p11sak - Man Page

generate and list token keys in an openCryptoki token repository.

Synopsis

p11sak command [Args] [Options]

p11sak --help|-h

Description

p11sak can be used to generate, list and delete the token keys in an openCryptoki token repository. The utility provides a flexible key management tool in openCryptoki to list and generate symmetric (DES; 3DES, AES) and asymetric (RSA, EC) keys. This tool is especially capable of a well defined listing of keys with their PKCS #11 attributes.

Commands

The p11sak tool can operate in three modes: when command generate-key is specified, it operates in the mode to generate a token key in the openCryptoki token repository. If command list-key is given, it lists the keys specified in the arguments. If command remove-key is given, it removes the keys specified in the arguments.

generate-key

Use the generate-key|gen-key|gen command and key argument to generate a token key with the respective [Args] and [Options]. The --help|-h option will show the arguments and options available.

list-key

Use the list-key|ls-key|ls command and key argument to list token keys given the respective [Args] and [Options]. The --help|-h option will show the arguments and options available.

remove-key

Use the remove-key|rm-key|rm command and key argument to delete token keys given the respective [Args] and [Options]. The --help|-h option will show the arguments and options available.

Generating DES/3DES keys

p11sak generate-key|gen-key|gen des|3des --slot SLOTID --pin PIN --label LABEL --attr [PMRLSEDGVWUAXNT] --help | -h

Use the generate-key command with the des|3des key argument to generate a DES or 3DES key. The --slot SLOTID and --pin PIN options are required to set the token to SLOTID and the token PIN. The --label option allows the user to set the LABEL attribute of the key and --attr [PMRLSEDGVWUAXNT] can be used to set the binary attributes of the key (see below for detailed description of the attributes).

Generating AES keys

p11sak generate-key|gen-key|gen aes 128|192|256 --slot SLOTID --pin PIN --label LABEL --attr [PMRLSEDGVWUAXNT] --help | -h

Use the generate-key aes 128|192|256 command and key argument to generate a AES key with 128, 192 or 256 bit length, respectively. The --slot SLOTID and --pin PIN options are required to set the token to SLOTID and the token PIN. The --label option allows the user to set the LABEL attribute of the key and --attr [PMRLSEDGVWUAXNT] can be used to set the binary attributes of the key (see below for detailed description of the attributes).

Generating RSA keys

p11sak generate-key|gen-key|gen rsa 1024|2048|4096 --slot SLOTID --pin PIN --label LABEL --exponent EXP --attr [PMRLSEDGVWUAXNT] --help | -h

Use the generate-key rsa 1024|2048|4096 command and key argument to generate a 1024, 2048 or 4096 bit RSA key, respectively. The --slot SLOTID and --pin PIN options are required to set the token to SLOTID and the token PIN. The --label option allows the user to set the LABEL attribute of the key and --attr [PMRLSEDGVWUAXNT] can be used to set the binary attributes of the key (see below for detailed description of the attributes). Furthermore, the --exponent EXP options allows the user to specify the exponent used for generating the RSA key. The default is set to 65537 according to the PKCS #11 standard.

Generating EC keys

p11sak generate-key|gen-key|gen ec CURVE --slot SLOTID --pin PIN --label LABEL --attr [PMRLSEDGVWUAXNT] --help | -h

Use the generate-key ec CURVE command and key argument to generate an EC key, where CURVE specifies the eliptic curve used to create the EC key. The following arguments can be used for respective curves: prime256v1 | prime192 | secp224 | secp384r1 | secp521r1 | secp265k1 | brainpoolP160r1 | brainpoolP160t1 | brainpoolP192r1 | brainpoolP192t1 | brainpoolP224r1 | brainpoolP224t1 | brainpoolP256r1 | brainpoolP256t1 | brainpoolP320r1 | brainpoolP320t1 | brainpoolP384r1 | brainpoolP384t1 | brainpoolP512r1 | brainpoolP512t1

Note: not all curves will be supported by all tokens and key generation will fail when the specified CURVE is not supported. The --slot SLOTID and --pin PIN options are required to set the token to SLOTID and the token PIN. The --label option allows the user to set the LABEL attribute of the key and --attr [PMRLSEDGVWUAXNT] can be used to set the binary attributes of the key (see below for detailed description of the attributes).

Listing symmetric and asymmetric keys

p11sak list-key|ls-key|ls des|3des|aes|rsa|ec|public|private|secret|all --slot SLOTID --pin PIN --long | -l --help | -h

Use the list-key | ls-key | ls command and key argument to list DES, 3DES, AES, RSA or EC keys, respectively. Public, private, secret, or all keys can also be listed irrespective of key type.

