Xbase++

PKCS11 Generate Secret Key (such as AES)

See more PKCS11 Examples

Generates a symmetric secret key such as AES on the HSM.

Note: This example requires Chilkat v9.5.0.96 or later.

Xbase++

LOCAL nSuccess
LOCAL oPkcs11
LOCAL cPin
LOCAL nUserType
LOCAL cKeyType
LOCAL oJson
LOCAL nKeyHandle

nSuccess := 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

oPkcs11 := CreateObject("Chilkat.Pkcs11")

//  Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
//  (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
oPkcs11:SharedLibPath := "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

//  Establish a logged-on session.
cPin := "0000"
nUserType := 1
nSuccess := oPkcs11:QuickSession(nUserType, cPin)
IF (nSuccess == 0)
    ? oPkcs11:LastErrorText
    oPkcs11:destroy()
    RETURN
ENDIF

//  Let's generate a 256-bit AES key on the token, which will exist for the duration of this session.
//  Symmetric keys, such as AES keys, are typically created (or imported) and used during a single session.

//  Other possible values for keyType are "AES XTS", "Blowfish", "Twofish", "ChaCha20", and others. 
//  In virtually all cases, you'll want to create an AES key.
cKeyType := "AES"

//  Specify attributes and abilities (how this key can be used) by providing a JSON template.
oJson := CreateObject("Chilkat.JsonObject")

//  The key can be extracted or wrapped.
oJson:UpdateBool("extractable", 1)

//  Allow the key to be used for encryption, decryption, wrapping other keys, and unwrapping other keys.
oJson:UpdateBool("encrypt", 1)
oJson:UpdateBool("decrypt", 1)
oJson:UpdateBool("wrap", 1)
oJson:UpdateBool("unwrap", 1)

//  Indicate a 256-bit AES key is to be generated by setting the value_len attribute equal to the key size in bytes.
//  (32 bytes * 8 bits/byte = 256 bits)
oJson:UpdateInt("value_len", 32)

nKeyHandle := oPkcs11:GenSecretKey(cKeyType, oJson)
IF (nKeyHandle == 0)
    ? oPkcs11:LastErrorText
    ? "Failed to generate an AES key."
ELSE
    ? "key handle = " + Str(nKeyHandle)
    ? "Success."
ENDIF

oPkcs11:Logout()
oPkcs11:CloseSession()

oPkcs11:destroy()
oJson:destroy()