How to export generated keypairs?

[MrWildanMD]

I'm using Utimaco HSM Simulator but how i can export the generated keypairs?
i need to export the private and the public generated by hsm to use it later with CA

[keldonin]

Hi @MrWildanMD,

Can you please elaborate more on your plan? do you mean to deploy your keys into an HSM?
On a side note, the simulator does not have the same level of assurance than a real HSM.

[keldonin]

The explanation provided is for the private key. Note that the public key if present will also be carried inside the wrap file and imported back onto the target HSM.

You can't display the content of an extractable key directly. This attribute means the key can be wrapped.

[MrWildanMD]

Okay, thanks for the explanation, can i have a feature request? like signing data, verify signed data, or if i can contribute to this can you explain the project dir? so i can contribute 😄

[keldonin]

Hi @MrWildanMD , sorry for the late reply. You can request features, obviously. that being said, pkcs11-tools is meant to be a key management tool, in the first place. Signing or verifying data is shifting the intent towards key operation, not sure if it belongs here.

Can you be more specific on the use case? what data would you like to sign/verify? In what context?

Cheers,

[MrWildanMD]

sorry for late reply, so i would like to use the private key to sign into docs (like pdf) so the pdf can be verfied using the p12.
if u confused what i'm saying, the content of private key will be injected inside docs then within p12 from keygen u can verify it

[keldonin]

I must admit this is confusing indeed. A PKCS#12 usually contains a private key together with certificates. To validate documents, you only need a public key (embedded into a certificate + its chain). It means you don't need an HSM or even a PKCS#12 keystore to do that. Am I missing something?

[MrWildanMD]

@keldonin hi, what about luna hsm? when i try ./with_luna p11slotinfo it return token not present, did i miss some step?

[keldonin]

can you please choose "11" (Slot Info) and report what you get with ckdemo ?

[MrWildanMD]

@keldonin here you go

[keldonin]

Alright, can you now execute "Token Info" (12) and select slot 0 when asked for a slot number, and report the content?

As an example, here is what I have on my config:

$ ckdemo -n
ckdemo (64-bit) v10.7.0-255. Copyright (c) 2023 Thales Group. All rights reserved.

ckdemo is the property of Thales Group and is provided to our customers for
diagnostic and development purposes only.  It is not intended for use in
production installations.  Any re-distribution of this program in whole or
in part is a violation of the license agreement.

Modified on Dec 18 2023 at 15:32:15

Starting CHRYSTOKI DEMO - SIMULATION LAB

Status: Doing great, no errors (CKR_OK)

(TITLE) menu titles, (99 or FULL) Full Help, (NONE) No help, (0 or EXIT) Quit


Status: Doing great, no errors (CKR_OK)
Enter your choice : 12

Slots available:
	slot#0 - Net Token Slot
	slot#1 - Net Token Slot
	slot#2 - Net Token Slot
Select a slot: 0

Token Info:
	Token label -> lun0woo2.caectf.com-d99-p000
	Token Manufacturer -> Safenet, Inc.
	Token Model -> LunaSA 7.7.1
	Token Serial Number -> XXXXXXXXXXXX
	Token Flags ->
		CKF_RNG
		CKF_LOGIN_REQUIRED
		CKF_USER_PIN_INITIALIZED
		CKF_RESTORE_KEY_NOT_NEEDED
		CKF_TOKEN_INITIALIZED
	Sessions (count/max) -> 0 / 0
	Read/Write Sessions (count/max) -> 0 / 0
	PIN Length (min - max) -> 8 - 255
	Public Memory (free / total) -> 5564691 - 5585635
	Private Memory (free / total) -> 5564691 - 5585635
	Hardware Version                -> 0.0
	Firmware Version (CK_VERSION)   -> 7.7
	Firmware Version (Luna Version) -> 7.7.1
	Bootloader Version              -> 1.1.2
	UTC Time -> 20240502091818
Status: Doing great, no errors (CKR_OK)

(TITLE) menu titles, (99 or FULL) Full Help, (NONE) No help, (0 or EXIT) Quit


Status: Doing great, no errors (CKR_OK)
Enter your choice : 0

Ending CHRYSTOKI DEMO - SIMULATION LAB

Can you also provide the output of lunacm ?

$ lunacm -q slot list

[MrWildanMD]

@keldonin the issue is Crystoki.conf permission because i logged in as normal user so i changed the permission to 755 and can run smoothly right now

[keldonin]

Thanks for your feedback @MrWildanMD , glad you could find the root cause to your problem.