SC-HSM-TOOL(1) | OpenSC Tools | SC-HSM-TOOL(1) |
sc-hsm-tool - smart card utility for SmartCard-HSM
sc-hsm-tool [OPTIONS]
The sc-hsm-tool utility can be used from the command line to perform extended maintenance tasks not available via PKCS#11 or other tools in the OpenSC package. It can be used to query the status of a SmartCard-HSM, initialize a device, generate and import Device Key Encryption Key (DKEK) shares and to wrap and unwrap keys.
--initialize, -X
Use --so-pin to define SO-PIN for first initialization or to verify in subsequent initializations.
Use --pin to define the initial user pin value.
Use --pin-retry to define the maximum number of wrong user PIN presentations.
Use with --dkek-shares to enable key wrap / unwrap.
Use with --label to define a token label
--create-dkek-share filename, -C filename
Use --password to provide a password for encryption rather than prompting for one.
Use --pwd-shares-threshold and --pwd-shares-total to randomly generate a password and split is using a (t, n) threshold scheme.
--import-dkek-share filename, -I filename
Use --password to provide a password for decryption rather than prompting for one.
Use --pwd-shares-total to specify the number of shares that should be entered to reconstruct the password.
--wrap-key filename, -W filename
Use --pin to provide the user PIN on the command line.
--unwrap-key filename, -U filename
Determine the key reference using the output of pkcs15-tool -D.
Use --pin to provide a user PIN on the command line.
Use --force to remove any key, key description or certificate in the way.
--dkek-shares number-of-shares, -s number-of-shares
This is an optional parameter. Using --initialize without --dkek-shares will disable the DKEK completely.
Using --dkek-shares with 0 shares requests the SmartCard-HSM to generate a random DKEK. Keys wrapped with this DKEK can only be unwrapped in the same SmartCard-HSM.
After using --initialize with one or more DKEK shares, the SmartCard-HSM will remain in the initialized state until all DKEK shares have been imported. During this phase no new keys can be generated or imported.
--so-pin value
--pin value
--pin-retry value
--password value
--pwd-shares-threshold value
--pwd-shares-total value
--force
--label label, -l label
--reader num, -r num
--wait, -w
--verbose, -v
Create a DKEK share:
sc-hsm-tool --create-dkek-share dkek-share-1.pbe
Create a DKEK share with random password split up using a (3, 5) threshold scheme:
sc-hsm-tool --create-dkek-share dkek-share-1.pbe --pwd-shares-threshold 3 --pwd-shares-total 5
Initialize SmartCard-HSM to use a single DKEK share:
sc-hsm-tool --initialize --so-pin 3537363231383830 --pin 648219 --dkek-shares 1 --label mytoken
Import DKEK share:
sc-hsm-tool --import-dkek-share dkek-share-1.pbe
Import DKEK share using a password split up using a (3, 5) threshold scheme for encryption:
sc-hsm-tool --import-dkek-share dkek-share-1.pbe --pwd-shares-total 3
Wrap referenced key, description and certificate:
sc-hsm-tool --wrap-key wrap-key.bin --key-reference 1 --pin 648219
Unwrap key into same or in different SmartCard-HSM with the same DKEK:
sc-hsm-tool --unwrap-key wrap-key.bin --key-reference 10 --pin 648219 --force
sc-hsm-tool was written by Andreas Schwier <andreas.schwier@cardcontact.de>.
01/23/2022 | opensc |