使用pkcs11interop创建ECDSA密钥对时出错

Question

我正在连接支持secp256r1的Gemalto HSM。我有以下使用Pkcs11interop创建ECDSA密钥对的代码。我正在使用BouncyCastle NistNamedCurves和X962Parameters获取paramsBytes。

HSM总是带着CKR_ATTRIBUTE_TYPE_INVALID返回。我是ECDSA的新手，所以我可能错过了一些东西。有什么想法吗？

                X9ECParameters x9Ec = NistNamedCurves.GetByName("P-256");
                X962Parameters x962 = new X962Parameters(x9Ec);
                byte[] paramsBytes =  x962.GetDerEncoded();

                // The CKA_ID attribute is intended as a means of distinguishing multiple key pairs held by the same subject
                byte[] ckaId = session.GenerateRandom(20);

                // Prepare attribute template of new public key
                List<ObjectAttribute> publicKeyAttributes = new List<ObjectAttribute>();
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_PRIVATE, false));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, keyName));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ID, ckaId));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_VERIFY, true));
                publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes));

                // Prepare attribute template of new private key
                List<ObjectAttribute> privateKeyAttributes = new List<ObjectAttribute>();
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_PRIVATE, true));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, keyName));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ID, ckaId));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_SENSITIVE, true));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_SIGN, true));
                privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes));

                // Generate key pair
                Mechanism mechanism = new Mechanism(CKM.CKM_ECDSA_KEY_PAIR_GEN);
                ObjectHandle publicKeyHandle = null;
                ObjectHandle privateKeyHandle = null;
                session.GenerateKeyPair(mechanism, publicKeyAttributes, privateKeyAttributes, out publicKeyHandle,
                    out privateKeyHandle);

Answer 1

发现了发生了什么事。HSM不喜欢

privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes));

在私钥上。PKCS规定ECDSA参数需要在公钥上，而不能在私钥上，这个实现强制了这一点。