Rust

PKCS11 Generate Secret Key (such as AES)

See more PKCS11 Examples

Generates a symmetric secret key such as AES on the HSM.

Note: This example requires Chilkat v9.5.0.96 or later.

Rust

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

let pkcs11 = chilkat::Pkcs11::new();

// Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
// (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
pkcs11.set_shared_lib_path("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll");

// Establish a logged-on session.
let pin = "0000".to_string();
let user_type = 1;
if pkcs11.quick_session(user_type, &pin).is_err() {
    println!("{}", pkcs11.last_error_text());
    return;
}

// Let's generate a 256-bit AES key on the token, which will exist for the duration of this session.
// Symmetric keys, such as AES keys, are typically created (or imported) and used during a single session.

// Other possible values for keyType are "AES XTS", "Blowfish", "Twofish", "ChaCha20", and others. 
// In virtually all cases, you'll want to create an AES key.
let key_type = "AES".to_string();

// Specify attributes and abilities (how this key can be used) by providing a JSON template.
let json = chilkat::JsonObject::new();

// The key can be extracted or wrapped.
let _ = json.update_bool("extractable", true);

// Allow the key to be used for encryption, decryption, wrapping other keys, and unwrapping other keys.
let _ = json.update_bool("encrypt", true);
let _ = json.update_bool("decrypt", true);
let _ = json.update_bool("wrap", true);
let _ = json.update_bool("unwrap", true);

// Indicate a 256-bit AES key is to be generated by setting the value_len attribute equal to the key size in bytes.
// (32 bytes * 8 bits/byte = 256 bits)
let _ = json.update_int("value_len", 32);

let key_handle = pkcs11.gen_secret_key(&key_type, &json);
if key_handle == 0 {
    println!("{}", pkcs11.last_error_text());
    println!("Failed to generate an AES key.");
} else {
    println!("key handle = {}", key_handle);
    println!("Success.");
}

let _ = pkcs11.logout();
let _ = pkcs11.close_session();