Question

我正在连接支持secp256r1的Gemalto HSM。我有以下代码使用Pkcs11interop创建一个ECDSA密钥对。我使用BouncyCastle NistNamedCurves和X962Parameters来获取paramsBytes。

HSM继续使用CKR_ATTRIBUTE_TYPE_INVALID返回。我是ECDSA的新手，所以我可能错过了一些东西。有什么想法吗？

                X9ECParameters x9Ec = NistNamedCurves.GetByName("P-256");
                X962Parameters x962 = new X962Parameters(x9Ec);
                byte[] paramsBytes =  x962.GetDerEncoded();

                // The CKA_ID attribute is intended as a means of distinguishing multiple key pairs held by the same subject
                byte[] ckaId = session.GenerateRandom(20);

                // Prepare attribute template of new public key
                List<ObjectAttribute> publicKeyAttributes = new List<ObjectAttribute>();
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_PRIVATE, false));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, keyName));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ID, ckaId));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_VERIFY, true));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes));

                // Prepare attribute template of new private key
                List<ObjectAttribute> privateKeyAttributes = new List<ObjectAttribute>();
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_PRIVATE, true));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, keyName));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ID, ckaId));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_SENSITIVE, true));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_SIGN, true));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes));

                // Generate key pair
                Mechanism mechanism = new Mechanism(CKM.CKM_ECDSA_KEY_PAIR_GEN);
                ObjectHandle publicKeyHandle = null;
                ObjectHandle privateKeyHandle = null;
                session.GenerateKeyPair(mechanism, publicKeyAttributes, privateKeyAttributes, out publicKeyHandle,
                    out privateKeyHandle);

Answer 1

了解发生了什么。

不喜欢HSM

privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes));

私钥上的

。 PKCS声明ECDSA参数需要在公钥上，并且不能在私钥上，并且这种实现强制执行。

使用pkcs11interop创建ECDSA密钥对时出错

1 个答案: