Public Key Authentication (PKA) with a n-of-m threshold scheme is a feature that has been available in the SmartCard-HSM for more than a decade. So far only the PKI-as-a-Service and the SmartCard-HSM JCE-Provider had support for PKA, because the PKCS#11 API does not provide mechanisms for this kind of authentication. That is why most PKCS#11 aware applications only support PIN or pass phrase for authentication.
With the SmartCard-HSM Cloud Service and the new remote login feature in the SmartCard-HSM PKCS#11 Module you can now use Public Key Authentication with most PKCS#11 applications.
Remote login means, that you can configure the PKCS#11 module so that it indicates CKF_PROTECTED_AUTHENTICATION_PATH
to the application. The application then calls C_Login() without prompting for a PIN and the module connects to an
URL configured in the PKCS11_LOGIN_URL environment variable using
RAMOverHTTP.
The service listening at the URL endpoint can then connect to the SmartCard-HSM and perform whatever is required to login. When the service terminates the RAMOverHTTP session, the C_Login() resumes and passes back control to the application.
The user interface is similar to using a PIN-PAD reader. Such a device is also indicated to the calling application with CKF_PROTECTED_AUTHENTICATION_PATH. XCA for examples prompts “Please enter the PIN on the PIN-PAD” in that case. Instead you switch to the web-service and enter the PIN there or perform PKA.
To give this a try, you can run the SmartCard-HSM Cloud Service locally and call the sc-hsm-pkcs-test with
$ PKCS11_LOGIN_URL=http://localhost:8080/rt/hsm ./sc-hsm-pkcs11-test --module ../pkcs11/.libs/libsc-hsm-pkcs11.so
PKCS11 unit test running.
Calling C_GetFunctionList Calling C_Initialize - CKR_OK : Passed
Calling C_GetInfo - CKR_OK : Passed
Calling C_GetSlotList - CKR_OK : Passed
Calling C_GetSlotInfo for slot 1 - CKR_OK : Passed
Slot manufacturer: CardContact
Slot ID : Slot description: 1 : REINER SCT cyberJack RFID basis 00 00
Slot flags: 7
Calling C_GetTokenInfo - CKR_OK : Passed
Token label : SmartCard-HSM
Token manufacturer: CardContact (www.cardcontact.de)
Token model : SmartCard-HSM
Token flags : 50d
Calling C_OpenSession - CKR_OK : Passed
Calling C_Login User to connect to http://localhost:8080/rt/hsm
- CKR_OK
Calling C_CloseSession - CKR_OK : Passed
Calling C_Finalize - CKR_OK : Passed
Unit test finished.
7 tests performed.
0 tests failed.
The same should work with XCA when using
$ PKCS11_LOGIN_URL=http://localhost:8080/rt/hsm xca
assuming that you configured the libsc-hsm-pkcs11.so module in XCA.
The actual login is done on the SmartCard-HSM Cloud Service webpage. Once the module has connected, a refresh shows the
SmartCard-HSM status page. You can there enter the PIN or perform PKA. When finished, you press Disconnect,
but remember to select the “Stay logged in” option. Without that option, the disconnect will
de-authenticate the online session.