Java

PKCS11 Import an Existing AES Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing AES symmetric encrytion key onto the smartcard/token. The imported AES key is a session object, and only exists for the duration of the PKCS11 session. (AES keys are typically used for wrapping/unwrapping RSA and EC keys.)

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat2 Java

import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.JsonObject;
import com.chilkatsoft.chilkat2.Pkcs11;
import com.chilkatsoft.chilkat2.StringBuilder;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

        Pkcs11 pkcs11 = new Pkcs11();

        // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
        // (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
        pkcs11.setSharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll");

        // Establish a logged-on session.
        String pin = "0000";
        int userType = 1;
        try {
            pkcs11.quickSession(userType, pin);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Generate a 256-bit AES key.
        // (32 bytes is 256 bits)
        // Append 32 bytes of random data in the base64 encoding.
        StringBuilder sbAesKey = new StringBuilder();
        sbAesKey.appendRandom(32, "base64");

        JsonObject attrs = new JsonObject();
        // Specify the type of object, and the type of key.
        attrs.updateString("class", "CKO_SECRET_KEY");
        attrs.updateString("key_type", "CKK_AES");
        // Add an optional label if desired.
        attrs.updateString("label", "My AES wrapping/unwrapping key");
        // Allow the key to be use for wrapping and unwrapping operations.
        attrs.updateBool("wrap", true);
        attrs.updateBool("unwrap", true);

        // Provide the AES key material.
        attrs.updateString("value", sbAesKey.getAsString());

        // Create the object (i.e. create the AES key with the given key material.)
        // Returns the PKCS11 object handle of the created AES session key.
        long objHandle = pkcs11.createPkcs11Object(attrs);
        if (objHandle == 0) {
            System.out.println(pkcs11.getLastErrorText());
            System.out.println("Failed.");
        } else {
            System.out.println("PKCS11 object handle = " + objHandle);
            System.out.println("Successfully created a 256-bit AES session key.");
        }

        // Typically, you would do other things in the PKCS11 session that use the handle of AES key we just created.
        // ...
        // ...

        pkcs11.logout();
        pkcs11.closeSession();
    }
}