Search code examples
pkcs#11openscpkcs11interop

Exception "CKR_FUNCTION_NOT_SUPPORTED", PKCS11Interop with OpenSC


I am trying to use PKCS11Interop Library with latest version (0.16) of OpenSC (opensc-pkcs11.dll). I have tried USB tokens from three vendors which are Yubico 4, NitroKey Pro/Start, Fetian ePass2003 but unable to use most of the functions from PKCS11Interop Library. I receive Net.Pkcs11Interop.Common.Pkcs11Exception: 'Method C_SignRecoverInit returned CKR_FUNCTION_NOT_SUPPORTED' for most of functions provided by the library. The functions that throw this exception are C_GetOperationState, C_SetOperationState, C_GenerateKey, C_GenerateKeyPair, Encrypt/Decrypt functions, Sign/Verify functions etc.

The strange thing is functions like GetSlotInfo, GetMechanisms, Login, Session works fine.

I have spent a lot of time trying to find a solution here. Would appreciate if anyone can help on this.


Solution

  • Net.Pkcs11Interop.Common.Pkcs11Exception always indicates error returned by the underlying unmanaged PKCS#11 library which is usually provided by the device vendor.

    Error you are receiving - CKR_FUNCTION_NOT_SUPPORTED - indicates that unmanaged PKCS#11 library does not support/implement particular function defined in PKCS#11 specification.

    OpenSC source code confirms your finding that it does not support C_SignRecoverInit and also a few other functions.

    BTW this is normal and pretty common behavior. You will hardly find PKCS#11 library that supports all PKCS#11 functions. If PKCS#11 library provided by OpenSC does not provide some function you really need then I suggest you check other solutions provided by commercial vendors.