DataFlex

PKCS11 Import an Existing AES Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing AES symmetric encrytion key onto the smartcard/token. The imported AES key is a session object, and only exists for the duration of the PKCS11 session. (AES keys are typically used for wrapping/unwrapping RSA and EC keys.)

Note: This example requires Chilkat v9.5.0.96 or later.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoPkcs11
    String sPin
    Integer iUserType
    Handle hoSbAesKey
    Variant vAttrs
    Handle hoAttrs
    UInteger iObjHandle
    String sTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
    // (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
    Set ComSharedLibPath Of hoPkcs11 To "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

    // Establish a logged-on session.
    Move "0000" To sPin
    Move 1 To iUserType
    Get ComQuickSession Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Generate a 256-bit AES key.
    // (32 bytes is 256 bits)
    // Append 32 bytes of random data in the base64 encoding.
    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbAesKey
    If (Not(IsComObjectCreated(hoSbAesKey))) Begin
        Send CreateComObject of hoSbAesKey
    End
    Get ComAppendRandom Of hoSbAesKey 32 "base64" To iSuccess

    Get Create (RefClass(cComChilkatJsonObject)) To hoAttrs
    If (Not(IsComObjectCreated(hoAttrs))) Begin
        Send CreateComObject of hoAttrs
    End
    // Specify the type of object, and the type of key.
    Get ComUpdateString Of hoAttrs "class" "CKO_SECRET_KEY" To iSuccess
    Get ComUpdateString Of hoAttrs "key_type" "CKK_AES" To iSuccess
    // Add an optional label if desired.
    Get ComUpdateString Of hoAttrs "label" "My AES wrapping/unwrapping key" To iSuccess
    // Allow the key to be use for wrapping and unwrapping operations.
    Get ComUpdateBool Of hoAttrs "wrap" True To iSuccess
    Get ComUpdateBool Of hoAttrs "unwrap" True To iSuccess

    // Provide the AES key material.
    Get ComGetAsString Of hoSbAesKey To sTemp1
    Get ComUpdateString Of hoAttrs "value" sTemp1 To iSuccess

    // Create the object (i.e. create the AES key with the given key material.)
    // Returns the PKCS11 object handle of the created AES session key.
    Get pvComObject of hoAttrs to vAttrs
    Get ComCreatePkcs11Object Of hoPkcs11 vAttrs To iObjHandle
    If (iObjHandle = 0) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Showln "Failed."
    End
    Else Begin
        Showln "PKCS11 object handle = " iObjHandle
        Showln "Successfully created a 256-bit AES session key."
    End

    // Typically, you would do other things in the PKCS11 session that use the handle of AES key we just created.
    // ...
    // ...

    Get ComLogout Of hoPkcs11 To iSuccess
    Get ComCloseSession Of hoPkcs11 To iSuccess


End_Procedure