Retrieving Double DES KEY from my HSM using NCrytoki (.net c#)

2/2/2012 11:39:15 AM
Gravatar
Total Posts 2

Retrieving Double DES KEY from my HSM using NCrytoki (.net c#)

Dear Ugo,  

             Kindly assist with the following.

My Keys (Double DES) are store on a software HSM (ERACOM), I have been able to connect to the HSM using NCrytoki Sample Code. However the Sample Codes only showed methods for RSA.

My question
1.) Can you display sample Codes for retrieving  Double DES KEY from my HSM using NCrytoki (.net c#)

 

Kindly respond as soon as possible

2/2/2012 1:40:49 PM
Gravatar
Total Posts 300
Ugo Chirico http://www.ugochirico.com

Re: Retrieving Double DES KEY from my HSM using NCrytoki (.net c#)

Hi,

refer to this page in NCryptoki's wiki:

http://wiki.ncryptoki.com/How-to-extract-a-DES-secret-key.ashx

 

2/2/2012 3:50:40 PM
Gravatar
Total Posts 2

Re: Retrieving Double DES KEY from my HSM using NCrytoki (.net c#)

Thank you for your response.

Kindly review, i got the following error "CryptoKiExcpetion was unhanded  Error n. 17" on the last line one this Code snippet (i believe this error occored when passing secretKey.KeyValue to KeyValue (Byte[]) )

            CryptokiCollection template = new CryptokiCollection();
            template.Add(new ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_SECRET_KEY));
            template.Add(new ObjectAttribute(ObjectAttribute.CKA_KEY_TYPE, Key.CKK_DES2));
            template.Add(new ObjectAttribute(ObjectAttribute.CKA_LABEL, "GTBG_TK"));

            // Launchs the search specifying the template just created
            CryptokiCollection objects = session.Objects.Find(template, 10);


            Console.WriteLine(((SecretKey)objects[0]).Label);
            SecretKey secretKey = (SecretKey)objects[0];
            //Extracts the key value
            byte[] keyValue = secretKey.KeyValue;

2/2/2012 3:59:59 PM
Gravatar
Total Posts 300
Ugo Chirico http://www.ugochirico.com

Re: Retrieving Double DES KEY from my HSM using NCrytoki (.net c#)

error 17 (0x11) means:

CKR_ATTRIBUTE_SENSITIVE

From the PKCS#11 specs:

"CKR_ATTRIBUTE_SENSITIVE: An attempt was made to obtain the value of an attribute of an object which cannot be satisfied because the object is either sensitive or unextractable."

and

"Additional protection can be given to private keys and secret keys by marking them as “sensitive” or “unextractable”. Sensitive keys cannot be revealed in plaintext off the token, and unextractable keys cannot be revealed off the token even when encrypted (though they can still be used as keys)."