Delphi DLL

SSH HSM Public Key Authentication

Demonstrates SSH public-key authentication using a private key stored on an HSM — a USB token or smart card — accessed through PKCS#11. A session is opened with the vendor's driver, the key handles are located, and an SshKey object is bound to them with UsePkcs11.

Background: The point of an HSM is that the private key is generated on the device and cannot be exported: the signing operation happens on the hardware, so the key material never reaches your application's memory or disk. Even a fully compromised host cannot yield a copy of the key. PKCS#11 is the vendor-neutral interface to such devices, which is why the driver path and the object-finding template are the only vendor-specific parts of this example.

Chilkat Delphi DLL Downloads

Download Chilkat for Delphi DLL

Delphi DLL

var
success: Boolean;
pkcs11: HCkPkcs11;
pin: PWideChar;
userType: Integer;
json: HCkJsonObject;
priv_handle: Cardinal;
pub_handle: Cardinal;
key: HCkSshKey;
keyType: PWideChar;
ssh: HCkSsh;
port: Integer;

begin
success := False;

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Demonstrates SSH public-key authentication using a private key stored on an HSM (a USB token
//  or smart card) accessed through PKCS#11.
//  
//  Note: Chilkat's PKCS#11 implementation runs on Windows, Linux, macOS, and other supported
//  operating systems.

pkcs11 := CkPkcs11_Create();

//  The PKCS#11 driver supplied by your HSM vendor: a .dll on Windows, a .so on Linux, or a
//  .dylib on macOS.
CkPkcs11_putSharedLibPath(pkcs11,'C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll');

//  The PIN should come from a secure source rather than being hard-coded.
pin := '0000';

//  Normal user = 1
userType := 1;

success := CkPkcs11_QuickSession(pkcs11,userType,pin);
if (success = False) then
  begin
    Memo1.Lines.Add(CkPkcs11__lastErrorText(pkcs11));
    Exit;
  end;

//  Describe the private key object to be located on the HSM.
json := CkJsonObject_Create();
CkJsonObject_UpdateString(json,'class','private_key');
CkJsonObject_UpdateString(json,'label','MySshKey');

priv_handle := CkPkcs11_FindObject(pkcs11,json);
if (priv_handle = 0) then
  begin
    Memo1.Lines.Add(CkPkcs11__lastErrorText(pkcs11));
    Exit;
  end;

//  Find the corresponding public key by changing the class in the same template.
CkJsonObject_UpdateString(json,'class','public_key');

pub_handle := CkPkcs11_FindObject(pkcs11,json);
if (pub_handle = 0) then
  begin
    Memo1.Lines.Add(CkPkcs11__lastErrorText(pkcs11));
    Exit;
  end;

//  Create an SSH key object that uses the HSM handles.  The key type may be "rsa" or "ec".
key := CkSshKey_Create();
keyType := 'rsa';
success := CkSshKey_UsePkcs11(key,pkcs11,priv_handle,pub_handle,keyType);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSshKey__lastErrorText(key));
    Exit;
  end;

ssh := CkSsh_Create();

port := 22;
success := CkSsh_Connect(ssh,'ssh.example.com',port);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  The corresponding public key must already be installed on the SSH server for the account.
//  The signing operation happens on the HSM -- the private key never leaves the device.
success := CkSsh_AuthenticatePk(ssh,'mySshLogin',key);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

Memo1.Lines.Add('Public-key authentication successful.');

CkSsh_Disconnect(ssh);

CkPkcs11_Logout(pkcs11);
CkPkcs11_CloseSession(pkcs11);

CkPkcs11_Dispose(pkcs11);
CkJsonObject_Dispose(json);
CkSshKey_Dispose(key);
CkSsh_Dispose(ssh);