PKCS11 devices and their mechanisms

[msetina]

It would be a good idea to have a list of PKCS11 devices, where they can be had and their mechanisms. So basicaly:
Device name:
Mechanisms: (output from pkcs11-tool -M )
rsa: with what the range of numbers is supported
ec:<string|oid> with a list of known oids
...

The last two things (stolen from @mat813) is something that is in some device specifications, but ...

[msetina]

Card name:OpenPGP Smart Card V3.4
Mechanisms:
SHA-1, digest
SHA224, digest
SHA256, digest
SHA384, digest
SHA512, digest
MD5, digest
RIPEMD160, digest
GOSTR3411, digest
ECDSA, keySize={256,521}, hw, sign, verify, EC OID
ECDSA-SHA1, keySize={256,521}, sign, verify
ECDSA-SHA224, keySize={256,521}, sign, verify
ECDSA-SHA256, keySize={256,521}, sign, verify
ECDSA-SHA384, keySize={256,521}, sign, verify
ECDSA-SHA512, keySize={256,521}, sign, verify
ECDH1-COFACTOR-DERIVE, keySize={256,521}, hw, derive, EC OID
ECDH1-DERIVE, keySize={256,521}, hw, derive, EC OID
ECDSA-KEY-PAIR-GEN, keySize={256,521}, hw, generate_key_pair, EC OID
RSA-PKCS, keySize={2048,4096}, hw, decrypt, sign, verify
SHA1-RSA-PKCS, keySize={2048,4096}, sign, verify
SHA224-RSA-PKCS, keySize={2048,4096}, sign, verify
SHA256-RSA-PKCS, keySize={2048,4096}, sign, verify
SHA384-RSA-PKCS, keySize={2048,4096}, sign, verify
SHA512-RSA-PKCS, keySize={2048,4096}, sign, verify
MD5-RSA-PKCS, keySize={2048,4096}, sign, verify
RIPEMD160-RSA-PKCS, keySize={2048,4096}, sign, verify
RSA-PKCS-KEY-PAIR-GEN, keySize={2048,4096}, hw, generate_key_pair

[Jakuje]

Most of the cards in OpenSC have very similar list of mechanisms as the digests and hashed operations are mostly implemented in software.

I think, if you want, creating the information of rsa key size, ecc curves and some free-form information about the limitation for few cards that do not support Raw RSA operations

[msetina]

I would like to see information about different cards used by users. This could be an exchange discussion to support user decission makeing before buying a card to use with different types of keys. This is hard to find on the internet and also it helps proliferate OpenSC. For use WIKI is a good point. PKCS11 has a wide list of supported key types, but in my case I mostly saw cards with RSA and EC.
Also it would be nice to see which cards support OAEP and PSS.

[Jakuje]

PKCS11 has a wide list of supported key types, but in my case I mostly saw cards with RSA and EC.

These are the only mechanisms that make sense for the PKI and smart cards these days. We will likely see some PQC coming sooner or later.

Also it would be nice to see which cards support OAEP and PSS.

This is just the RSA padding. These are mostly supported if the card supports Raw RSA and then it is implemebed by OpenSC. Or if the card implements these operation themselves (there are few of them, namely IDPrime, sc-hsm, I think), but you will not distinguish this from the mechanism listing.

The PKCS#11 standard is not only about smart cards though. Various other mechanisms are usable in different applications such as HSM or crypto accelerators.

[msetina]

For RSA padding I understand that it is visible in mechanism with mechanisms that end with PSS or OAEP. This is how user can decide what to require from a device.
Documentation and samples are sparse, but some may want to use a device that can support those newer methodologies.

[dengert]

Documentation and samples are sparse, but some may want to use a device that can support those newer methodologies.

If and when such a device becomes available, someone with such a device, documentation and understating of OpenSC will submit a PR. It could be a device vendor, a distro developer, an employee of an organization that wants to use such a device or it could be you.

[msetina]

Card name:
Oberthur Cosmopolic 64K v5.2 D
OpenSC presents as ActivIdentity Activkey_Sim 00 00
3b:7b:18:00:00:00:31:c0:64:77:e3:03:00:82:90:00
Mechanisms:
SHA-1, digest
SHA224, digest
SHA256, digest
SHA384, digest
SHA512, digest
MD5, digest
RIPEMD160, digest
GOSTR3411, digest
RSA-X-509, keySize={1024,3072}, hw, decrypt, sign, verify
RSA-PKCS, keySize={1024,3072}, hw, decrypt, sign, verify
SHA1-RSA-PKCS, keySize={1024,3072}, sign, verify
SHA224-RSA-PKCS, keySize={1024,3072}, sign, verify
SHA256-RSA-PKCS, keySize={1024,3072}, sign, verify
SHA384-RSA-PKCS, keySize={1024,3072}, sign, verify
SHA512-RSA-PKCS, keySize={1024,3072}, sign, verify
MD5-RSA-PKCS, keySize={1024,3072}, sign, verify
RIPEMD160-RSA-PKCS, keySize={1024,3072}, sign, verify
RSA-PKCS-PSS, keySize={1024,3072}, hw, sign, verify
SHA1-RSA-PKCS-PSS, keySize={1024,3072}, sign, verify
SHA224-RSA-PKCS-PSS, keySize={1024,3072}, sign, verify
SHA256-RSA-PKCS-PSS, keySize={1024,3072}, sign, verify
SHA384-RSA-PKCS-PSS, keySize={1024,3072}, sign, verify
SHA512-RSA-PKCS-PSS, keySize={1024,3072}, sign, verify
RSA-PKCS-OAEP, keySize={1024,3072}, hw, decrypt

[dengert]

https://smartcard-atr.apdu.fr/parse?ATR=3b%3A7b%3A18%3A00%3A00%3A00%3A31%3Ac0%3A64%3A77%3Ae3%3A03%3A00%3A82%3A90%3A00
says this is a "Oberthur Cosmopolic 64K v5.2 D" card.

But the ATR does not uniquely identify a card, and some fields in the ATR may be set based on what a application (i.e. applet)
is on the card?
Who wrote the applet?
What version of the applet?
hat standard is the applet following?

There are multiple versions of some applets, including some written by multiple people in open source which may or may not have implemented all the features of the applet standard.

All your list is showing is OpenSC knows something about it.
There are other cards/tokens that OpenSC may not support at all.

The "ActivIdentity Activkey_Sim" is the name of the reader, which maybe part of a token or a reader with an inserted card.

[msetina]

In my case it is an USB key and on it it says ActiveIdentity ACTIVEKEY SIM. This is why I did not search for more info. All and all it is a USB reader that takes a SIM card (cutout). The SIM has some numbers on it, but no name.