javacryptographypkcs#11iaik-jcesafenet

How to get number of password retries in eToken SafeNet by IAIK PKCS#11

I use Java and IAIK to read eToken info.

Module pkcs11Module = Module.getInstance("PKCS11.dll");
    pkcs11Module.initialize(null);
    Slot[] slotsWithToken = pkcs11Module.getSlotList(Module.SlotRequirement.TOKEN_PRESENT);
    log.info("number of slots: {}", slotsWithToken.length);
    Token[] tokens = new Token[slotsWithToken.length];
    for (int i = 0; i < slotsWithToken.length; i++) {
        Session session = null;
        TokenInfo tokenInfo = null;
        try {
            tokens[i] = slotsWithToken[i].getToken();
            tokenInfo = tokens[i].getTokenInfo();

enter image description here

This is the information I took out:

Information returned only 'Security Officer PIN final Try' true of false. However I need to know how many times I have to re-enter the password so that I can notify the user. I've searched online but there's no positive result.

Solution

  • Using standard pkcs#11 calls, there is no way to get the actual number of (possible) retries.

    For the user's pin, there are the flags:

    For the SO pin, there are the flags:

    Which you can check on the TokenInfo class. So you can 'only' display a warning on the final try. Please also refer to the pkcs#11 specification.

    However, as Alexander mentioned in another answer there might be a vendor defined api for this.