"no slot found" when running in LXC with nitrokey HSM2

Any help would be highly appreciated as this is my first time using these HSMs.

i am getting the following log:

Dec 06 22:37:56 ca-master nixpkcs.sh[16939]: [nixpkcs.sh/I] (step-ca) <exec> pkcs11-tool --token-label SmartCard-HSM --id 01 --label step-ca --login --login-type user --pin //REDACTED// --keypairgen --key-type EC:secp256r1 --usage-sign --usage-derive
Dec 06 22:37:56 ca-master nixpkcs.sh[16939]: No slot with token named "SmartCard-HSM" found

this seems to be a problem with the systemd service, it also outputs a different result here:

Dec 06 22:37:56 ca-master nixpkcs.sh[16935]: [nixpkcs.sh/I] (step-ca) <exec> pkcs11-tool --token-label SmartCard-HSM --id 01 --label step-ca --list-slots
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]: Available slots:
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]: Slot 0 (0x1): NSS Internal Cryptographic Services
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token label        : NSS Generic Crypto Services
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token manufacturer : Mozilla Foundation
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token model        : NSS 3
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token flags        : rng, token initialized, readonly, other flags=0x200
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   hardware version   : 4.0
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   firmware version   : 0.0
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   serial num         : 0000000000000000
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   pin min/max        : 0/0
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   uri                : pkcs11:model=NSS%203;manufacturer=Mozilla%20Foundation;serial=0000000000000000;token=NSS%20Generic%20Crypto%20Services
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]: Slot 1 (0x2): NSS User Private Key and Certificate Services
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token label        : NSS Certificate DB
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token manufacturer : Mozilla Foundation
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token model        : NSS 3
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   token flags        : login required, rng, token initialized, PIN initialized, other flags=0x200
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   hardware version   : 0.0
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   firmware version   : 0.0
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   serial num         : 0000000000000000
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   pin min/max        : 0/500
Dec 06 22:37:56 ca-master nixpkcs.sh[16935]:   uri                : pkcs11:model=NSS%203;manufacturer=Mozilla%20Foundation;serial=0000000000000000;token=NSS%20Certificate%20DB

but if i run it (as root):

root@ca-master ~# pkcs11-tool --token-label SmartCard-HSM --id 01 --label step-ca --list-slots
Available slots:
Slot 0 (0x0): Nitrokey Nitrokey HSM (DENK03012600000         ) 00 00
  token label        : SmartCard-HSM
  token manufacturer : www.CardContact.de
  token model        : PKCS#15 emulated
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 24.13
  firmware version   : 4.0
  serial num         : DENK0301260
  pin min/max        : 6/15
  uri                : pkcs11:model=PKCS%2315%20emulated;manufacturer=www.CardContact.de;serial=DENK0301260;token=SmartCard-HSM

Can you paste your key definition in your config?

The short answer is that it looks like nixpkcs is using NSS (which is more suited for testing). Do you know which PKCS#11 module your key likes to use? We can fairly easily add support for it.

from what i can tell it is supposed to work with opensc-pkcs11 (normal use) and sc-hsm-embedded (read only mode)

  nixpkcs = {
    enable = true;
    pcsc.enable = true;
    environment.enable = true;
    uri.enable = true;
    keypairs = {
      step-ca = {
        enable = true;
        # The PKCS#11 module to use.
        #inherit (tpm2-pkcs11) pkcs11Module;
        # inherit (yubico-piv-tool) pkcs11Module;
        pkcs11Module = pkgs.nss_latest.pkcs11Module;

        # The token name. For TPM, this can be whatever you want, as long as it's consistent.
        token = "SmartCard-HSM";

        # The key ID.
        id = 10;

        # Not required for all tokens, but is for NSS.
        slot = 2;

        # Options for the private key.
        keyOptions = {
          # EC or RSA.
          algorithm = "EC";

          # The bits (for RSA) or the curve (for ECDSA).
          type = "secp256r1";

          # Options: sign, derive, decrypt, wrap
          usage = ["sign" "derive"];

          # Security Officer PIN. For the yubikey, this is the management token.
          soPinFile = "/etc/mgmt.pin";
        };

        # Options for the cert.
        certOptions = {
          # The certificate message digest. `openssl list -digest-commands` for the list. Case insensitive.
          digest = "SHA256";

          # Can be omitted for a random certificate serial.
          # serial = "09f91102";

          # Certificate (and key) validity in days.
          validityDays = 365 * 10;

          # Number of days prior to expiration this key should be renewed and replaced.
          renewalPeriod = 14;

          # The subject.
          subject = "C=AA/O=Arbel Arad/CN=CA-master";

          # Extensions to add.
          # Certificate authority:
          extensions = [
              "v3_ca"
              "keyUsage=critical,nonRepudiation,keyCertSign,digitalSignature,cRLSign"
          ];

          # File containing the user PIN. Usually 8 digits but can be more.
          pinFile = "/etc/user.pin";

          # If provided, will write the certificate here.
          writeTo = "/root/ca.crt";
        };
      };
    };
  };

It's probably just a matter of pointing it at the correct PKCS#11 module. I'll take a look at the right config snippet to add.

@Arbel-arad

@Arbel-arad Try using the master branch; this commit may fix it:

be572d4

Instead of saying pkcs11Module = pkgs.nss_latest.pkcs11Module; in your key definition, use inherit (pkgs.opensc) pkcs11Module;

ok it passes the key generation stage now, but fails when trying to create a certificate (technically i don't need the cert)
i also had to put the user pin in the SO pin file because loginAsUser didn't use the user pin file for key generation.

Dec 08 06:25:13 ca-master nixpkcs.sh[25231]: Could not find private key from pkcs11:id=%0A;object=step-ca;slot-id=2;token=SmartCard-HSM;type=private?module-path=%2Fnix%2Fstore%2F7bl2k36rcrdlp681km9pa0abwm0kngid-opensc-0.26.0%2Flib%2Fopensc-pkcs11.so&pin-source=file%3A%2Fetc%2Fuser.pin

can i just disable certificate signing?
it will be signed by an external root anyway.

The certificate is how it determines whether the key should be re-generated based on the renewal period in the key definition (and yes, you can definitely replace it with your own, but it basically uses the certificate as a record that the key was generated at a certain point in time). For your issue though, try getting rid of the slot = 2 in the config, you shouldn't need that. There is only one slot for your token.

i also had to put the user pin in the SO pin file because loginAsUser didn't use the user pin file for key generation.

This is expected. You can also point them to the same file.

it worked after removing the slot = 2;. thank you!

Excellent, good confirmation that it works on the Nitrokey too. The next release will include the passthru exposing the OpenSC PKCS#11 module.

v1.1.9 releases this change.

Navigation Menu

Repository navigation

"no slot found" when running in LXC with nitrokey HSM2 #13

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

"no slot found" when running in LXC with nitrokey HSM2 #13

Description

Activity

numinit commented on Dec 7, 2024

numinit commented on Dec 7, 2024

Arbel-arad commented on Dec 7, 2024

numinit commented on Dec 7, 2024

numinit commented on Dec 8, 2024

Arbel-arad commented on Dec 8, 2024

numinit commented on Dec 8, 2024

Arbel-arad commented on Dec 8, 2024

numinit commented on Dec 8, 2024

numinit commented on Dec 22, 2024

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions