可以在SoftHSM上存储密钥吗？

Question

我已经找到了这个线程：Connecting to SoftHSM java，它在存储私钥时工作，就像这个例子一样。

但我需要存储密匙，比如AES。

这是我的密码：

import java.security.*;
import sun.security.pkcs11.*;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    public static void main(String[] args) throws Exception {
        // Set up the Sun PKCS 11 provider
        String configName = "softhsm.cfg";
        Provider p = new SunPKCS11(configName);

        if (-1 == Security.addProvider(p)) {
            throw new RuntimeException("could not add security provider");
        }

        // Load the key store
        char[] pin = "mypin".toCharArray();
        KeyStore keyStore = KeyStore.getInstance("PKCS11", p);
        keyStore.load(null, pin);

        // AES key
        SecretKeySpec secretKeySpec = new SecretKeySpec("0123456789ABCDEF".getBytes(), "AES");
        Key key = new SecretKeySpec(secretKeySpec.getEncoded(), "AES");

        keyStore.setKeyEntry("AA", key, "1234".toCharArray(), null);
        keyStore.store(null); //this gives me the exception.
    }
}

这是softhsm.cfg文件：

name = SoftHSM
library = /usr/local/lib/softhsm/libsofthsm.so
slot = 0
attributes(generate, *, *) = {
   CKA_TOKEN = true
}
attributes(generate, CKO_CERTIFICATE, *) = {
   CKA_PRIVATE = false
}
attributes(generate, CKO_PUBLIC_KEY, *) = {
   CKA_PRIVATE = false
}

当执行keyStore.store(null)时，我得到了java.security.KeyStoreException Cannot convert to PKCS11 keys

Answer 1

结果发现，异常发生在SoftHSMv1中。我安装了SoftHSMv2，您可以使用git从GitHub下载它，并使用它存储密钥。不要从SoftHSMv2网站下载OpenDNSsec，因为它不能工作！

最后，我必须更改softhsm.cfg文件以指向新的库，由于某种原因我忽略了，SoftHSM2更改了初始化槽的数目，可以使用sudo softhsm2-util --show-slots验证它。

softhsm.cfg：

name = SoftHSM
library = /usr/local/lib/softhsm/libsofthsm2.so
slot = 498488451
attributes(generate, *, *) = {
   CKA_TOKEN = true
}
attributes(generate, CKO_CERTIFICATE, *) = {
   CKA_PRIVATE = false
}
attributes(generate, CKO_PUBLIC_KEY, *) = {
   CKA_PRIVATE = false
}

我的代码：

import java.security.*;
import sun.security.pkcs11.*;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    public static void main(String[] args) throws Exception {
        // Set up the Sun PKCS 11 provider
        String configName = "softhsm.cfg";
        Provider p = new SunPKCS11(configName);

        if (-1 == Security.addProvider(p)) {
            throw new RuntimeException("could not add security provider");
        }

        // Load the key store
        char[] pin = "mypin".toCharArray();
        KeyStore keyStore = KeyStore.getInstance("PKCS11", p);
        keyStore.load(null, pin);

        // AES key
        SecretKeySpec secretKeySpec = new SecretKeySpec("0123456789ABCDEF".getBytes(), "AES");
        Key key = new SecretKeySpec(secretKeySpec.getEncoded(), "AES");

        keyStore.setKeyEntry("AA", key, "1234".toCharArray(), null);
        keyStore.store(null); //this no longer gives me the exception.

        Enumeration<String> aliases = keyStore.aliases();
        while(aliases.hasMoreElements()){
            String alias = aliases.nextElement();
            System.out.println(alias + ": " + keyStore.getKey(alias,"1234".toCharArray()));
        }
    }
}

这给了我输出：

AA: SunPKCS11-SoftHSM AES secret key, 16 bits (id 2, token object, not sensitive, unextractable)

如果您尝试使用类似于keyStore.getKey("AA", "1234".toCharArray());的东西来获取密钥，您将得到一个带有键的一些属性的objet，但是您将无法使用.getEncoded()来实际获取密钥本身，因为它是不可提取的。