是否可以在 SoftHSM 上存储密钥？

Question

我找到了这个帖子：Connecting to SoftHSM java 它在存储私钥时有效，就像示例一样。

但是我需要存储密钥，比如AES。

这是我的代码：

import java.security.*;
import sun.security.pkcs11.*;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    public static void main(String[] args) throws Exception {
        // Set up the Sun PKCS 11 provider
        String configName = "softhsm.cfg";
        Provider p = new SunPKCS11(configName);

        if (-1 == Security.addProvider(p)) {
            throw new RuntimeException("could not add security provider");
        }

        // Load the key store
        char[] pin = "mypin".toCharArray();
        KeyStore keyStore = KeyStore.getInstance("PKCS11", p);
        keyStore.load(null, pin);

        // AES key
        SecretKeySpec secretKeySpec = new SecretKeySpec("0123456789ABCDEF".getBytes(), "AES");
        Key key = new SecretKeySpec(secretKeySpec.getEncoded(), "AES");

        keyStore.setKeyEntry("AA", key, "1234".toCharArray(), null);
        keyStore.store(null); //this gives me the exception.
    }
}

这是 softhsm.cfg 文件：

name = SoftHSM
library = /usr/local/lib/softhsm/libsofthsm.so
slot = 0
attributes(generate, *, *) = {
   CKA_TOKEN = true
}
attributes(generate, CKO_CERTIFICATE, *) = {
   CKA_PRIVATE = false
}
attributes(generate, CKO_PUBLIC_KEY, *) = {
   CKA_PRIVATE = false
}

当执行 keyStore.store(null) 我得到 java.security.KeyStoreException Cannot convert to PKCS11 keys

Answer 1

结果是 SoftHSMv1 出现了异常。我安装了 SoftHSMv2，您可以使用 git 从 GitHub 下载它，并用它来存储密钥。不要从 OpenDNSsec 网站下载 SoftHSMv2，因为它不会工作！！

最后我不得不更改 softhsm.cfg 文件以指向新库，出于某种原因我忽略了，SoftHSM2 更改了初始化插槽的编号，您可以使用 sudo softhsm2-util --show-slots[= 进行验证16=]

softhsm.cfg:

name = SoftHSM
library = /usr/local/lib/softhsm/libsofthsm2.so
slot = 498488451
attributes(generate, *, *) = {
   CKA_TOKEN = true
}
attributes(generate, CKO_CERTIFICATE, *) = {
   CKA_PRIVATE = false
}
attributes(generate, CKO_PUBLIC_KEY, *) = {
   CKA_PRIVATE = false
}

我的代码：

import java.security.*;
import sun.security.pkcs11.*;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    public static void main(String[] args) throws Exception {
        // Set up the Sun PKCS 11 provider
        String configName = "softhsm.cfg";
        Provider p = new SunPKCS11(configName);

        if (-1 == Security.addProvider(p)) {
            throw new RuntimeException("could not add security provider");
        }

        // Load the key store
        char[] pin = "mypin".toCharArray();
        KeyStore keyStore = KeyStore.getInstance("PKCS11", p);
        keyStore.load(null, pin);

        // AES key
        SecretKeySpec secretKeySpec = new SecretKeySpec("0123456789ABCDEF".getBytes(), "AES");
        Key key = new SecretKeySpec(secretKeySpec.getEncoded(), "AES");

        keyStore.setKeyEntry("AA", key, "1234".toCharArray(), null);
        keyStore.store(null); //this no longer gives me the exception.

        Enumeration<String> aliases = keyStore.aliases();
        while(aliases.hasMoreElements()){
            String alias = aliases.nextElement();
            System.out.println(alias + ": " + keyStore.getKey(alias,"1234".toCharArray()));
        }
    }
}

这给了我输出：

AA: SunPKCS11-SoftHSM AES secret key, 16 bits (id 2, token object, not sensitive, unextractable)

如果您尝试使用 keyStore.getKey("AA", "1234".toCharArray()); 之类的方法获取密钥，您将获得一个具有密钥某些属性的对象，但您将无法使用 .getEncoded() 来实际获取密钥本身因为它是不可提取的。

是否可以在 SoftHSM 上存储密钥？

Is it possible to store secret keys on SoftHSM?

java

linux

ubuntu

softhsm