Clash Royale CLAN TAG#URR8PPP

Cannot generate 32 bytes AES Secret using pkcs11js

I wanted to generate a 32 bytes AES Secret Key with the code below. I am using the node module pkcs11js as I need to connect to HSM. However, when I printed the length of the key, it is showing 8 instead of 32.

var path = require('path');
var pkcs11js = require("pkcs11js");
var crypto = require('crypto');
process.env['SOFTHSM2_CONF'] = path.resolve(__dirname, '../softhsm2.conf');

var pkcs11 = new pkcs11js.PKCS11();
pkcs11.load("/usr/local/Cellar/softhsm/2.4.0/lib/softhsm/libsofthsm2.so");

pkcs11.C_Initialize();

const _pkcs11FindObjects = (pkcs11, pkcs11Session, pkcs11Template) =>
pkcs11.C_FindObjectsInit(pkcs11Session, pkcs11Template);
var objs = ;
var obj = pkcs11.C_FindObjects(pkcs11Session);
while (obj)
objs.push(obj);
obj = pkcs11.C_FindObjects(pkcs11Session);

pkcs11.C_FindObjectsFinal(pkcs11Session);
return objs;


const _pkcs11Login = (slotNumber, pin) =>

let s = null;
try
const slots = pkcs11.C_GetSlotList(true);
const slot = slots[slotNumber];
var token_info = pkcs11.C_GetTokenInfo(slot);
s = pkcs11.C_OpenSession(slot, pkcs11js.CKF_RW_SESSION catch (e)
if (s != null)
pkcs11.C_CloseSession(s);

pkcs11.C_Finalize();




const _findAESKey = (session, ski) =>
var secretKeyHandle = _pkcs11FindObjects(pkcs11, session, [
type: pkcs11js.CKA_ID,
value: ski
,

type: pkcs11js.CKA_CLASS,
value: pkcs11js.CKO_SECRET_KEY

]);

if (secretKeyHandle.length == 1)
return secretKeyHandle[0];
else
return null;



const _createAESKey = (session, ski) =>

let key = _findAESKey(session, ski);
if (key && key !== null)
console.log('Key already exists. No need to re-create');
return;


var template = [
type: pkcs11js.CKA_ID,
value: ski
,

type: pkcs11js.CKA_CLASS,
value: pkcs11js.CKO_SECRET_KEY
,

type: pkcs11js.CKA_TOKEN,
value: true
,

type: pkcs11js.CKA_LABEL,
value: "My AES Key"
,

type: pkcs11js.CKA_VALUE_LEN,
value: 32
,

type: pkcs11js.CKA_ENCRYPT,
value: true
,

type: pkcs11js.CKA_DECRYPT,
value: true
,

type: pkcs11js.CKA_PRIVATE,
value: true

];
pkcs11.C_GenerateKey(session,
mechanism: pkcs11js.CKM_AES_KEY_GEN
, template);


let session = _pkcs11Login(0, '98765432');
_createAESKey(session, `9Rf3uJ7CEdKIhUvQu/2KN8hK0Kce0zYfPXSc8xAK4Oc=`);
let key = _findAESKey(session, `9Rf3uJ7CEdKIhUvQu/2KN8hK0Kce0zYfPXSc8xAK4Oc=`);
console.log(`key length: $key.length`); //key length: 8


The reason is I want to encrypt data using the function below which requires a key length of 32.

const encryptString = (s, secret) =>
const iv = crypto.randomBytes(16).toString('hex').slice(0, 16);
const cipher = crypto.createCipheriv('aes-256-ctr', secret, iv);
const encrypted = cipher.update(String(s), 'utf8', 'hex') + cipher.final('hex');
return iv + encrypted;


let e = encryptString('shezhuan sauce', key);
console.log(`encrypted string: $e`);


The above code will generate Invalid key length error.

2 Answers
2

Based on the answer here: https://github.com/PeculiarVentures/pkcs11js/issues/34, I am able to extract the secret key by using getting the CKA_VALUE attribute but I need to set the following during key generation: pkcs11js.CKA_EXTRACTABLE, value: true . I understand that this of course defeats the purpose of HSM which is not to expose the secret.

pkcs11js.CKA_EXTRACTABLE, value: true

The core issue here is the mechanism that is used is not supported by SoftHSM which is why only the get/set attribute approach is used. It is possible to get the length of a value without setting it to extractable but only if the mechanism is supported by the HSM/PKCS11 implementation.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.