錯誤地創建與pkcs11interop的ECDSA密鑰對

Question

我連接到支持secp256r1的金雅拓HSM。我有以下代碼來使用Pkcs11interop創建一個ECDSA密鑰對。我得到了使用BouncyCastle NistNamedCurves和X962Parameters的paramsBytes。

HSM繼續與CKR_ATTRIBUTE_TYPE_INVALID重新合作。我是ECDSA的新手，所以我可能錯過了一些東西。有任何想法嗎？

   X9ECParameters x9Ec = NistNamedCurves.GetByName("P-256"); 
       X962Parameters x962 = new X962Parameters(x9Ec); 
       byte[] paramsBytes = x962.GetDerEncoded(); 

       // The CKA_ID attribute is intended as a means of distinguishing multiple key pairs held by the same subject 
       byte[] ckaId = session.GenerateRandom(20); 

       // Prepare attribute template of new public key 
       List<ObjectAttribute> publicKeyAttributes = new List<ObjectAttribute>(); 
       publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_PRIVATE, false)); 
       publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, keyName)); 
       publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ID, ckaId)); 
       publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_VERIFY, true)); 
       publicKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes)); 

       // Prepare attribute template of new private key 
       List<ObjectAttribute> privateKeyAttributes = new List<ObjectAttribute>(); 
       privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_PRIVATE, true)); 
       privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, keyName)); 
       privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ID, ckaId)); 
       privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_SENSITIVE, true)); 
       privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_SIGN, true)); 
       privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes)); 

       // Generate key pair 
       Mechanism mechanism = new Mechanism(CKM.CKM_ECDSA_KEY_PAIR_GEN); 
       ObjectHandle publicKeyHandle = null; 
       ObjectHandle privateKeyHandle = null; 
       session.GenerateKeyPair(mechanism, publicKeyAttributes, privateKeyAttributes, out publicKeyHandle, 
        out privateKeyHandle); 

Answer 1

發現了什麼事。 HSM不喜歡私鑰上的

privateKeyAttributes.Add(new ObjectAttribute(CKA.CKA_ECDSA_PARAMS, paramsBytes)); 

。 PKCS指出ECDSA參數需要位於公鑰上，不能位於私鑰上，並且此實現強制執行該項。