0ca9ce91ba, 8) = 1
[pid 2086] exit(1 <no return ...>
[pid 2086] +++ exited (status 1) +++

libp11 does not support ECDH key derivation is OpenSSL versions < 1.1

Symptoms: trying to do encryption/decryption - which for ECC translates into shared key derivation - fails, because p11_ops.c (and/or p11_ec.c) does not implement ECDH1-DERIVE (ECDH1-COFACTOR-DERIVE) method. It seems to only support ECDSA now.

Example:

-passin arg     pass phrase source
$ openssl pkeyutl -engine pkcs11 -peerform engine -derive -inkey 384priv.pem -peerkey id_03 -hexdump
engine "pkcs11" set.
Error initializing context
140735231131728:error:260C0065:engine routines:ENGINE_get_pkey_meth:unimplemented public key method:tb_pkmeth.c:128:
140735231131728:error:0609D09C:digital envelope routines:INT_CTX_NEW:unsupported algorithm:pmeth_lib.c:164:
Usage: pkeyutl [options]
-in file        input file
-out file       output file
-sigfile file signature file (verify operation only)
-inkey file     input key
-keyform arg    private key format - default PEM
-pubin          input is a public key
-certin         input is a certificate carrying a public key
-pkeyopt X:Y    public key options
-sign           sign with private key
-verify         verify with public key
-verifyrecover  verify with public key, recover original data
-encrypt        encrypt with public key
-decrypt        decrypt with private key
-derive         derive shared secret
-hexdump        hex dump output
-engine e       use engine e, possibly a hardware device.
-passin arg     pass phrase source

The problem is not with pkeyutl key derivation itself, because it works fine when the keys are in the filesystem:

$ pkcs15-tool -read-public-key 03 -o 384token-pub.pem
Using reader with a card: Yubico Yubikey 4 OTP+U2F+CCID
Certificate with ID 'ead-public-key' not found.
$ pkcs15-tool --read-public-key 03 -o 384token-pub.pem
Using reader with a card: Yubico Yubikey 4 OTP+U2F+CCID
$ cat !!:$
cat 384token-pub.pem
-----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEDGS7L4T8k+bleEHixoBy/78g5c2T4gXh
jfbSp9mu7QFsQM+GUXPq/vXY/keAvMytU1/J1+IOs60fSojUHTTKBGP37eAirjbP
aPKoCOuwZfU2azEtyfqlEhVZF9RX3Sre
-----END PUBLIC KEY-----
$ openssl pkeyutl -derive -inkey 384priv.pem -peerkey 384token-pub.pem -hexdump
0000 - 49 9d 0c 63 f0 65 24 65-8e 36 43 dd e0 d9 38 61   I..c.e$e.6C...8a
0010 - 96 16 2a 03 49 e3 a1 cf-48 fd e0 f8 d4 b8 5d 1b   ..*.I...H.....].
0020 - e9 9e 31 53 a6 97 10 5f-cb c7 d2 15 ac 7d 84 b5   ..1S..._.....}..
$

openssl-1.1 changed the naming convention

From now on, openssl-1.1 is looking not for libpkcs11.so but for pkcs11.so. Notice that it dropped the lib prefix from the name. This has been discussed in openssl/openssl#727

The current work-around is to symlink libpkcs11.so to pkcs11.so after successful installation.

It would be nice, however, if the configuration script could figure what version of OpenSSL it is dealing with, and prepared the install accordingly.

p11_ec does not compile for OpenSSL 1.0.2 - fix proposed

Nice to see that EC support has been added meanwhile. Trying it out, I found and fixed three issues with p11_ec.c.

Here's the first one: it does not compile with OpenSSL 1.0.2 (to be more precise: 1.0.2d) because the declaration for struct ecdsa_method is not visible. This can be corrected easily as given in the attached diff/patch file.

p11_ec_OpenSSL-1.0.2d_ecdsa_method.patch.txt

strange crash when trying EVP code with pkcs11 engine

This may be related to #72 because it is manifested by the same code. I first observed it with the latest code in the master of https://github.com/OpenSC/libp11.

Here are the symptoms:

Generated random 256-bit AES key:
30 d8 8b e1 b3 a8 b6 36 3f f9 92 36 3f af 08 e6 
43 f1 a2 d7 c7 d2 9e 28 6d 9a 84 83 e7 ea 95 78 

Encrypted symmetric key (256 bytes):
1f e6 08 cb 28 5a 12 ad 96 35 56 c5 17 51 7c 57 
3e 75 6e 8d 34 57 8b 88 22 6d 27 21 22 a2 fd da 
b1 0b c8 84 55 49 ee 3b 04 a3 c5 1f 2b 5f 31 0e 
7f be e3 09 8b 51 90 1b 07 54 48 b1 de 76 d9 24 
03 65 00 e2 92 64 e1 26 eb 7d 75 51 6f 01 d7 b8 
7c a0 ab 5d 9f d9 24 49 eb 2b 91 4e 78 cf 88 c2 
af 7f f6 3d a7 ad d8 cc 38 a5 e7 8f a1 3d 5b ae 
e6 d5 1b c9 ba 4b 53 97 2f e3 29 8e 3c 35 51 89 
e4 2a 6e a6 ae 3f f2 27 2b 3e b8 78 b6 af 95 21 
82 34 62 be 36 c7 91 d8 00 7d 3f fa 98 c4 79 a6 
5a 72 4f 29 18 1f 61 d5 d2 8e d2 31 56 77 98 01 
dd 6e 98 ea 02 ce 50 21 01 c7 c2 0a 6e 33 88 a8 
53 94 2a f7 6a c4 f2 4c 78 21 95 95 b9 f0 48 30 
97 5c 37 08 e1 d4 67 00 b5 f0 ec 7c 0b cb 20 78 
41 12 ee e9 2b 4f 76 f9 4b 82 ac 9e c4 89 b9 91 
ea 13 f8 d1 69 9a 86 38 c2 fb cf 35 57 80 96 94 

PKCS#11 token PIN: xxxxxxxx

unwrap: loaded privkey of size 256
unwrap: allocating 256 bytes (rv=1)
unwrapping returned -1
Decrypted symmetric key (256 bytes):
00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 80 
10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 

unwrap: failed to decrypt (rv=-1)
140735133200464:error:80008001:Vendor defined:PKCS11_rsa_decrypt:Cancel:p11_rsa.c:179:
printed OpenSSL errors, heading to end: label...
unwrap: returning -1...
freeing sym_key...
freeing wrapped_key...
freeing unwrapped_key...
OSSL-Tst2(4412,0x7fff739f3000) malloc: *** error for object 0x7f8871c3e4d0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug

The concern is not only the inability to properly decrypt (as seen in #72 as well), but the malloc/free failure that did not show up before.

