Zig

PKCS11 Import an Existing AES Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing AES symmetric encrytion key onto the smartcard/token. The imported AES key is a session object, and only exists for the duration of the PKCS11 session. (AES keys are typically used for wrapping/unwrapping RSA and EC keys.)

Note: This example requires Chilkat v9.5.0.96 or later.

Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    const pkcs11 = try chilkat.Pkcs11.init();
    defer pkcs11.deinit();

    // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
    // (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
    pkcs11.setSharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll");

    // Establish a logged-on session.
    const pin = "0000";
    const user_type = 1;
    pkcs11.quickSession(user_type, pin) catch {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    };

    // Generate a 256-bit AES key.
    // (32 bytes is 256 bits)
    // Append 32 bytes of random data in the base64 encoding.
    const sb_aes_key = try chilkat.StringBuilder.init();
    defer sb_aes_key.deinit();
    sb_aes_key.appendRandom(32, "base64") catch {};

    const attrs = try chilkat.JsonObject.init();
    defer attrs.deinit();
    // Specify the type of object, and the type of key.
    attrs.updateString("class", "CKO_SECRET_KEY") catch {};
    attrs.updateString("key_type", "CKK_AES") catch {};
    // Add an optional label if desired.
    attrs.updateString("label", "My AES wrapping/unwrapping key") catch {};
    // Allow the key to be use for wrapping and unwrapping operations.
    attrs.updateBool("wrap", true) catch {};
    attrs.updateBool("unwrap", true) catch {};

    // Provide the AES key material.
    attrs.updateString("value", try sb_aes_key.getAsString(alloc)) catch {};

    // Create the object (i.e. create the AES key with the given key material.)
    // Returns the PKCS11 object handle of the created AES session key.
    const obj_handle = pkcs11.createPkcs11Object(attrs);
    if (obj_handle == 0) {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        std.debug.print("Failed.\n", .{});
    } else {
        std.debug.print("PKCS11 object handle = {d}\n", .{obj_handle});
        std.debug.print("Successfully created a 256-bit AES session key.\n", .{});
    }

    // Typically, you would do other things in the PKCS11 session that use the handle of AES key we just created.
    // ...
    // ...

    pkcs11.logout() catch {};
    pkcs11.closeSession() catch {};
}