(Chilkat2-Python) Import an SSH Key to an HSM using PKCS11

See more PKCS11 Examples

Demonstrates how to import an SSH private key to an HSM (smartcard or token).

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat2 Python Downloads install with pip pip3 install chilkat2 or download... Python Module for Windows, Linux, Alpine Linux, MacOS, Solaris

import sys
import chilkat2

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

pkcs11 = chilkat2.Pkcs11()

# Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
# For example:
pkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll"

# Use your HSM's PIN.
pin = "0000"

# Normal user = 1
userType = 1

# Establish a logged-on user session with the HSM.
success = pkcs11.QuickSession(userType,pin)
if (success == False):
    print(pkcs11.LastErrorText)
    sys.exit()

# Create a PKCS11 template for importing the SSH key.
jsonTemplate = chilkat2.JsonObject()

# Indicate the key is to be stored on the token (i.e. it is not a session-only key)
jsonTemplate.UpdateBool("token",True)
# The key should have the ability to sign
jsonTemplate.UpdateBool("sign",True)

# Let's provide a few attributes to help us find the this key at a later time.
# See SSH Public-Key Authentication using an HSM

# The ID is byte data, so it should be base64 or hex.
# Specify "id" if passing base64 data, "id_hex" for hexidecimal, or "id_ascii" for directly copying the ascii bytes of the string.
# You can provide any ID of your choice.  It is optional.
jsonTemplate.UpdateString("id_hex","0A0B0C0D01020304")

# Optionally specify a label.
jsonTemplate.UpdateString("label","MySshKey")

# Load the SSH key to be imported to the HSM (smartcard or token)
sshKey = chilkat2.SshKey()
sshKey.Password = "password_of_the_encrypted_ppk_file"
ppkContents = sshKey.LoadText("c:/my_ssh_keys/someSshKey.ppk")
success = sshKey.FromPuttyPrivateKey(ppkContents)
if (success == False):
    print(sshKey.LastErrorText)
    sys.exit()

# Import the SSH private key onto the HSM.
# The PKCS11 handle to the imported private key is returned.
# A 0 is returned on failure.
privKeyHandle = pkcs11.ImportSshKey(sshKey,jsonTemplate)
if (privKeyHandle == 0):
    print(pkcs11.LastErrorText)
    sys.exit()

# The private key handle is only valid during the PKCS11 session.
# If you wish to use the private key in another PKCS11 session,
# you'll first need to find it.  See  SSH Public-Key Authentication using a Smartcard
print("private key handle: " + str(privKeyHandle))

print("Successfully imported the SSH key onto the HSM.")

pkcs11.Logout()
pkcs11.CloseSession()