(CkPython) PKCS11 Generate Secret Key (such as AES)

See more PKCS11 Examples

Generates a symmetric secret key such as AES on the HSM.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

pkcs11 = chilkat.CkPkcs11()

# Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
# (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
pkcs11.put_SharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll")

# Establish a logged-on session.
pin = "0000"
userType = 1
success = pkcs11.QuickSession(userType,pin)
if (success == False):
    print(pkcs11.lastErrorText())
    sys.exit()

# Let's generate a 256-bit AES key on the token, which will exist for the duration of this session.
# Symmetric keys, such as AES keys, are typically created (or imported) and used during a single session.

# Other possible values for keyType are "AES XTS", "Blowfish", "Twofish", "ChaCha20", and others. 
# In virtually all cases, you'll want to create an AES key.
keyType = "AES"

# Specify attributes and abilities (how this key can be used) by providing a JSON template.
json = chilkat.CkJsonObject()

# The key can be extracted or wrapped.
json.UpdateBool("extractable",True)

# Allow the key to be used for encryption, decryption, wrapping other keys, and unwrapping other keys.
json.UpdateBool("encrypt",True)
json.UpdateBool("decrypt",True)
json.UpdateBool("wrap",True)
json.UpdateBool("unwrap",True)

# Indicate a 256-bit AES key is to be generated by setting the value_len attribute equal to the key size in bytes.
# (32 bytes * 8 bits/byte = 256 bits)
json.UpdateInt("value_len",32)

keyHandle = pkcs11.GenSecretKey(keyType,json)
if (keyHandle == 0):
    print(pkcs11.lastErrorText())
    print("Failed to generate an AES key.")
else:
    print("key handle = " + str(keyHandle))
    print("Success.")

pkcs11.Logout()
pkcs11.CloseSession()