Here's the code in question (please feel free to tell me if it's doing something stupid), a lot of it was taken from apps.c in attempt to emulate what works:

#include <stdio.h>
#include <string.h>

#include <openssl/conf.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/engine.h>
#include <openssl/rsa.h>
#include <openssl/evp.h>
#include <openssl/ui.h>

#undef OPENSSL_CONF
#define OPENSSL_CONF "/opt/local/etc/openssl/openssl.cnf"

# define FORMAT_UNDEF    0
# define FORMAT_ASN1     1
# define FORMAT_TEXT     2
# define FORMAT_PEM      3
# define FORMAT_NETSCAPE 4
# define FORMAT_PKCS12   5
# define FORMAT_SMIME    6
# define FORMAT_ENGINE   7
# define FORMAT_IISSGC   8      /* XXX this stupid macro helps us to avoid
 * adding yet another param to load_*key() */
# define FORMAT_PEMRSA   9      /* PEM RSAPubicKey format */
# define FORMAT_ASN1RSA  10     /* DER RSAPubicKey format */
# define FORMAT_MSBLOB   11     /* MS Key blob format */
# define FORMAT_PVK      12     /* MS PVK file format */
# define FORMAT_HTTP     13     /* Download using HTTP */
# define EXT_COPY_NONE   0
# define EXT_COPY_ADD    1
# define EXT_COPY_ALL    2
# define NETSCAPE_CERT_HDR       "certificate"
# define APP_PASS_LEN    1024
# define SERIAL_RAND_BITS        64

/* 256-bit AES key */
#define AES_KEYSIZE 32

#define APP_PASS_LEN  1024

int wrap(const unsigned char *in, const size_t inlen, unsigned char **out, size_t *olen, ENGINE **e);
int unwrap(const unsigned char *in, const size_t inlen, unsigned char **out, size_t *olen, ENGINE **e);
ENGINE *load_engine(const char *name);
void unload_engine(ENGINE *e);
void init_openssl(void);
void clean_openssl(void);
void print_hex(const unsigned char *buf, const size_t len);

#ifndef HEADER_APPS_H
int setup_ui_method(void);
void destroy_ui_method(void);

#  ifndef NON_MAIN
CONF *config = NULL;
BIO *bio_err = NULL;
#  else
extern CONF *config;
extern BIO *bio_err;
#  endif

# define PW_MIN_LENGTH 4
typedef struct pw_cb_data {
    const void *password;
    const char *prompt_info;
} PW_CB_DATA;

#endif /* HEADER_APPS_H */

int main(int argc, char **argv)
{
    int i = 0;
    size_t ilen = AES_KEYSIZE, olen = 0;
    unsigned char *sym_key = NULL;
    unsigned char *wrapped_key = NULL;
    unsigned char *unwrapped_key = NULL;

    ENGINE *e = NULL;

    init_openssl();

    setup_ui_method();

    /* Allocate symm key and fill with random data */
    sym_key = OPENSSL_malloc(ilen); /* 256-bit AES key */
    RAND_bytes(sym_key, ilen);
    printf("Generated random 256-bit AES key:\n");
    print_hex(sym_key, ilen);
    printf("\n");

    i = wrap(sym_key, ilen, &wrapped_key, &olen, &e);
    //printf("wrapping returned %d\n", i);
    printf("Encrypted symmetric key (%1lu bytes):\n", olen);
    print_hex(wrapped_key, olen);
    printf("\n");

    //goto end; /* TODO for now only testing wrap */
    olen = 0; /* to avoid confusion by decrypter */

    i = unwrap(wrapped_key, ilen, &unwrapped_key, &olen, &e);
    printf("unwrapping returned %d\n", i);
    if (olen > 0) {
        printf("Decrypted symmetric key (%1lu bytes):\n", olen);
        print_hex(unwrapped_key, olen);
    } else {
        printf("Decrypt returned zero bytes - error\n");
    }
    printf("\n");

//end:
    if (sym_key != NULL) {
        fprintf(stderr, "freeing sym_key...\n");
        OPENSSL_free(sym_key);
    }
    if (wrapped_key != NULL) {
        fprintf(stderr, "freeing wrapped_key...\n");
        OPENSSL_free(wrapped_key);
    }
    if (unwrapped_key != NULL) {
        fprintf(stderr, "freeing unwrapped_key...\n");
        OPENSSL_free(unwrapped_key);
    }

    fprintf(stderr, "destroy_ui_method()...\n");
    destroy_ui_method();
    fprintf(stderr, "unload_engine()...\n");
    unload_engine(e);
    fprintf(stderr, "clean_openssl()...\n");
    clean_openssl();
}

#ifndef DONT_INCLUDE_UI_METHOD_HERE
static UI_METHOD *ui_method = NULL;

static int ui_open(UI *ui)
{
    return UI_method_get_opener(UI_OpenSSL())(ui);
}

static int ui_read(UI *ui, UI_STRING *uis)
{
    if ((UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD)
        && UI_get0_user_data(ui)) {
        switch (UI_get_string_type(uis)) {
        case UIT_PROMPT:
        case UIT_VERIFY:
            {
                const char *password =
                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
                if (password && password[0] != '\0') {
                    UI_set_result(ui, uis, password);
                    return 1;
                }
            }
            break;
        default:
            break;
        }
    }
    return UI_method_get_reader(UI_OpenSSL())(ui, uis);
}

static int ui_write(UI *ui, UI_STRING *uis)
{
    if ((UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD)
        && UI_get0_user_data(ui)) {
        switch (UI_get_string_type(uis)) {
        case UIT_PROMPT:
        case UIT_VERIFY:
            {
                const char *password =
                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
                if (password && password[0] != '\0')
                    return 1;
            }
            break;
        default:
            break;
        }
    }
    return UI_method_get_writer(UI_OpenSSL())(ui, uis);
}

static int ui_close(UI *ui)
{
    return UI_method_get_closer(UI_OpenSSL())(ui);
}

int setup_ui_method(void)
{
    ui_method = UI_create_method("OpenSSL application user interface");
    UI_method_set_opener(ui_method, ui_open);
    UI_method_set_reader(ui_method, ui_read);
    UI_method_set_writer(ui_method, ui_write);
    UI_method_set_closer(ui_method, ui_close);
    return 0;
}

void destroy_ui_method(void)
{
    if (ui_method) {
        UI_destroy_method(ui_method);
        ui_method = NULL;
    }
}

int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp)
{
    UI *ui = NULL;
    int res = 0;
    const char *prompt_info = NULL;
    const char *password = NULL;
    PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp;

    if (cb_data) {
        if (cb_data->password)
            password = cb_data->password;
        if (cb_data->prompt_info)
            prompt_info = cb_data->prompt_info;
    }

    if (password) {
        res = strlen(password);
        if (res > bufsiz)
            res = bufsiz;
        memcpy(buf, password, res);
        return res;
    }

    ui = UI_new_method(ui_method);
    if (ui) {
        int ok = 0;
        char *buff = NULL;
        int ui_flags = 0;
        char *prompt = NULL;

        prompt = UI_construct_prompt(ui, "pass phrase", prompt_info);
        if (!prompt) {
            BIO_printf(bio_err, "Out of memory\n");
            UI_free(ui);
            return 0;
        }

        ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD;
        UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);

        if (ok >= 0)
            ok = UI_add_input_string(ui, prompt, ui_flags, buf,
                                     PW_MIN_LENGTH, bufsiz - 1);
        if (ok >= 0 && verify) {
            buff = (char *)OPENSSL_malloc(bufsiz);
            if (!buff) {
                BIO_printf(bio_err, "Out of memory\n");
                UI_free(ui);
                OPENSSL_free(prompt);
                return 0;
            }
            ok = UI_add_verify_string(ui, prompt, ui_flags, buff,
                                      PW_MIN_LENGTH, bufsiz - 1, buf);
        }
        if (ok >= 0)
            do {
                ok = UI_process(ui);
            }
            while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));

        if (buff) {
            OPENSSL_cleanse(buff, (unsigned int)bufsiz);
            OPENSSL_free(buff);
        }

        if (ok >= 0)
            res = strlen(buf);
        if (ok == -1) {
            BIO_printf(bio_err, "User interface error\n");
            ERR_print_errors(bio_err);
            OPENSSL_cleanse(buf, (unsigned int)bufsiz);
            res = 0;
        }
        if (ok == -2) {
            BIO_printf(bio_err, "aborted!\n");
            OPENSSL_cleanse(buf, (unsigned int)bufsiz);
            res = 0;
        }
        UI_free(ui);
        OPENSSL_free(prompt);
    }
    return res;
}

