Using IAIK PKCS#11 Wrapper with AWS CloudHSM

0

Hi,
I'm trying to issue RSA key pairs on AWS CloudHSM with a JAVA application using IAIK PKCS#11 Wrapper and JVM JCE Provider and I'm facing some difficulties. Indeed, for now, the only way to generate a keypair is providing minimal templates for both public and private key:
RSAPublicKey rsaPublicKeyTemplate = new RSAPublicKey();
RSAPrivateKey rsaPrivateKeyTemplate = new RSAPrivateKey();
// Modulus
rsaPublicKeyTemplate.getModulusBits().setLongValue(new Long(keyLength));
// Public exp
byte[] publicExponentBytes = {0x01, 0x00, 0x01};
rsaPublicKeyTemplate.getPublicExponent().setByteArrayValue(publicExponentBytes);

All other tries I made for customizing fail with the PKCS#11 error CKR_TEMPLATE_INCONSISTENT, for example when I try to make the generated key pair persistent:
rsaPublicKeyTemplate.getToken().setBooleanValue(Boolean.TRUE);
rsaPrivateKeyTemplate.getToken().setBooleanValue(Boolean.TRUE);
It seems that the HSM does not understand the templates I provide...

Has someone here even succeeded in using IAIK Provider or is AWS CloudHSM not compatible with this provider?
Then, are we forced to use AWS JCE Provider?

Thanks in advance for taking time to read my questions
Eric

Edited by: EricT on Jan 11, 2021 3:23 AM

Edited by: EricT on Jan 11, 2021 6:51 AM

EricT
질문됨 3년 전477회 조회
2개 답변
0

Hi everyone,

For all that are here coming from Google or anything else, the error CKR_TEMPLATE_INCONSISTENT can be easily solved by carefully looking at supported attributes :)
In my case, it was because I tried to build a RSA/ECDSA template with a subject and start/end dates attributes which are not part of the list: https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-attributes.html

Éric

EricT
답변함 3년 전
0

To avoid CKR_TEMPLATE_INCOSISTENT error, build RSA/ECDSA templates only with supported attributes

EricT
답변함 3년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인