Fosstodon

OpenSoul ✅Siamo nel #2025 e con <a href="https://mastodon.social/tags/Firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Firefox</a> sulle *buntu <a href="https://mastodon.social/tags/Opensc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Opensc</a> e tutti i certificati <a href="https://mastodon.social/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a> (quindi anche robe come la <a href="https://mastodon.social/tags/CNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CNS</a>) continuano a *NON* funzionare grazie al fantastico sistema <a href="https://mastodon.social/tags/SNAP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SNAP</a> che qualcuno nello staff di <a href="https://mastodon.social/tags/Ubuntu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ubuntu</a> ha detto semplicemente "freghiamocene", nonostante sia stato segnalato da ANNI il problemaVediamo quanti anni devono passare ancora... Io sono senza parole 😞

jakob 🇦🇹 ✅<a href="https://mastodon.social/users/nixCraft" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@nixCraft</a>Yes for sure! <a href="https://soc.schuerz.at/search?tag=PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a>

Guillaume-Jean Herbiet<a href="https://mastodon.social/@jpmens" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jpmens</a> Read that too and also had a look at <a href="https://mamot.fr/tags/cznic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cznic</a> <a href="https://mamot.fr/tags/Knot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Knot</a> for a <a href="https://mamot.fr/tags/dnssec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dnssec</a> bump-in-the-wire signer. Also seen that @nitrokey also has doc for <a href="https://mamot.fr/tags/Knot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Knot</a>: <a href="https://docs.nitrokey.com/nethsm/knotdns" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://docs.nitrokey.com/nethsm/knotdns</a> One operational question I have is the the ability to pre-generate keys once on the HSM, lock the <a href="https://mamot.fr/tags/pkcs11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pkcs11</a> interface and have <a href="https://mamot.fr/tags/Knot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Knot</a> use them for automatic roll-overs according to policy w/o creating new keys automatically. My understanding of <a href="https://mamot.fr/tags/Knot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Knot</a> manual mode is that key timing has to be done… well, manually!

Martin SchmittIch bereite einen Bugreport vor für einen proprietären Smartcardtreiber, der allein dadurch, dass er geladen wird, <a href="https://mastodon.online/tags/pcscd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pcscd</a> abspacken lässt, egal ob eine <a href="https://mastodon.online/tags/Smartcard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Smartcard</a> im Reader steckt oder nicht.Mit dem "normalen" onepin-opensc-pkcs11.so tritt das Problem nicht auf.Jetzt kommts: Kann jemand einen frei downloadbaren proprietären <a href="https://mastodon.online/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a>-Smartcardtreiber eines namhaften Anbieters 🤡 empfehlen, den ich daneben halten kann, ob er sich genauso erratisch verhält?

OejAre you using <a href="https://infosec.exchange/tags/SoftHSM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SoftHSM</a>? Join us on October 24th! Check the attachment for details.<a href="https://infosec.exchange/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKI</a> <a href="https://infosec.exchange/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a> <a href="https://infosec.exchange/tags/SOFTHSM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SOFTHSM</a> <a href="https://infosec.exchange/tags/OPENDNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OPENDNSSEC</a> <a href="https://infosec.exchange/tags/OPENSOURCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OPENSOURCE</a>

Kushal Das :python: :tor:What could cause <a href="https://toots.dgplug.org/tags/Firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Firefox</a> (after opening a new tab) to try to unlock a <a href="https://toots.dgplug.org/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a> by asking for PIN? <a href="https://toots.dgplug.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://toots.dgplug.org/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Voralpen Linux User GroupMorgen, am 14.06.2024 um 18:30 gibt es wieder ein <a href="https://floss.social/tags/VALUG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VALUG</a>-Treffen im Alten Schl8hof in <a href="https://floss.social/tags/Wels" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Wels</a>. <a href="https://chaos.social/@hkrat" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hkrat</a> wird diesmal Einblicke in die Thematik "<a href="https://floss.social/tags/HSM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HSM</a> (<a href="https://floss.social/tags/TPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TPM</a>, <a href="https://floss.social/tags/CAAM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CAAM</a>) & <a href="https://floss.social/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a>" gewähren. <a href="https://valug.at/events/2024-06-14-hsm/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://valug.at/events/2024-06-14-hsm/</a>

James BottomleyI finally dusted off my <a href="https://mastodon.online/tags/openssl" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssl</a> to <a href="https://mastodon.online/tags/pkcs11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pkcs11</a> conversion project to work with openssl3:<a href="https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl-pkcs11-export.git/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl-pkcs11-export.git/</a>This all came about because I wanted a pkcs11 capability rooted in the <a href="https://mastodon.online/tags/tpm2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tpm2</a> so I can use <a href="https://mastodon.online/tags/tpm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tpm</a> based keys on <a href="https://mastodon.online/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firefox</a> . However, since I'd already written the engine for tpm2, it seemed somewhat parochial to limit this to tpm2 only and instead I wrote the above to export every possible key type (including engine keys and hence tpm2 keys) from openssl.