static char *app_get_pass(BIO *err, char *arg, int keepbio);

int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2)
{
    int same;
    if (!arg2 || !arg1 || strcmp(arg1, arg2))
        same = 0;
    else
        same = 1;
    if (arg1) {
        *pass1 = app_get_pass(err, arg1, same);
        if (!*pass1)
            return 0;
    } else if (pass1)
        *pass1 = NULL;
    if (arg2) {
        *pass2 = app_get_pass(err, arg2, same ? 2 : 0);
        if (!*pass2)
            return 0;
    } else if (pass2)
        *pass2 = NULL;
    return 1;
}

static char *app_get_pass(BIO *err, char *arg, int keepbio)
{
    char *tmp, tpass[APP_PASS_LEN];
    static BIO *pwdbio = NULL;
    int i;
    if (!strncmp(arg, "pass:", 5))
        return BUF_strdup(arg + 5);
    if (!strncmp(arg, "env:", 4)) {
        tmp = getenv(arg + 4);
        if (!tmp) {
            BIO_printf(err, "Can't read environment variable %s\n", arg + 4);
            return NULL;
        }
        return BUF_strdup(tmp);
    }
    if (!keepbio || !pwdbio) {
        if (!strncmp(arg, "file:", 5)) {
            pwdbio = BIO_new_file(arg + 5, "r");
            if (!pwdbio) {
                BIO_printf(err, "Can't open file %s\n", arg + 5);
                return NULL;
            }
        } else if (!strncmp(arg, "fd:", 3)) {
            BIO *btmp;
            i = atoi(arg + 3);
            if (i >= 0)
                pwdbio = BIO_new_fd(i, BIO_NOCLOSE);
            if ((i < 0) || !pwdbio) {
                BIO_printf(err, "Can't access file descriptor %s\n", arg + 3);
                return NULL;
            }
            /*
             * Can't do BIO_gets on an fd BIO so add a buffering BIO
             */
            btmp = BIO_new(BIO_f_buffer());
            pwdbio = BIO_push(btmp, pwdbio);
        } else if (!strcmp(arg, "stdin")) {
            pwdbio = BIO_new_fp(stdin, BIO_NOCLOSE);
            if (!pwdbio) {
                BIO_printf(err, "Can't open BIO for stdin\n");
                return NULL;
            }
        } else {
            BIO_printf(err, "Invalid password argument \"%s\"\n", arg);
            return NULL;
        }
    }
    i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);
    if (keepbio != 1) {
        BIO_free_all(pwdbio);
        pwdbio = NULL;
    }
    if (i <= 0) {
        BIO_printf(err, "Error reading password from BIO\n");
        return NULL;
    }
    tmp = strchr(tpass, '\n');
    if (tmp)
        *tmp = 0;
    return BUF_strdup(tpass);
}
#endif /* DONT_INCLUDE_UI_METHOD_HERE */

ENGINE* load_engine(const char *engine_name) {
    ENGINE *e = NULL;

    e = ENGINE_by_id("pkcs11");
    if ( e == NULL ) {
        fprintf(stderr, "ENGINE_by_id(\"pkcs11\") returned %lu\n",
                ERR_get_error());
        return NULL;
    }
    if ( ! ENGINE_init(e) ) {
        fprintf(stderr, "ENGINE_init returned %lu\n", ERR_get_error());
        return NULL;
    }

    return e;
}

void unload_engine(ENGINE *e) {
    ENGINE_finish(e);
    ENGINE_free(e);
    ENGINE_cleanup();
}

int wrap(const unsigned char *in, const size_t inlen, unsigned char **out, size_t *olen, ENGINE **e) {
    int rv = -1;
    EVP_PKEY *pubkey = NULL;
    EVP_PKEY_CTX *ctx = NULL;

    /* Sanity checks */
    if (in == NULL) {
        fprintf(stderr, "wrap: missing key to be encrypted...\n");
        return rv;
    }
    if (out == NULL) {
        fprintf(stderr, "wrap: missing ptr to encrypted key...\n");
        return rv;
    }
    if (inlen == 0) {
        fprintf(stderr, "wrap: key to be encrypted cannot have zero length\n");
        return rv;
    }
    /* How to check olen??? */

    /* Initialize OpenSSL crypto library */
    //init_openssl();

    /* Load engine */
    if (*e == NULL) {
        *e = load_engine("pkcs11");
        if (e == NULL) {
            fprintf(stderr, "wrap: failed to instantiate pkcs11 engine\n");
            ERR_print_errors_fp(stderr);
            goto end;
        }
#if 0
        /* Set ui_method for this engine */
        ENGINE_ctrl_cmd(*e, "SET_USER_INTERFACE", 0, ui_method, 0, 1);
        if (!ENGINE_set_default(*e, ENGINE_METHOD_ALL)) {
            fprintf(stderr, "Failed to set ui_method\n");
            ENGINE_free(*e);
            goto end;
        }
#endif
    }

    /* Retrieve the public key from the token */
    pubkey = ENGINE_load_public_key(*e, "id_03", NULL, NULL);
    if (pubkey == NULL) {
        fprintf(stderr, "wrap: failed to retrieve pubkey id_03\n");
        ERR_print_errors_fp(stderr);
        goto end;
    }

    /* Create context */
    ctx = EVP_PKEY_CTX_new(pubkey, NULL);
    EVP_PKEY_free(pubkey);
    if (ctx == NULL) {
        fprintf(stderr, "wrap: failed to create context\n");
        ERR_print_errors_fp(stderr);
        goto end;
    }
    rv = EVP_PKEY_encrypt_init(ctx);
    EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING);
    if (rv <= 0) {
        fprintf(stderr, "wrap: failed to set RSA_PKCS1_OAEP_PADDING (rv=%d)\n", rv);
        ERR_print_errors_fp(stderr);
        goto end;
    }

    /* Wrap/encrypt the symmetric key */
    *olen = 0;
    rv = EVP_PKEY_encrypt(ctx, NULL, olen, in, inlen);
    if (rv <= 0) {
        fprintf(stderr, "wrap: failed to get required output buf len (rv=%d)\n", rv);
        ERR_print_errors_fp(stderr);
        goto end;
    }
    *out = OPENSSL_malloc(olen);
    if (*out == NULL) {
        fprintf(stderr, "wrap: failed to allocate output buf (%1lu bytes)\n", *olen);
        rv = -1;
        goto end;
    }
    rv = EVP_PKEY_encrypt(ctx, *out, olen, in, inlen);
    if (rv <= 0) {
        OPENSSL_free(*out);
        fprintf(stderr, "wrap: failed to encrypt (rv=%d)\n", rv);
        ERR_print_errors_fp(stderr);
        goto end;
    }

    /* Cleanup - tear down the OpenSSL constructs used */
end:
    if (ctx == NULL)
        EVP_PKEY_CTX_free(ctx);
    //unload_engine(pkcs);
    //clean_openssl();

    return rv;
}

int unwrap(const unsigned char *in, const size_t inlen, unsigned char **out, size_t *olen, ENGINE **e) {
    int rv = -1;
    EVP_PKEY *privkey = NULL;
    EVP_PKEY_CTX *ctx = NULL;
    char *passin = NULL;
    PW_CB_DATA cb_data;

    cb_data.password = NULL;
    cb_data.prompt_info = "id_03";

    /* Sanity checks */
    if (in == NULL) {
        fprintf(stderr, "unwrap: missing key to be decrypted...\n");
        return rv;
    }
    if (out == NULL) {
        fprintf(stderr, "unwrap: missing ptr to decrypted key...\n");
        return rv;
    }
    if (inlen == 0) {
        fprintf(stderr, "unwrap: key to be decrypted cannot have zero length\n");
        return rv;
    }
    /* How to check olen??? */

