用Pkcs11Interop进行PDF签名

Question

我尝试在我们的机构项目中使用Pkcs11Interop图书馆。但问题是，当我试图从令牌卡中获取值时，“试图读取或写入受保护的内存，这通常表明其他内存已损坏”，这是来自Pkcs11Interop的错误。我找不到任何解决办法。请帮我，谢谢你提前。

项目是用.Net Framework4.5编写的windows窗体应用程序

错误： system.accessviolationexception {"Attempted to read or write protected memory. This is often an indication that other memory is corrupt."}

错误堆栈跟踪：

 at Net.Pkcs11Interop.HighLevelAPI40.Session.GetAttributeValue(ObjectHandle objectHandle, List`1 attributes)
   at Net.Pkcs11Interop.HighLevelAPI40.Session.GetAttributeValue(ObjectHandle objectHandle, List`1 attributes)
   at EFinImza.Program.Main() in c:\HttpRoot\EFinImza\EFinImza\Program.cs:line 56
   at System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
   at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ThreadHelper.ThreadStart()

代码是这样的：

static void Main()
    {
        try
        {
            string pkcs11Library = @"C:\Windows\System32\akisp11.dll";
            using (var pkcs11 = new Net.Pkcs11Interop.HighLevelAPI40.Pkcs11(pkcs11Library, false, false))
            {
                LibraryInfo info = pkcs11.GetInfo();
                foreach (Slot slot in pkcs11.GetSlotList(false))
                {
                    SlotInfo slotInfo = slot.GetSlotInfo();
                    if (slotInfo.SlotFlags.TokenPresent)
                    {
                        TokenInfo tokenInfo = slot.GetTokenInfo();

                        Session session = slot.OpenSession(false);
                        String pin = "*****";
                        session.Login(CKU.CKU_USER, pin);

                        // get all objects using empty ObjectAttributes list
                        List<ObjectHandle> handles = session.FindAllObjects(new List<ObjectAttribute>());
                        List<CKA> attrs = new List<CKA>();
                        attrs.Add(CKA.CKA_LABEL);

                        foreach (ObjectHandle handle in handles)
                        {
                            List<ObjectAttribute> oAttrs = session.GetAttributeValue(handle, attrs);   **//Error is getting here**
                        }

                        session.CloseSession();
                    }
                }

                pkcs11.Dispose();
            }

            Application.EnableVisualStyles();
            Application.SetCompatibleTextRenderingDefault(false);
        }
        catch (Exception ex)
        {
            throw ex;
        }

    }

Answer 1

正如正式文件中所建议的那样，在开始使用Pkcs11Interop之前，您至少应该熟悉PKCS#11 v2.20规范的“第2章-范围”、“第6章-总览”和“第10章-对象”。

您的代码首先查找所有对象，而不管它们的类型(键、证书等)。然后尝试读取每个单独对象的CKA_VALUE属性。CKA_VALUE不是所有对象类型的有效属性，我猜这可能会导致您的问题。当然，运行良好的非托管PKCS#11库将返回CKR_ATTRIBUTE_TYPE_INVALID错误，而不是分段错误，但是有许多质量较差的PKCS#11库不能很好地处理这些角落情况。

我建议您首先阅读规范中提到的章节，然后将传递给FindAllObjects()方法的搜索模板更改为只搜索您真正感兴趣的特定对象类型。