(Java) SSH HSM Public Key Authentication

Demonstrates how to authenticate with an SSH server using public key authentication using an HSM (USB token or smartcard).

Chilkat Java Downloads Java Libs for Windows, MacOS, Linux, Alpine Linux, Solaris Java Libs for Android

import com.chilkatsoft.*;

public class ChilkatExample {

  static {
    try {
        System.loadLibrary("chilkat");
    } catch (UnsatisfiedLinkError e) {
      System.err.println("Native code library failed to load.\n" + e);
      System.exit(1);
    }
  }

  public static void main(String argv[])
  {
    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, MacOs, and other supported operating systems.

    CkPkcs11 pkcs11 = new CkPkcs11();

    // This would be a path to a .dylib on MacOS, or a path to a .so shared lib on Linux.
    pkcs11.put_SharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll");
    String pin = "0000";
    int userType = 1;

    // Establish a PKCS11 logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
    boolean success = pkcs11.QuickSession(userType,pin);
    if (success == false) {
        System.out.println(pkcs11.lastErrorText());
        return;
        }

    // Set PKCS11 attributes to find our desired private key object.
    CkJsonObject json = new CkJsonObject();
    json.UpdateString("class","private_key");
    json.UpdateString("label","MySshKey");

    // Get the PKCS11 handle to the private key located on the HSM.
    int priv_handle = pkcs11.FindObject(json);

    // Get the PKCS11 handle to the corresponding public key located on the HSM.
    json.UpdateString("class","public_key");

    int pub_handle = pkcs11.FindObject(json);

    CkSshKey key = new CkSshKey();
    // The key type can be "rsa" or "ec"
    String keyType = "rsa";
    success = key.UsePkcs11(pkcs11,priv_handle,pub_handle,keyType);
    if (success == false) {
        System.out.println(key.lastErrorText());
        return;
        }

    CkSsh ssh = new CkSsh();

    success = ssh.Connect("example.com",22);
    if (success != true) {
        System.out.println(ssh.lastErrorText());
        return;
        }

    // Authenticate with the SSH server using the login and
    // HSM private key.  (The corresponding public key should've 
    // been installed on the SSH server beforehand.)
    success = ssh.AuthenticatePk("myLogin",key);
    if (success != true) {
        System.out.println(ssh.lastErrorText());
        return;
        }

    System.out.println("Public-Key Authentication Successful!");
  }
}