Exception “CKR_FUNCTION_NOT_SUPPORTED”, PKCS11Inte

Question

I am trying to use PKCS11Interop Library with latest version (0.16) of OpenSC (opensc-pkcs11.dll). I have tried USB tokens from three vendors which are Yubico 4, NitroKey Pro/Start, Fetian ePass2003 but unable to use most of the functions from PKCS11Interop Library. I receive Net.Pkcs11Interop.Common.Pkcs11Exception: 'Method C_SignRecoverInit returned CKR_FUNCTION_NOT_SUPPORTED' for most of functions provided by the library. The functions that throw this exception are C_GetOperationState, C_SetOperationState, C_GenerateKey, C_GenerateKeyPair, Encrypt/Decrypt functions, Sign/Verify functions etc.

The strange thing is functions like GetSlotInfo, GetMechanisms, Login, Session works fine.

I have spent a lot of time trying to find a solution here. Would appreciate if anyone can help on this.

Answer 1

C_SignRecoverInit functions are not implemented in most of the drivers in OpenSC. The other functions should be fine and if not, read what to do and how to report the bugs in the OpenSC wiki.

Answer 2

Net.Pkcs11Interop.Common.Pkcs11Exception always indicates error returned by the underlying unmanaged PKCS#11 library which is usually provided by the device vendor.

Error you are receiving - CKR_FUNCTION_NOT_SUPPORTED - indicates that unmanaged PKCS#11 library does not support/implement particular function defined in PKCS#11 specification.

OpenSC source code confirms your finding that it does not support C_SignRecoverInit and also a few other functions.

BTW this is normal and pretty common behavior. You will hardly find PKCS#11 library that supports all PKCS#11 functions. If PKCS#11 library provided by OpenSC does not provide some function you really need then I suggest you check other solutions provided by commercial vendors.