Deleting symmetric and asymmetric keys

p11sak remove-key|rm-key|rm des|3des|aes|rsa|ec --slot SLOTID --pin PIN --label LABEL --force | -f --help | -h

Use the remove-key | rm-key | rm command and key argument to delete DES, 3DES, AES, RSA, or EC keys, respectively. All specified cipher keys will be promted to be deleted unless  a specific key with the --label LABEL argument is selected. The user will be promted to confirm the deletion of the key. To suppress the promt, use the --force | -f option.

Args

des | 3des | aes | rsa | ec | public | private | secret | all

selects the respective symmetric or asymetric key to be generated or listed. The public|private|secret|all argument can only be used with the list-key command to list either public, private, secret, or all keys.

128|192|256

the aes argument has to be followed by either 128, 192 or 256 to set the respective key bit length of the AES key.

1024|2048|4096

the rsa argument has to be followed by either 1024, 2048 or 4096 to set the respective key bit length of the RSA key.

prime256v1 | prime192 | secp224 | secp384r1 | secp521r1 | secp265k1 | brainpoolP160r1 | brainpoolP160t1 | brainpoolP192r1 | brainpoolP192t1 | brainpoolP224r1 | brainpoolP224t1 | brainpoolP256r1 | brainpoolP256t1 | brainpoolP320r1 | brainpoolP320t1 | brainpoolP384r1 | brainpoolP384t1 | brainpoolP512r1 | brainpoolP512t1

the ec argument has to be followed by either of these CURVE to select the EC curve used to generate the key.

Options

--slot SLOTID

sets the token to SLOTID

--pin PIN

sets the token PIN to PIN

--label LABEL

sets the key label attribute to LABEL

--exponent EXP

sets the RSA exponent to EXP

--attr [P M R L S E D G V W U A X N T]

sets the binary attributes of a key.

Note: not all binary attributes are applicable to all keys and will be omitted if not applicable.

The attributes are set to FALSE by default and switched to TRUE when the letter that is associated with the given binary attribute is specified. The following letters are associated with the respective CK_ATTRIBUTE:

  • P - CKA_PRIVATE
  • M - CKA_MODIFIABLE
  • R - CKA_DERIVE
  • L - CKA_LOCAL
  • S - CKA_SENSITIVE
  • E - CKA_ENCRYPT
  • D - CKA_DECRYPT
  • G - CKA_SIGN
  • V - CKA_VERIFY
  • W - CKA_WRAP
  • U - CKA_UNWRAP
  • A - CKA_ALWAYS_SENSITIVE
  • X - CKA_EXTRACTABLE
  • N - CKA_NEVER_EXTRACTABLE
  • * - if in p11sak_defined_attrs.conf additional attributes are defined.

CKA_TOKEN and CKA_PRIVATE are set by default to TRUE. For multiple attributes, combine the letters in a string without white space, e. g. 'MlD'. An uppercase letter means true, while an lowercase letter equals false. From Example above: CKA_MODIFIABLE=true, CKA_LOCAL=false, CKA_DECRYPT=true

For asymmetric keys a user can set different custom attributes for the public and the private key. The separator is the symbol ":". The defined attributes in front of the separator are set for the public key and the attributes defined after the separator are set for the private key. When the  separator is not in the string, the defined attribute set is used for public and private key. To set  a configuration for only the public key, the string has to end with the separator and respectively,  to use a configuration for the private key only, the string has to start with the separator.

--long | -l

prints the list-key output in long format. If omitted, the output is in a short, tabular format.

--force | -f

to be used with the remove-key command to suppress the promt whether the user wants to delete the specified keys.

--help | -h

prints help for the usage of p11sak and/or the respective command.

Files

/usr/local/etc/opencryptoki/p11sak_defined_attrs.conf

In the output config file a user can define additional attributes, which are not  mentioned in the PKCS#11 standard. A custom filepath can be set with an environment  variable.

Environment Variables

P11sak_default_conf_file

A custom path for p11sak_defined_attrs.conf can be set with the environment variable P11SAK_DEFAULT_CONF_FILE. If none is set p11sak will first look for the file in the user  directory, followed by the standard installation path.

Exit Status

p11sak returns various error codes on fail:

CKR_ARGUMENTS_BAD (0x00000007)

The p11sak_defined_attrs.conf is not found.

CKR_DATA_INVALID (0x00000020)

The p11sak_defined_attrs.conf cannot be parsed or syntax is invalid.

CKR_ATTRIBUTE_TYPE_INVALID (0x00000012)

A given attribute type cannot be set for this key.

See Also

p11sak_defined_attrs.conf(5)

Referenced By

p11sak_defined_attrs.conf(5).

May 2020 3.18.0 openCryptoki