我想让 OpenSSH 与 OpenSSL plus 一起工作openCryptoki(pkcs11) 加上软件 TPM。据我所知，openCryptoki 能够使用软件令牌（用于测试目的）。我想使用 openCryptoki 软件 TPM，据我所知它存在（替代方案似乎是：softhsm、heimdal、tpmd）。
我已经安装了：gnutls-bin、opencryptoki、libengine-pkcs11-openssl、libp11-2、libp11-2dev。
我执行以下操作来启动 openCryptoki：
pkcs11_startup
文件如下pk_config_data ：
TRUE|0|Linux 3.5.0-54-generic Linux (TPM)|Linux 3.5.0-54-generic|TRUE|FALSE|TRUE|0|0|1|1|NONE|libpkcs11_tpm.so|ST_Initialize
TRUE|0|Linux 3.5.0-54-generic Linux (Soft)|Linux 3.5.0-54-generic|TRUE|FALSE|FALSE|0|0|1|1|NONE|libpkcs11_sw.so|ST_Initialize
我还没有找到如何使用 openCryptoki 软件令牌。
然后我尝试使用 opensc：
OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/opensc-pkcs11.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib/opensc-pkcs11.so
Loaded: (pkcs11) pkcs11 engine
[ available ]
OpenSSL> req -engine pkcs11 -new -key id_45 -keyform engine -out req.pem -text -x509 -subj "/CN=Andreas Jellinghaus">
engine "pkcs11" set.
Invalid slot number: 0
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
3073657032:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126:
unable to load Private Key
error in req
然后我尝试使用 softhsm：
softhsm --init-token --slot 0 --label "softhsmTPM"
The SO PIN must have a length between 4 and 255 characters.
Enter SO PIN: aaaa
The user PIN must have a length between 4 and 255 characters.
Enter user PIN: bbbb
The token has been initialized.
OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/libsofthsm.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/engines/engine_pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib/libsofthsm.so
Loaded: (pkcs11) pkcs11 engine
SoftHSM: Could not open the config file: /etc/softhsm/softhsm.conf
unable to load module /usr/lib/libsofthsm.so
[ unavailable ]
然后我尝试使用一个未使用的插槽：
pkcsconf -s
Slot #0 Info
Description: Linux 3.5.0-54-generic Linux (TPM)
Manufacturer: Linux 3.5.0-54-generic
Flags: 0x5 (TOKEN_PRESENT|HW_SLOT)
Hardware Version: 0.0
Firmware Version: 1.1
Slot #1 Info
Description: Linux 3.5.0-54-generic Linux (Soft)
Manufacturer: Linux 3.5.0-54-generic
Flags: 0x1 (TOKEN_PRESENT)
Hardware Version: 0.0
Firmware Version: 1.1
softhsm --init-token --slot 2 --label "softhsmTPM"
The SO PIN must have a length between 4 and 255 characters.
Enter SO PIN:
The user PIN must have a length between 4 and 255 characters.
Enter user PIN:
Error: The given slot does not exist.
无论我尝试什么解决方案，它都失败了，但我对此还很陌生。有什么帮助吗？
答案1
https://blog.habets.se/2013/11/TPM-chip-protecting-SSH-keys---正确
它还涵盖了在 ssh 中使用 tpm 作为 pkcs11 提供程序编写的软件。