Question

在使用pkcs＃11的c ++代码中，我们试图找到私钥并在令牌中安装相应的x509证书。但是无法使用模数在令牌中找到密钥对。下面是我的代码示例。

    //Install certificate

    const char bytes[] = "-----BEGIN CERTIFICATE-----" "\n"
        ....
        "-----END CERTIFICATE-----" "\n";
    BIO *bio_mem = BIO_new(BIO_s_mem());
    BIO_puts(bio_mem, bytes);
    X509 * x509 = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL);
    //
    BIO *bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);

    EVP_PKEY *pkey = X509_get_pubkey(x509);

    RSA *rsa_key;
    DSA *dsa_key;
    char *rsa_e_dec, *rsa_n_hex, *dsa_p_hex,
        *dsa_q_hex, *dsa_g_hex, *dsa_y_hex;

    rsa_key = pkey->pkey.rsa;
    //IFNULL_FAIL(rsa_e_dec, "unable to extract rsa exponent");
    CK_BYTE_PTR modulus, exponent;

    modulus = (unsigned char *)malloc(256);
    int mo = BN_bn2bin(rsa_key->n, modulus);
    //EVP_PKEY_free(pkey);
//  CK_RV result;
    CK_OBJECT_HANDLE hObject;
    CK_OBJECT_HANDLE hObjects[100];
    CK_OBJECT_HANDLE_PTR hObject_PTR = NULL;
    CK_ULONG count;
    vector<CK_OBJECT_HANDLE> *handles = new vector<CK_OBJECT_HANDLE>();
    //Object class attribute
    CK_OBJECT_CLASS classValue = CKO_PRIVATE_KEY;
    CK_OBJECT_CLASS keytype = CKK_RSA;

    CK_ATTRIBUTE privKeySearchTemplate[] = {
        { CKA_CLASS, &classValue,sizeof(classValue) },
    { CKA_KEY_TYPE, &keytype,sizeof(keytype) },
    { CKA_MODULUS, &modulus, sizeof(modulus) },
    };
    //
    //{ CKA_PUBLIC_EXPONENT, exponent},

    // Read label and ID from private key handle
    CK_ATTRIBUTE privKeyAttrsToRead[] =
    { { CKA_LABEL, NULL_PTR, 0 },
    { CKA_ID, NULL_PTR, 0 },
    };
    //WriteToLog(modulus, modulus_len11);
    // Find all objects with the template specified
    result = m_pPKCS11->C_FindObjectsInit(m_SessionHandle, privKeySearchTemplate, 2);


    do {

        // Find the next object
        result = m_pPKCS11->C_FindObjects(m_SessionHandle, &hObject, 1, &count);


        if (count != 0)
            handles->push_back(hObject);

    } while (count != 0);

    result = m_pPKCS11->C_FindObjectsFinal(m_SessionHandle);

Answer 1

这里有几个错误：

{ CKA_MODULUS, &modulus, sizeof(modulus) }

像往常一样，sizeof(modulus)是指针的大小，根据系统，指针的大小是4或8。这应该是您的模数大小，在您的情况下为mo。另外，请在此处使用正确的类型：

CK_KEY_TYPE keytype = CKK_RSA;

另一个错误在这里：

m_pPKCS11->C_FindObjectsInit(m_SessionHandle, privKeySearchTemplate, 2);

您正在搜索具有3个属性的模板，但是您已将属性数量设置为2。通常，您需要编写这样的代码来防止此类错误：

m_pPKCS11->C_FindObjectsInit(m_SessionHandle, privKeySearchTemplate, sizeof(privKeySearchTemplate) / sizeof(CK_ATTRIBUTE));

最后，除非需要获取内存异常，否则在使用BN_bn2bin之前，您需要为模分配足够的内存。分配256字节可能不够。

如何在C ++中使用X509证书模数在令牌中找到私钥

1 个答案: