Configuring the PKCS#11 cryptographic ICA token

Edit online

The PKCS#11 cryptographic ICA token is not initialized by default. If it has never been used by any other application, it is probably not initialized and the PKCS#11 API does not work correctly when using the ICA token.

The openCryptoki package includes a utility pkcsconf to display and configure the state of the tokens managed by the pkcsslotd daemon.

To initialize the cryptographic ICA token with pkcsconf the following steps must be completed:

Sample command: display the PKCS#11 token info

# pkcsconf -t
Token #0 Info: 
	Label: IBM ICA  PKCS #11               
	Manufacturer: IBM Corp.       
	Model: IBM ICA         
	Serial Number: 123             
	Flags: 0x880045 (RNG|LOGIN_REQUIRED|CLOCK_ON_TOKEN|
         USER_PIN_TO_BE_CHANGED|SO_PIN_TO_BE_CHANGED) 
	Sessions: 0/-2 
	R/W Sessions: -1/-2 
	PIN Length: 4-8 
	Public Memory: 0xFFFFFFFF/0xFFFFFFFF 
	Private Memory: 0xFFFFFFFF/0xFFFFFFFF 
	Hardware Version: 1.0 
	Firmware Version: 1.0 
	Time: 13:32:27

In this case Token #0 is the ICA token and the token is not initialized according to its flags 0x880045. The Security Officer (SO) and the user pin are not set.

An already initialized token shows these flags:

0x44D (RNG|LOGIN_REQUIRED|USER_PIN_INITIALIZED|CLOCK_ON_TOKEN|TOKEN_INITIALIZED)

Note: The ICA token slot number (here it is #0) may differ on other Linux™ distributions.

The following steps show how to initialize the cryptographic token:

Initialize the token:
```
# pkcsconf -c 0 -I 
Enter the SO PIN: ########
Enter a unique token label: IBMICATOK
```
The parameter -c is the token slot (0 for the ICA token in this case). The SO pin is required for token initialization (default SO pin is 87654321). Enter a unique token label afterwards. This label is required later when the token is referenced from applications.

Set a new SO pin:

# pkcsconf -c 0 -P 
Enter the SO PIN: ########
Enter the new SO PIN: ######## 
Re-enter the new SO PIN: ########

Initialize and set the user pin:

# pkcsconf -c 0 -u 
Enter the SO PIN: ######## 
Enter the new user PIN: ######## 
Re-enter the new user PIN: ########

After the user pin has been initialized, the flag USER_PIN_TO_BE_CHANGED is set. It is recommended to explicitly set a new user pin afterwards.

# pkcsconf -c 0 -p 
Enter user PIN: ######## 
Enter the new user PIN: ######## 
Re-enter the new user PIN: ########

The fully initialized ICA token now looks like this:

Sample command: display the ICA token info after its initialization

# pkcsconf -t 
Token #0 Info: 
	Label: IBMICATOK
	Manufacturer: IBM Corp.
	Model: IBM ICA 
	Serial Number: 123 
	Flags: 0x44D (RNG|LOGIN_REQUIRED|USER_PIN_INITIALIZED|
            CLOCK_ON_TOKEN|TOKEN_INITIALIZED) 
	Sessions: 0/-2 
	R/W Sessions: -1/-2 
	PIN Length: 4-8 
	Public Memory: 0xFFFFFFFF/0xFFFFFFFF 
	Private Memory: 0xFFFFFFFF/0xFFFFFFFF 
	Hardware Version: 1.0 
	Firmware Version: 1.0 
	Time: 15:37:35