Hi,
On 04/10/17 10:17, lists wrote:
On 09/27/2017 11:13 PM, Ken Goldman wrote:
On 9/27/2017 2:19 PM, Dirk-Willem van Gulik wrote:
On 27 Sep 2017, at 20:02, Michael Wojcik
The tokens / HSMs I've used don't let you generate a key somewhere
else and install it on the token. They insist on doing the key
generation locally. That is, after all, part of the point of using
a token - the key never leaves it.
I've found that the Feitian ePass2000's and the Yubico keys allow for
importing of the private key. They do usually want the 'extra' flags
to specify use:
FWIW, the TPM hardware also permits key import. It does validate attributes, so users will know that the key was not
generated on chip.
Most smart cards (G&D, Oberthur and InCard) I've dealt with allow for external generation of RSA keys and import into the token.
Currently I mostly use InCard cards sold in Italy, I can't tell if the other brands are still easily purchaseable.
FWIW: I've used mostly Aladdin/Safenet/Gemalto eTokens (32K, 64K, 72K) and they all support the import of RSA keys (as well as
generation of keys, of course).
Furthermore, if you look at the libp11 library then you will find that it does just that: generate a key in memory and then
store it on the etoken. The source code even has a comment about this:
110 /*
111 * Generate and store a private key on the token
112 * FIXME: We should check first whether the token supports
113 * on-board key generation, and if it does, use its own algorithm
114 */
115 int
116 PKCS11_generate_key(PKCS11_TOKEN * token,
117 int algorithm, unsigned int bits, char *label, unsigned char* id, size_t id_len)
118 {
119 PKCS11_KEY *key_obj;
120 EVP_PKEY *pk;
121 RSA *rsa;
122 BIO *err;
123 int rc;
124
125 if (algorithm != EVP_PKEY_RSA) {
126 PKCS11err(PKCS11_F_PKCS11_GENERATE_KEY, PKCS11_NOT_SUPPORTED);
127 return -1;
128 }
129
130 err = BIO_new_fp(stderr, BIO_NOCLOSE);
131 rsa = RSA_generate_key(bits, 0x10001, NULL, err);
132 BIO_free(err);
133 if (rsa == NULL) {
134 PKCS11err(PKCS11_F_PKCS11_GENERATE_KEY, PKCS11_KEYGEN_FAILED);
135 return -1;
136 }
137
138 pk = EVP_PKEY_new();
139 EVP_PKEY_assign_RSA(pk, rsa);
140 rc = pkcs11_store_private_key(token, pk, label, id, id_len, &key_obj);
JM2CW,
JJK
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
