Re: [Openvpn-users] ECC with PKCS#11

2018-07-25 Thread Selva Nair
On Wed, Jul 25, 2018 at 5:27 PM, David Sommerseth wrote: > On 25/07/18 18:27, Selva Nair wrote: >> Hi, >> >> >> While replacing pkcs11-helper may be a good goal, I think the PIN >> prompt issue is beyond that and will not be solved by just using some >> other library. > > That is incorrect, and Ge

Re: [Openvpn-users] ECC with PKCS#11

2018-07-25 Thread David Sommerseth
On 25/07/18 18:27, Selva Nair wrote: > Hi, > > On Wed, Jul 25, 2018 at 4:04 AM, Gert Doering wrote: >> Hi, >> >> On Tue, Jul 24, 2018 at 11:26:40PM +0200, David Sommerseth wrote: >>> No matter how much I really dislike this, I do acknowledge this needs to be >>> fixed. I have played a little bit

Re: [Openvpn-users] ECC with PKCS#11

2018-07-25 Thread Selva Nair
Hi, On Wed, Jul 25, 2018 at 4:04 AM, Gert Doering wrote: > Hi, > > On Tue, Jul 24, 2018 at 11:26:40PM +0200, David Sommerseth wrote: >> No matter how much I really dislike this, I do acknowledge this needs to be >> fixed. I have played a little bit with this to look at workarounds, but the >> mo

Re: [Openvpn-users] ECC with PKCS#11

2018-07-25 Thread David Sommerseth
On 25/07/18 10:04, Gert Doering wrote: > Hi, > > On Tue, Jul 24, 2018 at 11:26:40PM +0200, David Sommerseth wrote: >> No matter how much I really dislike this, I do acknowledge this needs to be >> fixed. I have played a little bit with this to look at workarounds, but the >> more I look at it - w

Re: [Openvpn-users] ECC with PKCS#11

2018-07-25 Thread Gert Doering
Hi, On Tue, Jul 24, 2018 at 11:26:40PM +0200, David Sommerseth wrote: > No matter how much I really dislike this, I do acknowledge this needs to be > fixed. I have played a little bit with this to look at workarounds, but the > more I look at it - we either need to kill pkcs11-helper completely a

Re: [Openvpn-users] ECC with PKCS#11

2018-07-24 Thread David Sommerseth
On 24/07/18 23:57, Selva Nair wrote: > Hi, > > On Tue, Jul 24, 2018 at 5:26 PM, David Sommerseth > wrote: >> On 24/07/18 16:25, Selva Nair wrote: >>> On Tue, Jul 24, 2018 at 4:37 AM, Johannes Bauer >>> wrote: However, now I run into a separate issue, namely a hang at the PIN prompt: >

Re: [Openvpn-users] ECC with PKCS#11

2018-07-24 Thread Selva Nair
Hi, On Tue, Jul 24, 2018 at 5:26 PM, David Sommerseth wrote: > On 24/07/18 16:25, Selva Nair wrote: >> On Tue, Jul 24, 2018 at 4:37 AM, Johannes Bauer wrote: >>> >>> However, now I run into a separate issue, namely a hang at the PIN prompt: >>> >>> Tue Jul 24 10:20:20 2018 us=793936 PKCS#11: Cal

Re: [Openvpn-users] ECC with PKCS#11

2018-07-24 Thread David Sommerseth
On 24/07/18 16:25, Selva Nair wrote: > On Tue, Jul 24, 2018 at 4:37 AM, Johannes Bauer wrote: >> >> However, now I run into a separate issue, namely a hang at the PIN prompt: >> >> Tue Jul 24 10:20:20 2018 us=793936 PKCS#11: Calling pin_prompt hook for >> 'UserPIN (SmartCard-HSM)' >> >> This is a

Re: [Openvpn-users] ECC with PKCS#11

2018-07-24 Thread Selva Nair
On Tue, Jul 24, 2018 at 4:37 AM, Johannes Bauer wrote: > > However, now I run into a separate issue, namely a hang at the PIN prompt: > > Tue Jul 24 10:20:20 2018 us=793936 PKCS#11: Calling pin_prompt hook for > 'UserPIN (SmartCard-HSM)' > > This is a know issue since 2015, unfortunately: > https:

Re: [Openvpn-users] ECC with PKCS#11

2018-07-24 Thread Johannes Bauer
On 23.07.2018 21:26, Selva Nair wrote: >>> Mon Jul 23 18:26:53 2018 PKCS#11: Unable get evp object > > I think this would indicate pkcs11-helper was built without enabling > EC support -- could happen if it was configured against openssl with > EC disabled. Geeze, you're brilliant. Man, that was

Re: [Openvpn-users] ECC with PKCS#11

2018-07-23 Thread Selva Nair
Hi, On Mon, Jul 23, 2018 at 12:49 PM, Johannes Bauer wrote: > Hi list, > > I'm setting up a concentrator on Debian Stretch using OpenVPN 2.4.0 and > have a Ubuntu client on 2.4.4. My clients have PKCS#11 smart cards with > secp256r1 ECC certificates/private keys. Key handling works fine with > pk

[Openvpn-users] ECC with PKCS#11

2018-07-23 Thread Johannes Bauer
Hi list, I'm setting up a concentrator on Debian Stretch using OpenVPN 2.4.0 and have a Ubuntu client on 2.4.4. My clients have PKCS#11 smart cards with secp256r1 ECC certificates/private keys. Key handling works fine with pkcs11-tool and OpenSSL. However, when I try to use the keys with OpenVPN,