    /* OpenSSL should be initialized before we are called */
    //init_openssl();

    /* Load engine */
    if (*e == NULL) {
        fprintf(stderr, "unwrap: loading PKCS11 engine...\n");
        *e = load_engine("pkcs11");
        if (*e == NULL) {
            fprintf(stderr, "unwrap: failed to instantiate pkcs11 engine\n");
            ERR_print_errors_fp(stderr);
            goto end;
        }
#if 0
        /* Set ui_method for this engine */
        ENGINE_ctrl_cmd(*e, "SET_USER_INTERFACE", 0, ui_method, 0, 1);
        if (!ENGINE_set_default(*e, ENGINE_METHOD_ALL)) {
            fprintf(stderr, "Failed to set ui_method\n");
            ENGINE_free(*e);
            goto end;
        }
#endif
    }

    /* ui_method should be configured before this */

    if (!app_passwd(bio_err, NULL, NULL, &passin, NULL)) {
        BIO_printf(bio_err, "Error getting password\n");
        ERR_print_errors_fp(stderr);
        goto end;
    }


    /* Retrieve the handle to private key on the token */
    /* Here need to get user PIN somehow ... */
    cb_data.password = NULL;
    cb_data.prompt_info = "id_03";

    const char *inkey = "pkcs11:object=KEY%20MAN%20key;object-type=private";
    privkey = ENGINE_load_private_key(*e, inkey, ui_method, &cb_data);
    //privkey = load_key(bio_err, inkey, FORMAT_ENGINE, 0, passin, *e, "Private Key");
    if (privkey == NULL) {
        fprintf(stderr, "unwrap: failed to get handle to privkey id_03\n");
        ERR_print_errors_fp(stderr);
        goto end;
    }
    printf("unwrap: loaded privkey of size %1d\n", EVP_PKEY_size(privkey));

    /* Create context */
    ctx = EVP_PKEY_CTX_new(privkey, NULL);
    EVP_PKEY_free(privkey);
    if (ctx == NULL) {
        fprintf(stderr, "unwrap: failed to create context\n");
        ERR_print_errors_fp(stderr);
        goto end;
    }
    rv = EVP_PKEY_decrypt_init(ctx);
    EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING);
    if (rv <= 0) {
        fprintf(stderr, "unwrap: failed to set RSA_PKCS1_OAEP_PADDING (rv=%d\n", rv);
        ERR_print_errors_fp(stderr);
        goto end;
    }

    /* Unwrap the encrypted key */
    *olen = 0;
    rv = EVP_PKEY_decrypt(ctx, NULL, olen, in, inlen);
    if ((rv <= 0) || (*olen == 0)) {
        fprintf(stderr, "unwrap: failed to learn needed output buf len (rv=%d)\n", rv);
        ERR_print_errors_fp(stderr);
        goto end;
    }
    printf("unwrap: allocating %1lu bytes (rv=%1d)\n", *olen, rv);
    *out = OPENSSL_malloc(*olen);
    if (*out == NULL) {
        fprintf(stderr, "unwrap: failed to allocate output buf (%1lu bytes)\n", *olen);
        rv = -1;
        goto end;
    }
    /* Somewhere here the code fails to re-authenticate to the token */
    rv = EVP_PKEY_decrypt(ctx, *out, olen, in, inlen);
    if (rv <= 0) {
        OPENSSL_free(*out);
        fprintf(stderr, "unwrap: failed to decrypt (rv=%d)\n", rv);
        ERR_print_errors_fp(stderr);
        fprintf(stderr, "printed OpenSSL errors, heading to end: label...\n");
        goto end;
    }
    printf("unwrap: decrypt returned %1lu bytes (rv=%1d)\n", *olen, rv);

    /* Cleanup - tear down OpenSSL constructs used */
end:
    ERR_print_errors_fp(stderr);
    if (ctx == NULL) {
        fprintf(stderr, "freeing CTX...\n");
        EVP_PKEY_CTX_free(ctx);
        fprintf(stderr, "freed CTX...\n");
    }
    //unload_engine(e);
    //clean_openssl();
    fprintf(stderr, "unwrap: returning %1d...\n", rv);
    return rv;
}

inline
void init_openssl() {
    /* Load the human readable error strings for libcrypto */
    ERR_load_crypto_strings();
    /* Load all digest and cipher algorithms */
    OpenSSL_add_all_algorithms();
    /* Load config file, and other important initialization */
    OPENSSL_config(OPENSSL_CONF);

    ENGINE_load_rdrand(); /* and load RDRAND engine */
}

inline
void clean_openssl() { /* probably not needed if other modules use libcrypto? */
    /* Removes all digests and ciphers */
    EVP_cleanup();
    /* if you omit the next, a small leak may be left when you make use of the
     BIO (low level API) for e.g. base64 transformations */
    CRYPTO_cleanup_all_ex_data();
    /* Remove error strings */
    ERR_free_strings();
}

inline
void print_hex(const unsigned char *buf, const size_t len) {
    for (int i = 0; i < len; i++) {
        if ( ! (i % 16) && i ) printf("\n");
        printf("%02x ", buf[i]);
    }
    printf("\n");
}

libp11 uses app_data (ex_data with index=0)

The incorrect use of ex_data in p11_rsa.c and p11_ec.c may break applications that use the same ex_data index for a different purpose.

new release?

Hello,
Would it make sense to have a new release with the available fixes since 2.8?

Unable to successfully run "make check"?

Also, why I seem to be unable to run "make check"?

Making check in tests
/Applications/Xcode.app/Contents/Developer/usr/bin/make  auth fork-test rawrsasign \
      testpkcs11.softhsm testfork.softhsm
  CC       ../examples/auth.o
  CCLD     auth
libtool: warning: '-no-install' is ignored for x86_64-apple-darwin15.2.0
libtool: warning: assuming '-no-fast-install' instead
  CC       fork-test.o
  CCLD     fork-test
libtool: warning: '-no-install' is ignored for x86_64-apple-darwin15.2.0
libtool: warning: assuming '-no-fast-install' instead
  CC       ../examples/rawrsasign.o
  CCLD     rawrsasign
libtool: warning: '-no-install' is ignored for x86_64-apple-darwin15.2.0
libtool: warning: assuming '-no-fast-install' instead
make[2]: Nothing to be done for `testpkcs11.softhsm'.
make[2]: Nothing to be done for `testfork.softhsm'.
/Applications/Xcode.app/Contents/Developer/usr/bin/make  check-TESTS
SKIP: testpkcs11.softhsm
SKIP: testfork.softhsm
============================================================================
Testsuite summary for libp11 0.3.0_git
============================================================================
# TOTAL: 2
# PASS:  0
# SKIP:  2
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
============================================================================
Making check in examples
  CCLD     auth
$ tests/auth /Library/OpenSC/lib/opensc-pkcs11.so
Slot manufacturer......: OpenSC (www.opensc-project.org)
Slot description.......: Yubico Yubikey NEO OTP+U2F+CCID
Slot token label.......: PIV_II (PIV Card Holder pin)
Slot token manufacturer: piv_II
Slot token model.......: PKCS#15 emulated
Slot token serialnr....: 1e00100269d78e66
Password for token PIV_II (PIV Card Holder pin): authentication successfull.
$ tests/rawrsasign !!:1
tests/rawrsasign /Library/OpenSC/lib/opensc-pkcs11.so
Slot manufacturer......: OpenSC (www.opensc-project.org)
Slot description.......: Yubico Yubikey NEO OTP+U2F+CCID
Slot token label.......: PIV_II (PIV Card Holder pin)
Slot token manufacturer: piv_II
Slot token model.......: PKCS#15 emulated
Slot token serialnr....: 1e00100269d78e66
Password for token PIV_II (PIV Card Holder pin): raw signing operation and signature verification successful.
$ tests/testpkcs11.softhsm
mkdir: /output.88603: Permission denied
Could not find softhsm(2) tool
$

