How to get number of password retries in eToken SafeNet by IAIK PKCS#11

Question

I use Java and IAIK to read eToken info.

Module pkcs11Module = Module.getInstance("PKCS11.dll");
    pkcs11Module.initialize(null);
    Slot[] slotsWithToken = pkcs11Module.getSlotList(Module.SlotRequirement.TOKEN_PRESENT);
    log.info("number of slots: {}", slotsWithToken.length);
    Token[] tokens = new Token[slotsWithToken.length];
    for (int i = 0; i < slotsWithToken.length; i++) {
        Session session = null;
        TokenInfo tokenInfo = null;
        try {
            tokens[i] = slotsWithToken[i].getToken();
            tokenInfo = tokens[i].getTokenInfo();

This is the information I took out:

Information returned only 'Security Officer PIN final Try' true of false. However I need to know how many times I have to re-enter the password so that I can notify the user. I've searched online but there's no positive result.

Alexander · Answer 1 · 2022-03-28T07:40:59.563

2

There are exist Supplementary API (SAPI) for eToken located inside of eTSAPI.dll.

The method you need to call is:

CK_RV SAPI_GetSlotInfo(
  CK_SLOT_ID slotId, 
  CK_ATTRIBUTE_PTR pTemplate,
  CK_ULONG ulCount);

You must query this four attributes (values are DWORD types):

#define CKA_SAPI_RETRY_USER                  0x80001110
#define CKA_SAPI_RETRY_SO                    0x80001111
#define CKA_SAPI_RETRY_USER_MAX              0x80001112
#define CKA_SAPI_RETRY_SO_MAX                0x80001113

Documentation link.

C# prototype can look like

[DllImport("eTSAPI.dll", CallingConvention=CallingConvention.Cdecl, CharSet = CharSet.Ansi)]
static extern UInt32 SAPI_GetSlotInfo(UInt32 slotId, [In, Out] CK_ATTRIBUTE[] template, UInt32 count);

Have a look how Pkcs11Interop implement C_GetAttributeValue method.

edited Mar 28 '22 at 07:40

answered Mar 16 '22 at 14:30

Alexander

1,232
1
15
24

thanks for your help, Can you give me a document for reference? – htan Mar 17 '22 at 02:09
Documents is not so easy. I'll check. – Alexander Mar 17 '22 at 06:37
Thank you so much. I send email to IAIK to ask and waiting for a response. – htan Mar 17 '22 at 06:46
I have been googled and found it. Now I can share it with you. – Alexander Mar 17 '22 at 17:25
Thank you for giving me direction but i can't access to eTSAPI.dll by java. I searched google but nothing. how to use eTSAPI.dll in java or C#. Thank you very much – htan Mar 22 '22 at 04:42
This is possible to call for extension from C#. I'll check. – Alexander Mar 26 '22 at 06:51
I am anxiously waiting for your reply. I think if c# can do it, java can do it too – htan Mar 28 '22 at 07:09
Check my new edits to answer. – Alexander Mar 28 '22 at 07:41

Otto Touzil · Accepted Answer · 2022-03-17T08:35:35.697

1

Using standard pkcs#11 calls, there is no way to get the actual number of (possible) retries.

For the user's pin, there are the flags:

CKF_USER_PIN_COUNT_LOW and
CKF_USER_PIN_FINAL_TRY

For the SO pin, there are the flags:

CKF_SO_PIN_COUNT_LOW and
CKF_SO_PIN_FINAL_TRY

Which you can check on the TokenInfo class. So you can 'only' display a warning on the final try. Please also refer to the pkcs#11 specification.

However, as Alexander mentioned in another answer there might be a vendor defined api for this.

edited Mar 17 '22 at 08:35

answered Mar 17 '22 at 08:29

Otto Touzil

56
5

Thank you for your help. I also find it really impossible – htan Mar 17 '22 at 08:53

How to get number of password retries in eToken SafeNet by IAIK PKCS#11

2 Answers2