Kan-Ru Chen從一開始入手 … <a href="https://kanru.info/fedora-pkcs11-ssh-and-pgp/" class="" rel="nofollow noopener noreferrer" target="_blank">閱讀全文 Fedora 上使用硬體加密的 SSH 與 PGP</a><a href="https://kanru.info/fedora-pkcs11-ssh-and-pgp/" rel="nofollow noopener noreferrer" target="_blank">https://kanru.info/fedora-pkcs11-ssh-and-pgp/</a>

:idle: OpenSoul :verified:Dopo altri <a href="https://mastodon.uno/tags/mesi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mesi</a>, questo è l'aggiornamento sulla vicenda 🤦 ...<a href="https://mastodon.uno/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firefox</a> <a href="https://mastodon.uno/tags/cns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cns</a> <a href="https://mastodon.uno/tags/snap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#snap</a> <a href="https://mastodon.uno/tags/canonical" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#canonical</a> <a href="https://mastodon.uno/tags/ubuntu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ubuntu</a> <a href="https://mastodon.uno/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a>

HeikoWhile exploring use of PKCS #11 devices in <a href="https://fosstodon.org/tags/OpenPGP" class="mention hashtag" rel="tag">#OpenPGP</a> contexts, I stumbled over a bug (and potential security issue) in the yubihsm_pkcs11.so driver for <a href="https://fosstodon.org/tags/YubiHSM" class="mention hashtag" rel="tag">#YubiHSM</a> devices.Long form text by Christian Reitter (who walked me through the coordinated disclosure process with <a href="https://fosstodon.org/tags/Yubico" class="mention hashtag" rel="tag">#Yubico</a>, and did amazing work analyzing and writing up the issue): <a href="https://blog.inhq.net/posts/yubico-yubihsm-pkcs-vuln/" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://blog.inhq.net/posts/yubico-yubihsm-pkcs-vuln/</a>Yubico advisory: <a href="https://www.yubico.com/support/security-advisories/ysa-2023-01/" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.yubico.com/support/security-advisories/ysa-2023-01/</a><a href="https://fosstodon.org/tags/CVE" class="mention hashtag" rel="tag">#CVE</a>: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39908" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39908</a>(Thanks again to <a href="https://mastodon.social/@sovtechfund" class="u-url mention">@sovtechfund</a> for funding my <a href="https://fosstodon.org/tags/PKCS11" class="mention hashtag" rel="tag">#PKCS11</a> work)

HeikoOver the last half year, I've spent time with PKCS #11 and PIV hardware security devices. In particular, using such devices in the <a href="https://fosstodon.org/tags/OpenPGP" class="mention hashtag" rel="tag">#OpenPGP</a> context.Entry points for results of this work:- <a href="https://codeberg.org/heiko/openpgp-pkcs11" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://codeberg.org/heiko/openpgp-pkcs11</a> - <a href="https://codeberg.org/heiko/openpgp-piv" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://codeberg.org/heiko/openpgp-piv</a> - <a href="https://codeberg.org/heiko/pkcs11-openpgp-notes" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://codeberg.org/heiko/pkcs11-openpgp-notes</a>One particular focus was building CI testing infrastructure (including <a href="https://gitlab.com/hkos/virtual-piv/" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://gitlab.com/hkos/virtual-piv/</a>), to make future work on these codebases easier (and hopefully fun).<a href="https://fosstodon.org/tags/PKCS11" class="mention hashtag" rel="tag">#PKCS11</a> <a href="https://fosstodon.org/tags/PIV" class="mention hashtag" rel="tag">#PIV</a> <a href="https://fosstodon.org/tags/HSM" class="mention hashtag" rel="tag">#HSM</a>[This work was funded by <a href="https://mastodon.social/@sovtechfund" class="u-url mention">@sovtechfund</a>]

Jamie ClarkOASIS Open is a cosponsor of this year's International Cryptographic Module Conference (<a href="https://infosec.exchange/tags/ICMC23" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ICMC23</a>) in Ottawa this September; two of our technical committees, <a href="https://infosec.exchange/tags/KMIP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KMIP</a> and <a href="https://infosec.exchange/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a>, are on the agenda. More details: <a href="https://icmconference.org" rel="nofollow noopener noreferrer" target="_blank">https://icmconference.org</a> <a href="https://infosec.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptography</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://infosec.exchange/tags/standards" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#standards</a>RT @CryptoModConf@twitter.com: Agenda Announced! The Industry Reconvenes this Fall in Ottawa to Review Changing Global Standards ... in commercial cryptography.

HeikoToday I spent a bit of time with the <a href="https://fosstodon.org/tags/YubiHSM" class="mention hashtag" rel="tag">#YubiHSM</a> and its <a href="https://fosstodon.org/tags/PKCS11" class="mention hashtag" rel="tag">#PKCS11</a> driver (the yubihsm_pkcs11.so driver had exhibited some confusing-to-me behavior, during occasional experiments over the past few weeks).After a closer look, I believe that "yubihsm_pkcs11.so" version 2.4.0 has introduced a number of rather confusing regressions around object IDs (see <a href="https://github.com/Yubico/yubihsm-shell/issues/345" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://github.com/Yubico/yubihsm-shell/issues/345</a> <a href="https://fosstodon.org/tags/Yubico" class="mention hashtag" rel="tag">#Yubico</a>).This investigation was a side-quest of my <a href="https://mastodon.social/@sovtechfund" class="u-url mention">@sovtechfund</a> financed project "PKCS#11 support for <a href="https://mastodon.social/@sequoiapgp" class="u-url mention">@sequoiapgp</a>".

Kushal Das :python: :tor:What are good <a href="https://toots.dgplug.org/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://toots.dgplug.org/tags/certificate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#certificate</a> authorities which allows <a href="https://toots.dgplug.org/tags/PKCS11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKCS11</a>? <a href="https://toots.dgplug.org/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PKI</a> <a href="https://toots.dgplug.org/tags/CA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CA</a> This need to be deployed for smaller orgs.<a href="https://abyssdomain.expert/@filippo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@filippo</a> any tips?

NLnet LabsAny <a href="https://fosstodon.org/tags/PKCS11" class="mention hashtag" rel="tag">#PKCS11</a> experts who want to chime in on this discussion, whether or not to mark private keys as unmodifiable? <a href="https://fosstodon.org/tags/cryptography" class="mention hashtag" rel="tag">#cryptography</a> <a href="https://fosstodon.org/tags/HSM" class="mention hashtag" rel="tag">#HSM</a> <a href="https://fosstodon.org/tags/security" class="mention hashtag" rel="tag">#security</a> <a href="https://fosstodon.org/tags/BestPractices" class="mention hashtag" rel="tag">#BestPractices</a> <a href="https://github.com/NLnetLabs/krill/issues/1018" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://github.com/NLnetLabs/krill/issues/1018</a>

NLnet LabsAs the adoption of Delegated and Hybrid <a href="https://fosstodon.org/tags/RPKI" class="mention hashtag" rel="tag">#RPKI</a> grows, so are the number of Hardware Security Modules (HSMs) out in the field that people store Krill's key material on. <a href="https://fosstodon.org/tags/KMIP" class="mention hashtag" rel="tag">#KMIP</a> is pretty straight forward, but especially <a href="https://fosstodon.org/tags/PKCS11" class="mention hashtag" rel="tag">#PKCS11</a> can be quite finicky. So we're keeping a public list of interoperability information. <a href="https://fosstodon.org/tags/BGP" class="mention hashtag" rel="tag">#BGP</a> <a href="https://fosstodon.org/tags/OpenSource" class="mention hashtag" rel="tag">#OpenSource</a> <a href="https://fosstodon.org/tags/interop" class="mention hashtag" rel="tag">#interop</a> <a href="https://fosstodon.org/tags/rustlang" class="mention hashtag" rel="tag">#rustlang</a> <a href="https://github.com/NLnetLabs/krill/issues?q=label%3A%22interop+testing%22+label%3A%22hsm%22" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://github.com/NLnetLabs/krill/issues?q=label%3A%22interop+testing%22+label%3A%22hsm%22</a> Learn more about the option to use HSMs here: <a href="https://krill.docs.nlnetlabs.nl/en/stable/hsm.html" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://krill.docs.nlnetlabs.nl/en/stable/hsm.html</a>

OPSEC Cybersecurity News LiveHow to create, use and backup android signing keys without trusting the computer? <a href="https://security.stackexchange.com/questions/267736/how-to-create-use-and-backup-android-signing-keys-without-trusting-the-computer" rel="nofollow noopener noreferrer" target="_blank">https://security.stackexchange.com/questions/267736/how-to-create-use-and-backup-android-signing-keys-without-trusting-the-computer</a> <a href="https://aspiechattr.me/tags/codesigning" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#codesigning</a> <a href="https://aspiechattr.me/tags/yubikey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#yubikey</a> <a href="https://aspiechattr.me/tags/backup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backup</a> <a href="https://aspiechattr.me/tags/pkcs11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pkcs11</a>

Petr Menšík :fedora:When playing with my <a href="https://fosstodon.org/tags/Yubi" class="mention hashtag" rel="tag">#Yubi</a> 5 key, I have hit a wall. OTP keys were not straight forward, but worked. <a href="https://fosstodon.org/tags/PKCS11" class="mention hashtag" rel="tag">#PKCS11</a> works fine. But moving secret key from <a href="https://fosstodon.org/tags/gpg" class="mention hashtag" rel="tag">#gpg</a> to the key became blocker. It just doesn't work! Gitlab's or GitHub's <a href="https://fosstodon.org/tags/fido" class="mention hashtag" rel="tag">#fido</a> works like charm though.

Recent searches

Search options

Administered by:

Server stats:

#pkcs11