Tested card types include the following (this list is not complete):
IDPrimePKCS11 DLL from IDGo 800 Installer
eTPKCS11 DLL from SAC Installer
830 Card (tested with version 10.6 and 10.7)
840 Card (tested with version 10.6)
IDPrimePKCS11 DLL from SAC Installer
940 Card (tested with version 10.7)
940 USB Token, e.g. SafeNet eToken 5110 CC (tested with version 10.7 and 10.8 R2)
SafeNet eToken 5110 FIPS is NOT supported! Only SafeNet eToken 5110 CC is supported.
SAC 10.8 R2 no longer ships with dedicated drivers for USB tokens and uses the standard smartcard drivers from Windows, resulting in different reader and slot names.
PUK is permanently blocked after 5 consecutive failed attempts. The card can not be used anymore.
Initial PUK is a byte-array with 24 zero bytes. The PUK is identical to the Card Manager Key.
Initial PIN is 0000.
The PUK is referred to as "Admin PIN".
The PIN is referred to as "User PIN"
If multipin is enabled during installation and
ForcePinUseris set to false (that is, set to 0) (see heading "Configuration" below), when creating a keypair you will be prompted to select its PIN.
Support for cards with signature slot
Gemalto IDPrime 940 cards and USB tokens (like SafeNet eToken 5110 CC) contain a secondary slot for digital signatures, using its own set of credentials. The factory default for the signature PIN and PUK is 000000 for each. From PRIME 3.12, these are supported on the IDPrimePKCS11 DLLs that are included with a recent Safenet Authentication Client (SAC) Installer. SAC version 10.7 or later is required, see above for tested versions.
The PKCS11 library setting depends on the DLL and installer you used:
Define like this in the encoding description for the most compatible PKCS11Library setting for IDPrimePKCS11 (this one works with Smart ID Desktop App as well):
Version 10.8R2 of the SafeNet Authentication Client installer also uses these new locations in addition to the ones listed under 1.) above, and you may choose to reference the new locations (this works with Smart ID Desktop App as well):
Define like this in the encoding description for eTPKCS11 DLL from SafeNet Authentication Client installer (recommended only if you do not need the signature slot):
Do not use the PUK in encodings, use only the Card Manager Key (CMK). The two keys are identical but using a PUK with our implementation would only limit the effective key size.
To set the current CMK, use the keyword CardManagerKey.
To set a new CMK, use the keyword NewCardManagerKey, the same way as a new PUK is set.
The CMK must always be a sequence of 24 bytes. To set this value, specify the hex values of the bytes.
Define like this in the encoding description to set the CMK:
Define like this in the encoding description to reset the CMK:
Deviations from PKCS#11 standard
Tokens are always preinitialized. The initial PUK is a bytearray consisting of 24 nullbytes.
A new PUK must always be 24 bytes long.
The following restrictions apply:
- For RSA keys, the only supported key size values are 1024 and 2048 bits.
- For RSA key pairs, the only value supported for the public exponent is 0x010001.
If this function is called on a main slot (not virtual slot) and if the ForcePinUser option is set to 0 in the configuration file, then a dialog window is displayed in order to choose which PIN the resulting key pair should be associated with.
This applies to the original Gemalto IDGo 800 installer only!
To configure logging behaviour:
- Edit C:\ProgramData\Gemalto\PKCS11\Gemalto.PKCS11.ini.
Lines 8, 10 and 13 are used to configure logging behaviour.
- Set ForcePinUser to 1 to force any generated keys to be associated to the user PIN. This is how other cards generally behave. If set to 0, the user will be prompted to select which PIN the keypair should be associated with every time a keypair is generated, see heading "C_GenerateKeyPair" above.
This is an example of a configuration file:
Known issues and troubleshooting
Identity Manager versions before 3.10.6 / 3.11 have a bug that fails to detect the eTPKCS11 middleware type correctly. This causes a change to the PUK/cardManagerKey to silently fail. Therefore the PUK/cardManagerKey on the card is still the old one, but Identity Manager thinks it was changed, thus breaking the unblocking process.
Upgrade to Identity Manager 3.10.6 or 3.11 to solve the issue. Note that this will not automatically fix cards which were produced with the broken version.
With a lot of certificates on the card, but about 9Kb on the card still free according to the Mini-Driver Manager, InitToken or DestroyObject returned CKR_DEVICE_MEMORY. Even the Mini-Driver Manager crashed when attempting "Erase Card".
Delete single containers through the GUI. At 11Kb free, InitToken succeeded again (with 830 rev.A cards).
Trying to write a CA certificate that is already on the card fails with C_CreateObject failed with CKR_FUNCTION_FAILED. JPKIEncoder will notice this and will avoid trying to rewrite it.
You get an error like this in the log when trying to encode a card through Smart ID Desktop App:
Make sure the DLLs are present and specified in a correct way (absolute paths are usually required, see DLL Locations above).
Trying to delete a CA certificate can sometimes result in a state in which the certificate is no longer visible through PKCS#11, but still present on the card and visible through the SafeNet Authentication Client (SAC).
Observed e.g. with IDPrime DLLs from SAC 10.7 .
Manually delete the certificate with SAC (multiple attempts might be needed) to fully remove it.
Similarly, trying to delete a CA certificate can sometimes result in a state where the certificate is not deleted but its label changed to a UUID.
Observed e.g. with IDPrime DLLs from SAC 10.8 R2 and eTPKCS11 DLLs from SAC 10.7 .
Either manually delete the certificate with SAC or re-run the deletion (provided you are not using LABEL as deletion criteria, which would now fail to find the certificate).