dump info about a Hardware Security Key (HSK) or Hardware Security Module (HSM)

get-hsk-info.sh

#!/bin/sh
#
# get-hsk-info.sh: dump info about a Hardware Security Key (HSK) or Hardware Security Module (HSM)
#
# Mauro A. Meloni <com.gmail@maumeloni>
#
# Version 20201127.02
#

REQUIRED_PACKAGES="opensc pcscd rng-tools"
HASH_INPUT="hello world"
RNG_BYTES_LEN=250004

if ! dpkg -s $REQUIRED_PACKAGES 1> /dev/null 2> /dev/null; then
    echo "Please install the following packages:"
    echo
    echo "    $REQUIRED_PACKAGES"
    exit 1
fi


log_command() {
    COMMAND="${1}"
    FILENAME="${2}"
    if [ -f "${FILENAME}" ]; then
        printf "File %s already exists. Overwrite? [n] " "${FILENAME}"
        read -r OVERWRITE
        if [ "${OVERWRITE}" != "y" ] && [ "${OVERWRITE}" != "yes" ]; then
            return
        fi
    fi
    echo
    printf "\$ %s\n" "${COMMAND}" | tee "${FILENAME}"
    ${COMMAND} 2>&1 | tee -a "${FILENAME}"
}


# log_command "pcsc_scan" pcsc_scan.log
log_command "sc-hsm-tool --verbose" sc-hsm-tool.log

log_command "opensc-tool --list-readers" opensc-tool-readers.log
log_command "opensc-tool --verbose --list-algorithms" opensc-tool-algorithms.log
log_command "opensc-tool --list-files" opensc-tool-files.log

log_command "openpgp-tool --card-info --key-info" openpgp-tool.log

log_command "pkcs11-tool --list-slots" pkcs11-tool-slots.log
log_command "pkcs11-tool --list-token-slots" pkcs11-tool-token-slots.log
log_command "pkcs11-tool --verbose --list-mechanisms" pkcs11-tool-mechanisms.log
log_command "pkcs11-tool --list-objects" pkcs11-tool-objects.log

printf "\$ pkcs15-tool --reader 0 --auth-id 01 --verify-pin --dump --verbose" > pkcs15-tool-dump.log
pkcs15-tool --reader 0 --auth-id 01 --verify-pin --dump --verbose

printf "\$ echo %s | pkcs11-tool-hash.log\n" "${HASH_INPUT}" > pkcs11-tool-hash.log
echo "${HASH_INPUT}" | pkcs11-tool --hash --mechanism SHA256 1> pkcs11-tool-hash-result.bin 2> pkcs11-tool-hash.log
echo "${HASH_INPUT}" | openssl sha256 -binary > openssl-hash-result.bin
if cmp -s pkcs11-tool-hash-result.bin openssl-hash-result.bin; then
    echo "SHA256 hardware hash matches openssl result (good!)"
else
    echo "ERROR: SHA256 hardware hash DOES NOT MATCH expected result"
fi

echo
echo "This will take some minutes, please be patient ..."
printf "\$ pkcs11-tool --generate-random %s | rngtest -c 100\n" "${RNG_BYTES_LEN}" > pkcs11-tool-generate-random.log
pkcs11-tool --generate-random "${RNG_BYTES_LEN}" | rngtest -c 100 | tee -a pkcs11-tool-generate-random.log