I have installed [https://github.com/opendnssec/SoftHSMv2] in /opt/local.

boost::mutex Assertion

Hi,

When I try to write a new key I get the following error:

osc@XilinxDev:~/Documents/04_PKI_app/04_PKI_app/src$ pkcs11-tool --module=./libidprimepkcs11-2.4.0.so -l -k -d 03 -a olis_root_ca --key-type rsa:2048
Using slot 0 with a present token (0x0)
Logging in to "Card #A5**********************.".
Please enter User PIN:
pkcs11-tool: /usr/include/boost/thread/pthread/mutex.hpp:108: boost::mutex::~mutex(): Assertion `!posix::pthread_mutex_destroy(&m)' failed.
error: PKCS11 function C_GenerateKeyPair failed: rv = CKR_FUNCTION_CANCELED (0x50)

this happens with Ubuntu 14.04 in the VM and native.

br,
Oliver

pkcs11_ecdsa_sign_sig() does not truncate long digests - fix proposed

pkcs11_ecdsa_sign_sig() works for digests with sizes up to the key length.
Beyond that, the digest needs to be truncated, as done by OpenSSL in ecdsa_do_sign().
I took over (most of) that truncation code as attached and successfully tested it signing 64 bytes of data with CKM_ECDSA and secp256r1 used for authenticating a TLS endpoint.

p11_ec_ecdsa_sign_truncate.patch.txt

Parallel install with OpenSSL 1.0.2 and 1.1

Since OpenSSL 1.1 introduces a lot of API changes, it's likely to take applications a while to update. At least Fedora is planning to ship an openssl102 compat package in parallel with OpenSSL 1.1:
https://fedoraproject.org/wiki/Changes/OpenSSL110

This is fun because Fedora packaging guidelines say that any package which accepts cert files should also accept RFC7512 PKCS#11 URIs by default, and we're filing bugs against any package that doesn't.

This means we need at least the engine to be built and installed in parallel for both OpenSSL 1.0.2 and 1.1. And maybe libp11 itself too.

To start with, it would be useful if libp11 actually used pkg-config to file the version of OpenSSL that it's building with. We don't seem to pick up the correct cflags/ldflags for OpenSSL at all, and fixing that would allow it to be built against a specific version of OpenSSL.

libp11 does not support EC public key on the token

The main (openssl cli) usage of ECDH-DERIVE is this (having peer's ephemeral public key, and my private key on a hardware token):

$ openssl pkeyutl -engine pkcs11 -keyform engine -derive -inkey  "pkcs11:object=KEY%20MAN%20key;object-type=private" -peerform DER -peerkey /tmp/derive.62672.pub.der -hexdump
engine "pkcs11" set.
PKCS#11 token PIN: 
0000 - b3 41 58 6a 3e c5 68 23-2f fd ee 16 cb df 31 cf   .AXj>.h#/.....1.
0010 - 0c 0d a4 64 6c e6 33 c3-ed 6b 99 6f d3 c9 98 47   ...dl.3..k.o...G
0020 - a9 0a 45 93 c2 f1 10 32-ba 08 23 5a e1 f9 38 95   ..E....2..#Z..8.

As shown above, it works fine. Great!

Right now I'm involved in protecting encrypted filesystems with asymmetric keys residing on hardware tokens. So when you create or re-encrypt such a filesystem, you need to use your own public key to either encrypt/wrap the volume key, or derive it when the token has ECC keys. Of course when you mount (or decrypt) such a system, you need to perform a private key operation on the token. Currently it works with RSA tokens, but fails with ECC ones.

This (which fails now)

openssl pkeyutl -engine pkcs11 -peerform engine -derive -inkey /tmp/derive.60770.priv.pem -peerkey "pkcs11:object=KEY%20MAN%20pubkey;object-type=public" -out /tmp/derive.60770.shared1
engine "pkcs11" set.
Public Key operation error

used to work before:

$ apps/openssl pkeyutl -engine pkcs11 -keyform PEM -peerform engine -derive -inkey /tmp/derive.1017.priv.pem -peerkey "pkcs11:object=KEY%20MAN%20pubkey;object-type=public" -hexdump
engine "pkcs11" set.
0000 - 74 68 17 49 f2 4a d0 0f-73 4e ed c8 81 68 58 87   th.I.J..sN...hX.
0010 - 19 61 ba 11 d9 e8 05 d5-d7 fd cf e4 62 52 52 35   .a..........bRR5

I'd like to be able to restore that old behavior for the case when the requested operation uses public key on the token (for which it of course extracts the key and processes it in software, as no token actually performs operations with public keys, only with private keys - which is why the second example fails).

openssl pkeyutl crashes in int_free_ex_data() when used with engine_pkcs11

@mouse07410 Can you reproduce this issue with the latest libp11 master branch? I cleaned up some of the EVP_PKEY libp11 functions while adding PKCS11_enumerate_public_keys() to the API.

Libp11 needs a boostrap file

Recent changes in git master required an
autoreconf --verbose --install --force
to be run.
Can the OpenSC bootstrap by copied?

Merge engine_pkcs11 into libp11

I hereby propose libp11 build to produce both libp11 and engine_pkcs11 libraries. If needed, building engine_pkcs11 could be made optional with a ./configure parameter.

The relationship between libp11 and engine_pkcs11 is similar to the relationship between libcrypto and libssl in OpenSSL. libp11 is usable without engine_pkcs11 (but not the other way around) just like libcrypto is usable without libssl (but not the other way around).

Merging engine_pkcs11 into libp11 would provide the following advantages:

• libp11 testing scripts could use infrastructure provided by OpenSSL command-line tools via engine_pkcs11. Adding automated test cases to libp11 is essential to its further development.
• Combined releases would automatically ensure compatibility between new features introduced in both libraries. It would no longer be required to detect libp11 version and features when building engine_pkcs11.
• engine_pkcs11 would be easier to install for end-users. There would be simply less dependencies to download and compile.

I highly appreciate any comments, including any disadvantages I may have missed.

libp11 stopped compiling (build broken)

