Accessing USB HSM Token on Ubuntu 24.04 using p11-tool

Accessing Nitrokey HSM Token on Ubuntu 24.04 using p11-tool

In this article, we will discuss how to access a Nitrokey HSM token on Ubuntu 24.04 using the p11-tool command-line interface. We will cover the key concepts related to PKCS #11 tokens, the p11-tool, and how to use it to access the Nitrokey HSM token. We will also provide some code blocks to demonstrate the commands used in this tutorial.

What is a PKCS #11 Token?

PKCS #11, also known as "Cryptoki," is a standard for cryptographic tokens, which are hardware devices that securely store and manage cryptographic keys. PKCS #11 tokens can be used for various cryptographic operations, such as encryption, decryption, signing, and authentication.

A PKCS #11 token can be a smart card, a USB token, or a hardware security module (HSM). In this article, we will focus on using a USB HSM token, specifically the Nitrokey HSM.

What is p11-tool?

p11-tool is a command-line interface for managing PKCS #11 tokens. It allows you to perform various operations on the token, such as listing its slots, sessions, and objects, as well as performing cryptographic operations.

p11-tool is part of the p11-kit library, which provides a common API for accessing PKCS #11 tokens on various platforms, including Linux, macOS, and Windows.

Listing Nitrokey HSM Token URLs

Before we can use p11-tool to access the Nitrokey HSM token, we need to find its URL. A PKCS #11 token's URL is a string that identifies the token and its driver.

To list the available PKCS #11 token URLs on your system, you can run the following command:

This command will output a list of PKCS #11 modules and their corresponding URLs. Look for the Nitrokey HSM token in the list of modules and note down its URL.

Running a Local Session

Once you have the Nitrokey HSM token's URL, you can use p11-tool to open a local session with the token. A local session is a communication channel between the p11-tool and the token, which allows you to perform cryptographic operations on the token.

To open a local session with the Nitrokey HSM token, run the following command:

Replace pkcs11:model=p11-kit-trust;manufacturer=PKCS%21 with the Nitrokey HSM token's URL that you found in the previous step.

The --login option prompts you to enter the token's PIN code. Enter the PIN code when prompted, and you will be logged in to the token.

Performing Cryptographic Operations

Once you have opened a local session with the Nitrokey HSM token, you can use p11-tool to perform various cryptographic operations, such as generating keys, encrypting data, and signing messages.

For example, to generate a new RSA key pair on the Nitrokey HSM token, run the following command:

References

• PKCS #11 Specification
• p11-kit Documentation
• Nitrokey HSM Documentation