yubikey PIV openssl ecdsa sign verify on windows

windows openssl

https://slproweb.com/products/Win32OpenSSL.html

Win64 OpenSSL v3.4.0

C:\Program Files\OpenSSL-Win64\bin\

----

Install PIV Tool for PKCS#11 library

https://developers.yubico.com/PIV/Tools.html

"C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll"

----

windows OpenSC

https://github.com/OpenSC/OpenSC/wiki/Windows-Quick-Start

https://github.com/OpenSC/OpenSC/releases

install OpenSC-0.25.1_win64.msi

C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe

----

== slot 9C sign

-- key generation

use yubikey Authenticator to generate "Digital Signature" in "slot 9c"

use yubikey Authenticator click export to export cert "9c.crt"

- extract publickey

openssl x509 -inform PEM -in 9c.crt -outform PEM -pubkey -nocert -out 9c_pubkey.pem

pkcs11-tool.exe --module "C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll" --sign --id 2 -m ECDSA-SHA256 --signature-format openssl -i ..\message.bin -o yubikey_9c.sig

ENTER 6 PIN (twice)

- verify

openssl dgst -sha256 -verify 9c_pubkey.pem -signature yubikey_9c.sig ..\message.bin

=== slot 9A sign

use yubikey Authenticator to generate "Authentication" in "slot 9a"

use yubikey Authenticator click export to export cert "auth_9a.crt"

- extract publickey

openssl x509 -inform PEM -in auth_9a.crt -outform PEM -pubkey -nocert -out auth_9a_pubkey.pem

pkcs11-tool.exe --module "C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll" --sign --id 1 -m ECDSA-SHA256 --signature-format openssl -i ..\message.bin -o yubikey_9a.sig

ENTER 6 PIN

- verify

openssl dgst -sha256 -verify auth_9a_pubkey.pem -signature yubikey_9a.sig ..\message.bin

----------------------------------------

key generation outside of yubikey

you need to make cert for a key.

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -days 3650 -nodes -keyout key.pem -out cert.pem -subj "/CN=ecc384"

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes -keyout key.pem -out cert.pem -subj "/CN=prime256v1"

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes -subj "/CN=rsa4096"

Use yubikey Authenticator to import a cert and a key. Import TWICE.

or

make a PKCS#12 file using a cert and a key.

openssl pkcs12 -export -out cert.p12 -inkey key.pem -in cert.pem -name "ecc384_cert"

yubico-piv-tool -a import-key -a import-certificate -s 9d -k -i cert.p12 -K PKCS12

(enter management key)