'Get ECDSA Public Key Attributes from PKCS11 Interop ObjectHandle
I'm trying to create a PKCS10/CSR from Keys stored in a HSM.
It works just fine for RSA, but for ECDSA I'm struggeling to get the public key attributes
for the AsymetricKeyParameter for the BouncyCastle function Pkcs10CertificationRequestDelaySigned.
var certificateSigningRequestDelayed = new Pkcs10CertificationRequestDelaySigned(signatureAlgorithm, new X509Name(subjectDistinguishedName), publicKeyParameters, null);
This is my function:
public static byte[] GenerateCertificateSigningRequest(ISession session, IObjectHandle publicKeyHandle, IObjectHandle privateKeyHandle, string subjectDistinguishedName, string keyType, HashAlgorithm hashAlgorithm)
{
AsymmetricKeyParameter publicKeyParameters = null;
if (keyType == "RSA")
{
var pubKeyAttrsToRead = new List<CKA>
{
CKA.CKA_KEY_TYPE,
CKA.CKA_MODULUS,
CKA.CKA_PUBLIC_EXPONENT
};
var publicKeyAttributes = session.GetAttributeValue(publicKeyHandle, pubKeyAttrsToRead);
//cause nobody wants a small Integer
var modulus = new BigInteger(1, publicKeyAttributes[1].GetValueAsByteArray());
var publicExponent = new BigInteger(1, publicKeyAttributes[2].GetValueAsByteArray());
publicKeyParameters = new RsaKeyParameters(false, modulus, publicExponent);
}
if (keyType == "ECDSA")
{
var pubKeyAttrsToRead = new List<CKA>
{
CKA.CKA_KEY_TYPE,
};
var publicKeyAttributes = session.GetAttributeValue(publicKeyHandle, pubKeyAttrsToRead);
var attrs = new BigInteger(1, publicKeyAttributes[0].GetValueAsByteArray());
publicKeyParameters = new ECPublicKeyParameters(false, keyParameters);
}
IMechanism mechanism = null;
string signatureAlgorithm = null;
switch (hashAlgorithm)
{
case HashAlgorithm.SHA1:
mechanism = keyType == "RSA" ? session.Factories.MechanismFactory.Create(CKM.CKM_SHA1_RSA_PKCS) : session.Factories.MechanismFactory.Create(CKM.CKM_ECDSA_SHA1);
signatureAlgorithm = PkcsObjectIdentifiers.Sha1WithRsaEncryption.Id;
break;
case HashAlgorithm.SHA256:
mechanism = keyType == "RSA" ? session.Factories.MechanismFactory.Create(CKM.CKM_SHA256_RSA_PKCS) : session.Factories.MechanismFactory.Create(CKM.CKM_ECDSA_SHA256);
signatureAlgorithm = PkcsObjectIdentifiers.Sha256WithRsaEncryption.Id;
break;
case HashAlgorithm.SHA384:
mechanism = keyType == "RSA" ? session.Factories.MechanismFactory.Create(CKM.CKM_SHA384_RSA_PKCS) : session.Factories.MechanismFactory.Create(CKM.CKM_ECDSA_SHA384);
signatureAlgorithm = PkcsObjectIdentifiers.Sha384WithRsaEncryption.Id;
break;
case HashAlgorithm.SHA512:
mechanism = keyType == "RSA" ? session.Factories.MechanismFactory.Create(CKM.CKM_SHA512_RSA_PKCS) : session.Factories.MechanismFactory.Create(CKM.CKM_ECDSA_SHA512);
signatureAlgorithm = PkcsObjectIdentifiers.Sha512WithRsaEncryption.Id;
break;
}
var certificateSigningRequestDelayed = new Pkcs10CertificationRequestDelaySigned(signatureAlgorithm, new X509Name(subjectDistinguishedName), publicKeyParameters, null);
var signature = session.Sign(mechanism, privateKeyHandle, certificateSigningRequestDelayed.GetDataToSign());
certificateSigningRequestDelayed.SignRequest(new DerBitString(signature));
return certificateSigningRequestDelayed.GetDerEncoded();
}
This is my working RSA Code:
var pubKeyAttrsToRead = new List<CKA>
{
CKA.CKA_KEY_TYPE,
CKA.CKA_MODULUS,
CKA.CKA_PUBLIC_EXPONENT
};
var publicKeyAttributes = session.GetAttributeValue(publicKeyHandle, pubKeyAttrsToRead);
//cause nobody wants a small Integer
var modulus = new BigInteger(1, publicKeyAttributes[1].GetValueAsByteArray());
var publicExponent = new BigInteger(1, publicKeyAttributes[2].GetValueAsByteArray());
publicKeyParameters = new RsaKeyParameters(false, modulus, publicExponent);
This is my not working ECDSA Code:
if (keyType == "ECDSA")
{
var pubKeyAttrsToRead = new List<CKA>
{
CKA.CKA_KEY_TYPE,
};
var publicKeyAttributes = session.GetAttributeValue(publicKeyHandle, pubKeyAttrsToRead);
var attrs = new BigInteger(1, publicKeyAttributes[0].GetValueAsByteArray());
publicKeyParameters = new ECPublicKeyParameters(false, keyParameters);
}
Unfortunetly I couldn't find any related or helpful information trough google.
What am I missing? Thanks in advance for your help!
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
