(Chilkat2-Python) PKCS11 Import an Existing AES Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing AES symmetric encrytion key onto the smartcard/token. The imported AES key is a session object, and only exists for the duration of the PKCS11 session. (AES keys are typically used for wrapping/unwrapping RSA and EC keys.)

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat2 Python Downloads install with pip pip3 install chilkat2 or download... Python Module for Windows, Linux, Alpine Linux, MacOS, Solaris

import sys
import chilkat2

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

pkcs11 = chilkat2.Pkcs11()

# Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
# (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
pkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

# Establish a logged-on session.
pin = "0000"
userType = 1
success = pkcs11.QuickSession(userType,pin)
if (success == False):
    print(pkcs11.LastErrorText)
    sys.exit()

# Generate a 256-bit AES key.
# (32 bytes is 256 bits)
# Append 32 bytes of random data in the base64 encoding.
sbAesKey = chilkat2.StringBuilder()
sbAesKey.AppendRandom(32,"base64")

attrs = chilkat2.JsonObject()
# Specify the type of object, and the type of key.
attrs.UpdateString("class","CKO_SECRET_KEY")
attrs.UpdateString("key_type","CKK_AES")
# Add an optional label if desired.
attrs.UpdateString("label","My AES wrapping/unwrapping key")
# Allow the key to be use for wrapping and unwrapping operations.
attrs.UpdateBool("wrap",True)
attrs.UpdateBool("unwrap",True)

# Provide the AES key material.
attrs.UpdateString("value",sbAesKey.GetAsString())

# Create the object (i.e. create the AES key with the given key material.)
# Returns the PKCS11 object handle of the created AES session key.
objHandle = pkcs11.CreatePkcs11Object(attrs)
if (objHandle == 0):
    print(pkcs11.LastErrorText)
    print("Failed.")
else:
    print("PKCS11 object handle = " + str(objHandle))
    print("Successfully created a 256-bit AES session key.")

# Typically, you would do other things in the PKCS11 session that use the handle of AES key we just created.
# ...
# ...

pkcs11.Logout()
pkcs11.CloseSession()