Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Configure() fails when using Tokens that do not require a login #46

Closed
jls5177 opened this issue Jun 19, 2019 · 1 comment · Fixed by #54
Closed

Configure() fails when using Tokens that do not require a login #46

jls5177 opened this issue Jun 19, 2019 · 1 comment · Fixed by #54
Labels

Comments

@jls5177
Copy link
Contributor

jls5177 commented Jun 19, 2019

I noticed the latest v1.x changes now always attempts to login to the token regardless if the token states it requires a login or not. The previous code was checking this flag before calling login.

There are a few proposals here:

  1. Always perform the login and only error out when the CKF_LOGIN_REQUIRED flag is set on the token
  2. Add a configuration field to optionally login to the token
  3. Only login when the TokenPin is non-empty

Reproduction Steps
Select the module/accelerator token on a Thales HSM. This token does not require a login and will return an error code when we attempt to login.

@dmjones
Copy link
Contributor

dmjones commented Jun 20, 2019

As a temporary solution, if you are blocked with an nShield HSM, there is an environment variable that allows you to "log in" to the accelerator token. Something like CKA_FAKE_ACCELERATOR_LOGIN (check the manual).

As for the solution, I prefer option 2.

Option 3 is risky, because you could legitimately have an empty PIN. I think Option 1 is risky due to the potential for libraries to interpret this differently.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants