Генерация пары ГОСТ-2012 в OpenSC
Здравствуйте!
Использую OpenSC 0.18, OpenSSL 1.1.0, librtpkcs11ecp 1.6.5, rtengine.
В samples/tool/README.txt написано, что сгенерировать ключ OpenSSL через rtengine нельзя.
Пытаюсь сгенерировать через OpenSC.
$ opensc-tool -l
# Detected readers (pcsc)
Nr. Card Features Name
0 Yes Aktiv Rutoken ECP 00 00
$ pkcs11-tool --module /opt/aktivco/rutokenecp/x86_64/librtpkcs11ecp.so -M
*** Cryptoki library has already been initialized ***
Using slot 0 with a present token (0x0)
Supported mechanisms:
RSA-PKCS-KEY-PAIR-GEN, keySize={512,2048}, hw, generate_key_pair
RSA-PKCS, keySize={512,2048}, hw, encrypt, decrypt, sign, verify
RSA-PKCS-OAEP, keySize={512,2048}, hw, encrypt, decrypt
MD5, digest
SHA-1, digest
GOSTR3410-KEY-PAIR-GEN, hw, generate_key_pair
GOSTR3410, hw, sign, verify
mechtype-0x1204, hw, derive
mechtype-0xD4321005, hw, generate_key_pair
mechtype-0xD4321006, hw, sign, verify
mechtype-0xD4321007, hw, derive
GOSTR3411, hw, digest
mechtype-0xD4321012, hw, digest
mechtype-0xD4321013, hw, digest
GOSTR3410-WITH-GOSTR3411, hw, digest, sign
mechtype-0xD4321008, hw, digest, sign
mechtype-0xD4321009, hw, digest, sign
mechtype-0x1224, hw, wrap, unwrap
mechtype-0x1221, hw, encrypt, decrypt
mechtype-0x1222, hw, encrypt, decrypt
mechtype-0x1220, hw, generate
mechtype-0x1223, hw, sign, verify$ pkcs11-tool --module /opt/aktivco/rutokenecp/x86_64/librtpkcs11ecp.so --login --pin 12345678 --keypairgen --key-type GOSTR3410:B --id 3132
*** Cryptoki library has already been initialized ***
Using slot 0 with a present token (0x0)
Key pair generated:
Private Key Object; GOSTR3410
PARAMS OID: 06072a850302022302
label:
ID: 3132
Usage: sign
Public Key Object; GOSTR3410
PARAMS OID: 06072a850302022302
VALUE: 619d56126639eda006b22207ebcc362da6f2c1cd9bfbf7b909a7a68765941d24
493eb5182c629a6503df5ba35e620a1cea978b35f97655f6574a755a7185084c
label:
ID: 3132
Usage: verifyopenssl req -new -x509 -days 365 -subj '/CN=test/' -engine rtengine -keyform engine -key "pkcs11:id=12" > gost.pem
openssl x509 -inform pem -in gost.pem -outform der -out gost.der
$ openssl x509 -inform der -in gost.der -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
93:40:53:45:fc:cc:7c:ce
Signature Algorithm: GOST R 34.11-94 with GOST R 34.10-2001
Issuer: CN = test
Validity
Not Before: Aug 26 23:18:00 2018 GMT
Not After : Aug 26 23:18:00 2019 GMT
Subject: CN = test
Subject Public Key Info:
Public Key Algorithm: GOST R 34.10-2001
Public key:
X:241D946587A6A709B9F7FB9BCDC1F2A62D36CCEB0722B206A0ED396612569D61
Y:4C0885715A754A57F65576F9358B97EA1C0A625EA35BDF03659A622C18B53E49
Parameter set: id-GostR3410-2001-CryptoPro-B-ParamSet
X509v3 extensions:
X509v3 Subject Key Identifier:
DB:0B:9D:4D:15:F8:73:FC:AD:94:76:CC:BE:45:7F:CA:98:4E:48:3C
X509v3 Authority Key Identifier:
keyid:DB:0B:9D:4D:15:F8:73:FC:AD:94:76:CC:BE:45:7F:CA:98:4E:48:3C
X509v3 Basic Constraints: critical
CA:TRUE
Signature Algorithm: GOST R 34.11-94 with GOST R 34.10-2001
1d:45:33:94:94:d7:36:d6:05:66:ab:15:6d:40:5d:52:9f:4d:
7d:ea:60:fc:76:6c:90:19:af:8d:05:4f:23:0b:47:16:80:8a:
a3:c9:82:2a:e5:05:e4:e1:f1:56:27:39:d1:d3:b5:f7:80:ed:
1c:6f:05:42:6b:11:9c:c5:f1:86
-----BEGIN CERTIFICATE-----
MIIBazCCARigAwIBAgIJAJNAU0X8zHzOMAoGBiqFAwICAwUAMA8xDTALBgNVBAMM
BHRlc3QwHhcNMTgwODI2MjMxODAwWhcNMTkwODI2MjMxODAwWjAPMQ0wCwYDVQQD
DAR0ZXN0MGMwHAYGKoUDAgITMBIGByqFAwICIwIGByqFAwICHgEDQwAEQGGdVhJm
Oe2gBrIiB+vMNi2m8sHNm/v3uQmnpodllB0kST61GCximmUD31ujXmIKHOqXizX5
dlX2V0p1WnGFCEyjUzBRMB0GA1UdDgQWBBTbC51NFfhz/K2Udsy+RX/KmE5IPDAf
BgNVHSMEGDAWgBTbC51NFfhz/K2Udsy+RX/KmE5IPDAPBgNVHRMBAf8EBTADAQH/
MAoGBiqFAwICAwUAA0EAHUUzlJTXNtYFZqsVbUBdUp9Nfepg/HZskBmvjQVPIwtH
FoCKo8mCKuUF5OHxVic50dO194DtHG8FQmsRnMXxhg==
-----END CERTIFICATE-----Получается ГОСТ-2001.
Если попытаться задать хэш явно:
$ openssl req -new -x509 -days 365 -subj '/CN=test/' -md_gost12_256 -engine rtengine -keyform engine -key "pkcs11:id=12" > gost.pem
engine "rtengine" set.
Enter PKCS#11 token PIN:
unable to load 'random state'
This means that the random number generator has not been seeded
with much random data.
140112944571648:error:8107506F:lib(129):PKEY_GOST_CTRL:invalid digest type:/home/jenkins/newjenkins/workspace/rtengine-build/03532063/engine/orig/gost_pmeth.c:132:Возможно ли сгенерировать пару ГОСТ-2012 через OpenSC? Если нет, то как?