From a message on the OpenSC mailing list:
The security problem in short: you need a combination of
1.) a tool that starts a key generation with public exponent set to 1
(an invalid value that causes an insecure rsa key)
2.) a PKCS#11 module that accepts that this public exponent and forwards
it to the card
3.) a card that accepts the public exponent and generates the rsa key.
OpenSC is insecure because due to a code bug in pkcs11-tool it had
the wrong public exponent. But OpenSC PKCS#11 module is secure, it
ignores the public exponent. So only if you generate your keys with
pkcs11-tool from OpenSC 0.11.7 (which very few people do), and only if
you used it with some other vendors PKCS#11 module, and only if the
card accepted the bogus value too, then your rsa key is insecure.
| 