Alternative ncrypt implementation based on p11-kit

[ondrejholy]

Would you accept an alternative ncrypt implementation based on the p11-kit project (currently FreeRDP relies on pkcs11-helper)? I am asking because everything else uses the p11-kit project in RHEL for this purpose.

[hardening]

That could be nice, especially if p11-kit behaves better with proprietary drivers with which we sometime have troubles.

[Jakuje]

Do you have some example of the troubles you had with pkcs11-helper and proprietary drivers?

[ondrejholy]

@hardening, thanks for your reply, I will try to do so next month if all goes as expected.

[hardening]

@ondrejholy feel free to ask if the API is unclear (on the matrix channel)

[hardening]

I had private reports with SafeNet devices (if I'm correct these requires a library to work)

[Jakuje]

Yes, some of the safenet devices do not work with OpenSC. Can you be more specific in what were the issues you had with pkcs11-helper with these?

[hardening]

sorry I had not the hardware myself, it has been reported to me like "that doesn't work". When investigating it revealed that for some reason we were unable to list the cert/keys on the smartcard, while pkcs11-tool was able to. I've not been able to figure why (unable to open the slot)