(Tcl) PKCS11 Import an Existing AES Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing AES symmetric encrytion key onto the smartcard/token. The imported AES key is a session object, and only exists for the duration of the PKCS11 session. (AES keys are typically used for wrapping/unwrapping RSA and EC keys.)

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

set pkcs11 [new_CkPkcs11]

# Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
# (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
CkPkcs11_put_SharedLibPath $pkcs11 "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

# Establish a logged-on session.
set pin "0000"
set userType 1
set success [CkPkcs11_QuickSession $pkcs11 $userType $pin]
if {$success == 0} then {
    puts [CkPkcs11_lastErrorText $pkcs11]
    delete_CkPkcs11 $pkcs11
    exit
}

# Generate a 256-bit AES key.
# (32 bytes is 256 bits)
# Append 32 bytes of random data in the base64 encoding.
set sbAesKey [new_CkStringBuilder]

CkStringBuilder_AppendRandom $sbAesKey 32 "base64"

set attrs [new_CkJsonObject]

# Specify the type of object, and the type of key.
CkJsonObject_UpdateString $attrs "class" "CKO_SECRET_KEY"
CkJsonObject_UpdateString $attrs "key_type" "CKK_AES"
# Add an optional label if desired.
CkJsonObject_UpdateString $attrs "label" "My AES wrapping/unwrapping key"
# Allow the key to be use for wrapping and unwrapping operations.
CkJsonObject_UpdateBool $attrs "wrap" 1
CkJsonObject_UpdateBool $attrs "unwrap" 1

# Provide the AES key material.
CkJsonObject_UpdateString $attrs "value" [CkStringBuilder_getAsString $sbAesKey]

# Create the object (i.e. create the AES key with the given key material.)
# Returns the PKCS11 object handle of the created AES session key.
set objHandle [CkPkcs11_CreatePkcs11Object $pkcs11 $attrs]
if {$objHandle == 0} then {
    puts [CkPkcs11_lastErrorText $pkcs11]
    puts "Failed."
} else {
    puts "PKCS11 object handle = $objHandle"
    puts "Successfully created a 256-bit AES session key."
}

# Typically, you would do other things in the PKCS11 session that use the handle of AES key we just created.
# ...
# ...

CkPkcs11_Logout $pkcs11
CkPkcs11_CloseSession $pkcs11

delete_CkPkcs11 $pkcs11
delete_CkStringBuilder $sbAesKey
delete_CkJsonObject $attrs