DataFlex

PKCS11 Generate Secret Key (such as AES)

See more PKCS11 Examples

Generates a symmetric secret key such as AES on the HSM.

Note: This example requires Chilkat v9.5.0.96 or later.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoPkcs11
    String sPin
    Integer iUserType
    String sKeyType
    Variant vJson
    Handle hoJson
    UInteger iKeyHandle
    String sTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
    // (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
    Set ComSharedLibPath Of hoPkcs11 To "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

    // Establish a logged-on session.
    Move "0000" To sPin
    Move 1 To iUserType
    Get ComQuickSession Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Let's generate a 256-bit AES key on the token, which will exist for the duration of this session.
    // Symmetric keys, such as AES keys, are typically created (or imported) and used during a single session.

    // Other possible values for keyType are "AES XTS", "Blowfish", "Twofish", "ChaCha20", and others. 
    // In virtually all cases, you'll want to create an AES key.
    Move "AES" To sKeyType

    // Specify attributes and abilities (how this key can be used) by providing a JSON template.
    Get Create (RefClass(cComChilkatJsonObject)) To hoJson
    If (Not(IsComObjectCreated(hoJson))) Begin
        Send CreateComObject of hoJson
    End

    // The key can be extracted or wrapped.
    Get ComUpdateBool Of hoJson "extractable" True To iSuccess

    // Allow the key to be used for encryption, decryption, wrapping other keys, and unwrapping other keys.
    Get ComUpdateBool Of hoJson "encrypt" True To iSuccess
    Get ComUpdateBool Of hoJson "decrypt" True To iSuccess
    Get ComUpdateBool Of hoJson "wrap" True To iSuccess
    Get ComUpdateBool Of hoJson "unwrap" True To iSuccess

    // Indicate a 256-bit AES key is to be generated by setting the value_len attribute equal to the key size in bytes.
    // (32 bytes * 8 bits/byte = 256 bits)
    Get ComUpdateInt Of hoJson "value_len" 32 To iSuccess

    Get pvComObject of hoJson to vJson
    Get ComGenSecretKey Of hoPkcs11 sKeyType vJson To iKeyHandle
    If (iKeyHandle = 0) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Showln "Failed to generate an AES key."
    End
    Else Begin
        Showln "key handle = " iKeyHandle
        Showln "Success."
    End

    Get ComLogout Of hoPkcs11 To iSuccess
    Get ComCloseSession Of hoPkcs11 To iSuccess


End_Procedure