DataFlex

Import an SSH Key to an HSM using PKCS11

See more PKCS11 Examples

Demonstrates how to import an SSH private key to an HSM (smartcard or token).

Note: This example requires Chilkat v9.5.0.96 or later.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoPkcs11
    String sPin
    Integer iUserType
    Variant vJsonTemplate
    Handle hoJsonTemplate
    Variant vSshKey
    Handle hoSshKey
    String sPpkContents
    UInteger iPrivKeyHandle
    String sTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
    // For example:
    Set ComSharedLibPath Of hoPkcs11 To "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll"

    // Use your HSM's PIN.
    Move "0000" To sPin

    // Normal user = 1
    Move 1 To iUserType

    // Establish a logged-on user session with the HSM.
    Get ComQuickSession Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Create a PKCS11 template for importing the SSH key.
    Get Create (RefClass(cComChilkatJsonObject)) To hoJsonTemplate
    If (Not(IsComObjectCreated(hoJsonTemplate))) Begin
        Send CreateComObject of hoJsonTemplate
    End

    // Indicate the key is to be stored on the token (i.e. it is not a session-only key)
    Get ComUpdateBool Of hoJsonTemplate "token" True To iSuccess
    // The key should have the ability to sign
    Get ComUpdateBool Of hoJsonTemplate "sign" True To iSuccess

    // Let's provide a few attributes to help us find the this key at a later time.
    // See SSH Public-Key Authentication using an HSM

    // The ID is byte data, so it should be base64 or hex.
    // Specify "id" if passing base64 data, "id_hex" for hexidecimal, or "id_ascii" for directly copying the ascii bytes of the string.
    // You can provide any ID of your choice.  It is optional.
    Get ComUpdateString Of hoJsonTemplate "id_hex" "0A0B0C0D01020304" To iSuccess

    // Optionally specify a label.
    Get ComUpdateString Of hoJsonTemplate "label" "MySshKey" To iSuccess

    // Load the SSH key to be imported to the HSM (smartcard or token)
    Get Create (RefClass(cComChilkatSshKey)) To hoSshKey
    If (Not(IsComObjectCreated(hoSshKey))) Begin
        Send CreateComObject of hoSshKey
    End
    Set ComPassword Of hoSshKey To "password_of_the_encrypted_ppk_file"
    Get ComLoadText Of hoSshKey "c:/my_ssh_keys/someSshKey.ppk" To sPpkContents
    Get ComFromPuttyPrivateKey Of hoSshKey sPpkContents To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSshKey To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Import the SSH private key onto the HSM.
    // The PKCS11 handle to the imported private key is returned.
    // A 0 is returned on failure.
    Get pvComObject of hoSshKey to vSshKey
    Get pvComObject of hoJsonTemplate to vJsonTemplate
    Get ComImportSshKey Of hoPkcs11 vSshKey vJsonTemplate To iPrivKeyHandle
    If (iPrivKeyHandle = 0) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // The private key handle is only valid during the PKCS11 session.
    // If you wish to use the private key in another PKCS11 session,
    // you'll first need to find it.  See  SSH Public-Key Authentication using a Smartcard
    Showln "private key handle: " iPrivKeyHandle

    Showln "Successfully imported the SSH key onto the HSM."

    Get ComLogout Of hoPkcs11 To iSuccess
    Get ComCloseSession Of hoPkcs11 To iSuccess


End_Procedure