Mac OS X Yosemite

$ ./configure --prefix=/opt/local --with-pkcs11-module="/Library/OpenSC/lib/opensc-pkcs11.so" --with-enginesdir=/opt/local/lib/engines
checking for a BSD-compatible install... /opt/local/bin/ginstall -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /opt/local/bin/gmkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-apple-darwin15.3.0
checking host system type... x86_64-apple-darwin15.3.0
checking for gcc... clang
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether clang accepts -g... yes
checking for clang option to accept ISO C89... none needed
checking whether clang understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of clang... gcc3
checking for pkg-config... /opt/local/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking how to run the C preprocessor... clang -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... clang -E
checking whether ln -s works... yes
checking for a sed that does not truncate output... /opt/local/bin/gsed
checking whether make sets $(MAKE)... (cached) yes
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /opt/local/bin/gsed
checking for fgrep... /usr/bin/grep -F
checking for ld used by clang... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld
checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no
checking for BSD- or MS-compatible name lister (nm)... /opt/local/bin/nm
checking the name lister (/opt/local/bin/nm) interface... BSD nm
checking the maximum length of command line arguments... 196608
checking how to convert x86_64-apple-darwin15.3.0 file names to x86_64-apple-darwin15.3.0 format... func_convert_file_noop
checking how to convert x86_64-apple-darwin15.3.0 file names to toolchain format... func_convert_file_noop
checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r
checking for objdump... no
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... no
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /opt/local/bin/nm output from clang object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking for dsymutil... dsymutil
checking for nmedit... nmedit
checking for lipo... lipo
checking for otool... otool
checking for otool64... no
checking for -single_module linker flag... yes
checking for -exported_symbols_list linker flag... yes
checking for -force_load linker flag... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if clang supports -fno-rtti -fno-exceptions... yes
checking for clang option to produce PIC... -fno-common -DPIC
checking if clang PIC flag -fno-common -DPIC works... yes
checking if clang static flag -static works... no
checking if clang supports -c -o file.o... yes
checking if clang supports -c -o file.o... (cached) yes
checking whether the clang linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... darwin15.3.0 dyld
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for windres... no
checking for ANSI C header files... (cached) yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking malloc.h usability... no
checking malloc.h presence... no
checking for malloc.h... no
checking for stdlib.h... (cached) yes
checking for inttypes.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking for dlfcn.h... (cached) yes
checking utmp.h usability... yes
checking utmp.h presence... yes
checking for utmp.h... yes
checking for doxygen... no
checking for library containing dlopen... none required
checking for __register_atfork... no
checking for OPENSSL... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/libp11.pc
config.status: creating src/libp11.rc
config.status: creating src/pkcs11.rc
config.status: creating doc/Makefile
config.status: creating doc/doxygen.conf
config.status: creating examples/Makefile
config.status: creating tests/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands

libp11 has been configured with the following options:

Version:                 0.4.0_git
libp11 directory:        /opt/local/lib
Engine directory:        /opt/local/lib/engines
API doc support:         no
Default PKCS11 module:   /Library/OpenSC/lib/opensc-pkcs11.so

Host:                    x86_64-apple-darwin15.3.0
Compiler:                clang
Preprocessor flags:      -I/opt/local/include
Compiler flags:          -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4.2 -mtune=native -Os -Ofast
Linker flags:            -L/opt/local/lib
Libraries:

LIBP11_CFLAGS:
LIBP11_LIBS:
OPENSSL_CFLAGS:          -I/opt/local/include
OPENSSL_LIBS:            -L/opt/local/lib -lssl -lcrypto

$ make clean && make all
Making clean in src
test -z "libpkcs11.la" || rm -f libpkcs11.la
rm -f ./so_locations
test -z "libp11.pc" || rm -f libp11.pc
test -z "libp11.la" || rm -f libp11.la
rm -f ./so_locations
rm -rf .libs _libs
rm -f *.o
rm -f *.lo
Making clean in doc
rm -rf .libs _libs
rm -fr api.out
rm -f *.lo
Making clean in examples
rm -rf .libs _libs
 rm -f auth decrypt getrandom listkeys rawrsasign
rm -f *.o
rm -f *.lo
Making clean in tests
 rm -f fork-test
rm -rf .libs _libs
rm -f *.o
test -z "testpkcs11.softhsm.log testfork.softhsm.log testlistkeys.softhsm.log" || rm -f testpkcs11.softhsm.log testfork.softhsm.log testlistkeys.softhsm.log
test -z "testpkcs11.softhsm.trs testfork.softhsm.trs testlistkeys.softhsm.trs" || rm -f testpkcs11.softhsm.trs testfork.softhsm.trs testlistkeys.softhsm.trs
test -z "test-suite.log" || rm -f test-suite.log
rm -f *.lo
rm -rf .libs _libs
rm -f *.lo
Making all in src
/Applications/Xcode.app/Contents/Developer/usr/bin/make  all-am
  CC       libpkcs11_la-eng_front.lo
  CC       libpkcs11_la-eng_back.lo
  CCLD     libpkcs11.la
Undefined symbols for architecture x86_64:
  "_PKCS11_CTX_free", referenced from:
      _pkcs11_finish in libpkcs11_la-eng_back.o
  "_PKCS11_CTX_init_args", referenced from:
      _pkcs11_init in libpkcs11_la-eng_back.o
  "_PKCS11_CTX_load", referenced from:
      _pkcs11_init in libpkcs11_la-eng_back.o
  "_PKCS11_CTX_new", referenced from:
      _pkcs11_init in libpkcs11_la-eng_back.o
  "_PKCS11_CTX_unload", referenced from:
      _pkcs11_finish in libpkcs11_la-eng_back.o
  "_PKCS11_ecdsa_method_free", referenced from:
      _pkcs11_engine_destroy in libpkcs11_la-eng_front.o
  "_PKCS11_enumerate_certs", referenced from:
      _load_cert_ctrl in libpkcs11_la-eng_back.o
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_enumerate_keys", referenced from:
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_enumerate_public_keys", referenced from:
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_enumerate_slots", referenced from:
      _load_cert_ctrl in libpkcs11_la-eng_back.o
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_find_token", referenced from:
      _load_cert_ctrl in libpkcs11_la-eng_back.o
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_get_ecdsa_method", referenced from:
      _bind_engine in libpkcs11_la-eng_front.o
  "_PKCS11_get_private_key", referenced from:
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_get_public_key", referenced from:
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_get_rsa_method", referenced from:
      _bind_engine in libpkcs11_la-eng_front.o
  "_PKCS11_get_slotid_from_slot", referenced from:
      _load_cert_ctrl in libpkcs11_la-eng_back.o
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_login", referenced from:
      _load_cert_ctrl in libpkcs11_la-eng_back.o
      _pkcs11_load_key in libpkcs11_la-eng_back.o
  "_PKCS11_release_all_slots", referenced from:
      _load_cert_ctrl in libpkcs11_la-eng_back.o
      _pkcs11_load_key in libpkcs11_la-eng_back.o
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [libpkcs11.la] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1

You can see why I don't like automake/autotools/autoconf.

It seems that "it" doesn't resolve what's defined in src/p11_slot.c, but I haven't the slightest idea what to tweak to either ensure it is included in whatever it should've been included, or to test this hypothesis.

Possible deadlock

Hi,

I'm working on a patch to the serf library that adds support for PKCS11 via engine_pkcs11 (see serf issue 27) and after upgrading libp11 from 0.2.8 to 0.3.1 found what appears to be a deadlock in the new thread safety code. The load_cert_ctrl function from engine_pkcs11 calls PKCS11_enumerate_certs from libp11, which sets a dynlock on the context and then calls pkcs11_find_certs. pkcs11_find_certs calls PKCS11_open_session, which in turn calls pkcs11_open_session. At this point, if it's not a relogin, CHECK_SLOT_FORK is called and the process deadlocks because another lock is requested on the context and it just sits and waits for it. Any chance someone could take a look at this? I have very little experience with PKCS11 at all, just jumped into this because the company I work for is adopting smart cards for authentication and we need subversion v1.8.

Thanks,
-brian

make.rules.mak file missing from release archive

Trying to build libp11 0.4.0 on windows, but the make.rules.mak file is missing from it for some reason...

Using libpkcs11.so as engine with module libsofthsm2.so

Hi,

I'm using softhsm2 as HSM and try to use in conjunction with openssl by engine_pkcs11.so. Everything went fine with RSA keys, but when I try to select ECC keys I got the error that the keys could not be found.
I found out, that the old engine_pkcs11.so can only handle RSA keys, so I tried so migrate to libp11 as it has been merged with engine_pkcs11.

