Wrong key length for EC public key I have a problem with EC public key reading from smartcard using pkcs11 library.
With the secp256r1 EC algorithm, I always get 65 or 67-byte length public key with different smartcards. But with the ePass2003 token, the length of the public key is 61 bytes. Using the pkcs11 library all sign and verify methods work fine with these pair keys(so it seems key pairs are OK), but when I read public key I get 61 bytes.
I tried opensc for double testing. There is also EC_POINT is 232 bits with ePass2003, whether 256 bits with Safenet 5110.
You can see opensc keygeneration command and result below:
&quot;C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe&quot; --modul C:\Windows\System32\eps2003csp11.dll --login --login-type user --keypairgen --id 1 --key-type EC:secp256r1
Using slot 0 with a present token (0x1)
Logging in to &quot;ePass2003&quot;.
WARNING: user PIN to be changed
Please enter User PIN: Key pair generated:
Private Key Object; EC
  label:
  ID:         01
  Usage:      sign, derive
  Access:     sensitive, always sensitive, never extractable, local
Public Key Object; EC  EC_POINT 232 bits
  EC_POINT:   a6ea6b9ce6bd0e086f029b082e1a4096062b79293b782bb0d255363994fd846e93ef0950a1338fa2106769a46f692da9a1607cd98a68b42b85a1ab47c9
  EC_PARAMS:  06082a8648ce3d030107
  label:
  ID:         01
  Usage:      encrypt, verify, wrap, derive
  Access:     local

And it is the same code for Safenet 5110 token below:
&quot;C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe&quot; --modul C:\Windows\System32\etpkcs11.dll --login --login-type user --keypairgen --id 1 --key-type EC:secp256r1
Using slot 2 with a present token (0x2)
Logging in to &quot;GlobalSign SafeNet Token&quot;.
Please enter User PIN: Key pair generated:
Private Key Object; EC
  label:
  ID:         01
  Usage:      decrypt, sign, unwrap, derive
  Access:     sensitive, always sensitive, never extractable, local
Public Key Object; EC  EC_POINT 256 bits
  EC_POINT:   0441044de0b0df2e13f532240a9c3dd8123c86963ee7e456e62c4be767ff76a74ee935ba431a4d6159db031377d0a1e9cf2fc0b4e818912e9cfc124bc90c13f5b055c7
  EC_PARAMS:  06082a8648ce3d030107
  label:
  ID:         01
  Usage:      encrypt, verify, wrap, derive
  Access:     local
The EC_POINT must be a ASN.1-encoded octet string, and the ePass2003 result does not seem to be valid ASN.1 (compare the Safenet 5110 value and the ePass2003 value)
(Due to a fun coincidence, the octet string ASN.1 prefix is also 04, so the byte that identifies that it's an uncompressed point is actually the second 04 in the third byte, in the Safenet 5110 output)
I don't know exactly what it's returning, but it's certainly wrong. It doesn't matter for the signing/verification process because they happen inside the token and don't rely on the EC_POINT value returned by the token.
My guess is that internally it has the correct value, but the ePass2003 code that returns the EC_POINT value has a bug.