Hi,

i'm trying to store in my hsm luna pci a private key from a generated certificate.

Using bouncycastle library for create a certificate the code looks like this:

var keypairgen = new RsaKeyPairGenerator();
keypairgen.Init(new KeyGenerationParameters(new SecureRandom(new CryptoApiRandomGenerator()), 1024));

var keypair = keypairgen.GenerateKeyPair();

var gen = new X509V3CertificateGenerator();

var CN = new X509Name("CN=" + label);

var SN = BigInteger.ProbablePrime(120, new Random());

gen.SetSerialNumber(SN);

gen.SetSubjectDN(CN);

gen.SetIssuerDN(CN);

gen.SetNotAfter(DateTime.MaxValue);
gen.SetNotBefore(DateTime.Now.Subtract(new TimeSpan(7, 0, 0, 0)));
gen.SetSignatureAlgorithm("SHA1WithRSA");
gen.SetPublicKey(keypair.Public);

var newCert = gen.Generate(keypair.Private);

X509Certificate2 cert = new X509Certificate2(DotNetUtilities.ToX509Certificate((Org.BouncyCastle.X509.X509Certificate)newCert));
CryptokiCollection certTemplate = new CryptokiCollection();
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_CERTIFICATE));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_CERTIFICATE_TYPE, Certificate.CKC_X_509));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_LABEL, label));

certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_PRIVATE, false));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_TOKEN, true));

certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_SUBJECT, cert.SubjectName.RawData));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_ID, Encoding.ASCII.GetBytes(label)));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_VALUE, cert.RawData));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_ISSUER, cert.Issuer));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_SERIAL_NUMBER, cert.SerialNumber));
certTemplate.Add(new ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, false));
session.Objects.Create(certTemplate);

So far all works fine. Now i wantstore the private key of the certificate but i got CKR_TEMPLATE_INCONSISTENT error with following code:

PrivateKeyInfo privateKeyInfo = PrivateKeyInfoFactory.CreatePrivateKeyInfo(keypair.Private);
byte[] serializedKey = privateKeyInfo.ToAsn1Object().GetDerEncoded();
 CryptokiCollection templatePub = new CryptokiCollection();
 templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY));
 templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_KEY_TYPE, Key.CKK_RSA));
 templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_LABEL, "SS" + label));
 templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_TOKEN, true));
 //templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_PRIVATE, true));
 //templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_ENCRYPT, true));
 //templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_DECRYPT, true));
 templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_VALUE, serializedKey));
 session.Objects.Create(templatePub);

What can i do wrong?

Could you please help me?

Thanks in advance.

Regards

Andrea

Hi,

thank you for the response.

I've tried with modulus and exponent this way:

RsaPrivateCrtKeyParameters keyParams = (RsaPrivateCrtKeyParameters)keypair.Private;

CryptokiCollection templatePub = new CryptokiCollection();

templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_KEY_TYPE, Key.CKK_RSA));

templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_LABEL, "SS" + label));

templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_TOKEN, true));

templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_PRIVATE, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_ENCRYPT, true));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_DECRYPT, true));

templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_MODULUS, keyParams.Modulus.ToByteArray()));
templatePub.Add(new ObjectAttribute(ObjectAttribute.CKA_PRIVATE_EXPONENT, keyParams.Exponent.ToByteArray()));        session.Objects.Create(templatePub);

but no luck, same error.

May be I forgot something?

Thanks

Andrea

Hi,

sorry but i can't get work the code, i get always the same error.

It is possible that i get better luck doing the reverse, I can generate a key pair the create a certificate with the just created keys?

Thanks a lot.

Andrea