I downloaded libp11-0.4.0, compiled and built it. In OpenSSL (1.0.1t) I tried to load the libpkcs11.so plugin in the following way:
OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/local/lib/softhsm/libsofthsm2.so

But I always get the error, that the plugin cannot be loaded:
139730761131664:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so): /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so: undefined symbol: PKCS11_enumerate_public_keys
139730761131664:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:232:
139730761131664:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:465:

139730761131664:error:260AC089:engine routines:INT_CTRL_HELPER:invalid cmd name:eng_ctrl.c:131:
139730761131664:error:260AB089:engine routines:ENGINE_ctrl_cmd_string:invalid cmd name:eng_ctrl.c:311:
[ unavailable ]

If I switch back to /usr/lib/ssl/engine/engine_pkcs11.so as SO_PATH, no error is thrown, but only RSA keys can be used.

Did I forget to add something? Please tell me what is wrong!
Thank you

examples/listkeys generates openssl error

$ examples/listkeys /Library/OpenSC/lib/opensc-pkcs11.so
PKCS11_CTX_new generated errors:
140735231131728:error:0F067064:common libcrypto routines:func(103):reason(100):cryptlib.c:248:
Slot manufacturer......: OpenSC (www.opensc-project.org)
Slot description.......: Yubico Yubikey NEO OTP+U2F+CCID
Slot token label.......: PIV_II (PIV Card Holder pin)
Slot token manufacturer: piv_II
Slot token model.......: PKCS#15 emulated
Slot token serialnr....: 17369f0af7841e2a

Public keys:
 * Public key: PIV AUTH pubkey
 * Public key: SIGN pubkey
 * Public key: KEY MAN pubkey
 * Public key: CARD AUTH pubkey

Private keys:
 * Private key: CARD AUTH key
Success.

If pin is provided on the command line, it lists all the private keys correctly, but still reports the above error from PKCS11_CTX_new().

Everything at the latest github master level (except for openssl that is 1.0.2f-dev).

Which key data should p11_ec.c check and provide when asked for a public/private key?

It is clear from the PKCS#11 spec that a module should allow to retrieve the EC domain params and the curve point Q when asked for an EC public key, and to retrieve the EC params and the private value d (if exportable) when asked for an EC private key. As discussed for commit 874154bc49d28c1358037f923e8d773ba0472b9d, libp11 should - and meanwhile does - make sure that this data is present in the EVP_PKEY structure for the case of public keys. For private keys residing on the module/card, only their params may be accessible.

The private key object and the related public key object of a key pair are supposed to have the same ID, such that one should be able to access the public key using the ID of a private key and the related private key meta-data using the ID of a public key.

@dengert wrote:

The OpenSC pkcs11 module goes to extra lengths to make sure the EC parameters are provided for both the pubkey and privkey. Libp11 will go as far as to read the pubkey to find the parameters when a request for the privkey is made.

I confirm this behavior, but here are three related subtle issues:

1. Suppose for a given ID of an EC key pair a module/card provides EC parameters for both the pubkey object and privkey object for that ID, how to react if the parameters returned disagree? Maybe libp11 should check for this error condition, as it indicates an incoherence of the module/card storage?
2. At the moment, libp11 retrieves the EC parameters for the type of key requested and does not check for potential disagreement. As Doug wrote, it even takes over the EC params of private key objects when retrieving data including the curve point of the related public key. I'd say that in this case it should better retrieve the params of the public key object, to be on the safe side.
3. How to handle the case that a privkey object is present on the module/card but not a pubkey object with the same ID? When asked for the private key, libp11 in this case returns - without flagging an error - in the EVP_PKEY structure the privkey aspect of the EC key pair only. This will be sufficient for pure signature applications, but in case the application in addition then tries making use of the public curve point, it will crash because the respective pointer is NULL. One could argue that the application should have asked for the public key instead (or in addition), but it seems that traditionally when one has a pointer to EVP_PKEY, both the public and private key aspects of it should be usable. This can be justified from the general observation for both RSA and EC cryptography: if one has a private key (including its meta data), one can derive the related public key from it.

PKCS11_enumerate_certs() returns cached results after login

Some certificates are stored in tokens with the CKA_PRIVATE flag, so they aren't visible until you log in.

In OpenConnect I call PKCS11_enumerate_certs() to find the cert requested by the user. If no matching cert if found, and if only one token was found that matched the user's specification, then I log in to that token... and call PKCS11_enumerate_certs() again. This doesn't work because the second call to PKCS11_enumerate_certs() will immediately return a cached empty set of results, without asking the (now logged in) token again.

2016-04-20 Can't compile with current OpenSSL-1.1 master

$ OPENSSL_CFLAGS="-I/Users/ur20980/src/openssl-1.1/include" OPENSSL_LIBS="-L/Users/ur20980/src/openssl-1.1/lib -lcrypto" ./configure --prefix=/Users/ur20980/src/openssl-1.1 --with-pkcs11-module="/Library/OpenSC/lib/opensc-pkcs11.so" --with-enginesdir=/Users/ur20980/src/openssl-1.1/lib/engines
checking for a BSD-compatible install... /opt/local/bin/ginstall -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /opt/local/bin/gmkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking build system type... x86_64-apple-darwin15.4.0
checking host system type... x86_64-apple-darwin15.4.0
checking for gcc... clang
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether clang accepts -g... yes
checking for clang option to accept ISO C89... none needed
checking whether clang understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of clang... gcc3
checking for pkg-config... /opt/local/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking how to run the C preprocessor... clang -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking whether byte ordering is bigendian... no
checking how to run the C preprocessor... clang -E
checking whether ln -s works... yes
checking for a sed that does not truncate output... /usr/bin/sed
checking whether make sets $(MAKE)... (cached) yes
checking how to print strings... printf
checking for a sed that does not truncate output... (cached) /usr/bin/sed
checking for fgrep... /usr/bin/grep -F
checking for ld used by clang... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld
checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking the maximum length of command line arguments... 196608
checking how to convert x86_64-apple-darwin15.4.0 file names to x86_64-apple-darwin15.4.0 format... func_convert_file_noop
checking how to convert x86_64-apple-darwin15.4.0 file names to toolchain format... func_convert_file_noop
checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r
checking for objdump... no
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... no
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from clang object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking for dsymutil... dsymutil
checking for nmedit... nmedit
checking for lipo... lipo
checking for otool... otool
checking for otool64... no
checking for -single_module linker flag... yes
checking for -exported_symbols_list linker flag... yes
checking for -force_load linker flag... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if clang supports -fno-rtti -fno-exceptions... yes
checking for clang option to produce PIC... -fno-common -DPIC
checking if clang PIC flag -fno-common -DPIC works... yes
checking if clang static flag -static works... no
checking if clang supports -c -o file.o... yes
checking if clang supports -c -o file.o... (cached) yes
checking whether the clang linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... darwin15.4.0 dyld
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for windres... no
checking for ANSI C header files... (cached) yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking malloc.h usability... no
checking malloc.h presence... no
checking for malloc.h... no
checking for stdlib.h... (cached) yes
checking for inttypes.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking for unistd.h... (cached) yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking for dlfcn.h... (cached) yes
checking utmp.h usability... yes
checking utmp.h presence... yes
checking for utmp.h... yes
checking for doxygen... /opt/local/bin/doxygen
checking for library containing dlopen... none required
checking for __register_atfork... no
checking for OPENSSL... yes
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/libp11.pc
config.status: creating src/libp11.rc
config.status: creating src/pkcs11.rc
config.status: creating doc/Makefile
config.status: creating doc/doxygen.conf
config.status: creating examples/Makefile
config.status: creating tests/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands

libp11 has been configured with the following options:

Version:                 0.4.1_git
libp11 directory:        /Users/ur20980/src/openssl-1.1/lib
Engine directory:        /Users/ur20980/src/openssl-1.1/lib/engines
Default PKCS11 module:   /Library/OpenSC/lib/opensc-pkcs11.so
API doc support:         no

Host:                    x86_64-apple-darwin15.4.0
Compiler:                clang
Preprocessor flags:      
Compiler flags:          -maes -mpclmul -mrdrnd -msse2 -mssse3 -msse4.1 -msse4.2
Linker flags:            
Libraries:               

OPENSSL_CFLAGS:          -I/Users/ur20980/src/openssl-1.1/include
OPENSSL_LIBS:            -L/Users/ur20980/src/openssl-1.1/lib -lcrypto

$ ~/src/openssl-1.1/bin/openssl version
OpenSSL 1.1.0-pre6-dev  xx XXX xxxx
$ make all && make check && make install
Making all in src
/Applications/Xcode.app/Contents/Developer/usr/bin/make  all-am
  CC       pkcs11_la-eng_front.lo
  CC       pkcs11_la-eng_back.lo
  CC       pkcs11_la-eng_parse.lo
  CC       libp11_la-libpkcs11.lo
  CC       libp11_la-p11_attr.lo
  CC       libp11_la-p11_cert.lo
  CC       libp11_la-p11_err.lo
  CC       libp11_la-p11_key.lo
p11_key.c:241:50: error: incomplete definition of type 'struct rsa_st'
                pkcs11_addattr_bn(attrs + n++, CKA_MODULUS, rsa->n);
                                                            ~~~^
/Users/ur20980/src/openssl-1.1/include/openssl/ossl_typ.h:154:16: note: forward declaration of
      'struct rsa_st'
typedef struct rsa_st RSA;
               ^
p11_key.c:242:58: error: incomplete definition of type 'struct rsa_st'
                pkcs11_addattr_bn(attrs + n++, CKA_PUBLIC_EXPONENT, rsa->e);
                                                                    ~~~^
/Users/ur20980/src/openssl-1.1/include/openssl/ossl_typ.h:154:16: note: forward declaration of
      'struct rsa_st'
typedef struct rsa_st RSA;
               ^
p11_key.c:244:60: error: incomplete definition of type 'struct rsa_st'
                        pkcs11_addattr_bn(attrs + n++, CKA_PRIVATE_EXPONENT, rsa->d);
                                                                             ~~~^
/Users/ur20980/src/openssl-1.1/include/openssl/ossl_typ.h:154:16: note: forward declaration of
      'struct rsa_st'
typedef struct rsa_st RSA;
               ^
p11_key.c:245:51: error: incomplete definition of type 'struct rsa_st'
                        pkcs11_addattr_bn(attrs + n++, CKA_PRIME_1, rsa->p);
                                                                    ~~~^
/Users/ur20980/src/openssl-1.1/include/openssl/ossl_typ.h:154:16: note: forward declaration of
      'struct rsa_st'
typedef struct rsa_st RSA;
               ^
p11_key.c:246:51: error: incomplete definition of type 'struct rsa_st'
                        pkcs11_addattr_bn(attrs + n++, CKA_PRIME_2, rsa->q);
                                                                    ~~~^
/Users/ur20980/src/openssl-1.1/include/openssl/ossl_typ.h:154:16: note: forward declaration of
      'struct rsa_st'
typedef struct rsa_st RSA;
               ^
5 errors generated.
make[2]: *** [libp11_la-p11_key.lo] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
$ 

Cross Compiling for windows using mingw

is there any document to compile libp11 for windows? I don't have any expertise about cross compiling using mingw. Please let me know any read me

Regards,
Sanaullah

Compiling on Windows with Msys2

Hi there,

I downloaded libp11-0.4.0. I used MSYS2 environment to configure and make the project.

It works very well with ./configure

Yet when I execute make, I receive the following error:

`libtool: link: warning: undefined symbols not allowed in i686-pc-mingw32 shared libraries
CCLD pkcs11.la

*** Warning: This system can not link to static lib archive libp11.la.
*** I have the capability to make that library automatically link in when
*** you link to this library. But I can only do this if you have a
*** shared version of the library, which you do not appear to have.
*** But as you try to build a module library, libtool will still create
*** a static module, that should work as long as the dlopening application
*** is linked with the -dlopen flag to resolve symbols at runtime.
libtool: link: warning: undefined symbols not allowed in i686-pc-mingw32 shared libraries
cd .libs && cp -pR -f pkcs11.dll libpkcs11.dll
cp: cannot stat ‘pkcs11.dll’: No such file or directory
Makefile:981: recipe for target 'all-local' failed
make[2]: *** [all-local] Error 1
make[2]: Leaving directory '/c/libp11-0.4.0/src'
Makefile:405: recipe for target 'all' failed
make[1]: *** [all] Error 2
make[1]: Leaving directory '/c/libp11-0.4.0/src'
Makefile:465: recipe for target 'all-recursive' failed
make: *** [all-recursive] Error 1
`

We will appreciate for any help.

openssl could not load the shared library

OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/local/lib/libp11.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Failure]: LOAD
140621404858016:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:185:filename(/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so): libp11.so.2: cannot open shared object file: No such file or directory
140621404858016:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:244:
140621404858016:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:450:
[Failure]: MODULE_PATH:/usr/local/lib/libp11.so
140621404858016:error:260AC089:engine routines:INT_CTRL_HELPER:invalid cmd name:eng_ctrl.c:134:
140621404858016:error:260AB089:engine routines:ENGINE_ctrl_cmd_string:invalid cmd name:eng_ctrl.c:316:
     [ unavailable ]

Ubuntu14, openssl-1.0.1f

Support OpenSSL 1.1

The OpenSSL 1.1 API removes direct application access to most internal data structures in favour of getters and setters. This improves binary compatibility, but requires significant changes in the applications.

engine_pkcs11-0.4.0-2.fc24 can't read private key from pkcs token

Description of problem:
I use rutoken-csp. With engine_pkcs11-0.2.0-2.fc24.x86_64 openssl can read private key from the token.

Command:
echo "engine -t dynamic -pre SO_PATH:/usr/lib64/openssl/engines/libpkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib64/opensc-pkcs11.so
rsautl -engine pkcs11 -keyform engine -inkey slot_1-id_123456 -sign -in ./cs_pkcs11_in -out ./cs_pkcs11_out" |openssl

With engine_pkcs11-0.2.0-2.fc24.x86_64 openssl requests a pin. After upgrading to engine_pkcs11-0.4.0-2.fc24.x86_64 openssl reports about error:
OpenSSL> (dynamic) Dynamic engine loading support

Loaded: (pkcs11) pkcs11 engine
[ available ]
OpenSSL> engine "pkcs11" set.
Invalid slot number: 1
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
140337634576248:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:124:
unable to load Private Key
error in rsautl

Version-Release number of selected component (if applicable):
0.4.0-2.fc24

How reproducible:

Steps to Reproduce:

1. create a rsa:2048 keypair on a token (with engine_pkcs11-0.2.0)
2. upgrade to engine_pkcs11-0.4.0
3. sign some data with above command

Actual results:
unable to load Private Key
error in rsautl

Expected results:
openssl requests a pin

Additional info:
downgrading to engine_pkcs11-0.2.0-2.fc24.x86_64 solves the problem

Compile fails when the number of jobs is large

make -j 22 at the top-level on a machine with a large number of cores

Associated compilation output:

cd .libs && ln -s -f pkcs11.so libpkcs11.so
/bin/bash: line 0: cd: .libs: No such file or directory
make[2]: *** [all-local] Error 1
make[2]: *** Waiting for unfinished jobs....

(Full log: http://errors.yoctoproject.org/Errors/Details/75462/)

It appears that the target all-local does not have the required dependencies defined explicitly

I added all-local: $(LTLIBRARIES) as a quick work around. I can create a PR if that is a valid long term fix