pkcs#11 - 与PCKS11interop和Safenet网络HSM ECDH1_DERIVE问题

我一直在与Gemalto网络HSM战斗一段时间，大约在一段时间后，我寻求一些专家帮助。我试图从存储在HSM上的已知公钥和私钥派生ECDH1 key ，并不断将HSM发送到某种紧急状态，这要求我在每次调用该派生 key 重新开始交谈之前将其重置功能如下。有人得到任何指示吗？

static string PKCSLibraryPath = @"C:\Program Files (x86)\SafeNet\Protect Toolkit 5\Protect Toolkit C SDK\bin\hsm\cryptoki.dll";
    static Pkcs11 pkc = new Pkcs11(PKCSLibraryPath, AppType.SingleThreaded);

    public string HSM_Interaction(int SlotNumber, string KeyLabel, string Pubkey, string GUID)
    {

        List<Slot> slots = pkc.GetSlotList(SlotsType.WithTokenPresent);
        string pass = "1111";

        //convert putblic key to byte array
        byte[] data = Get_pub_Key(Pubkey);

        //convert password to byte array
        byte[] password = Encoding.ASCII.GetBytes(pass);

        //select correct HSM slot
        Slot S = slots[SlotNumber];

        using (Session Sesh = S.OpenSession(SessionType.ReadWrite))
        {

            Sesh.Login(CKU.CKU_USER, password);
            List<CKM> Mechs = S.GetMechanismList();
            ObjectHandle oPrivKeyObjectHandle;

            //setup search criteria for token
            List<ObjectAttribute> objectAttributes = new List<ObjectAttribute>();
            objectAttributes.Add(new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_PRIVATE_KEY));
            objectAttributes.Add(new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_EC));
            objectAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, KeyLabel));
            Sesh.FindObjectsInit(objectAttributes);
            List<ObjectHandle> oObjCollection = Sesh.FindObjects(1);
            Sesh.FindObjectsFinal();

            if (oObjCollection.Count > 0)
            {
                oPrivKeyObjectHandle = oObjCollection[0];

                //set template for generated key
                var shared_secret_template = new List<ObjectAttribute>
                {
                    new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                    new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_GENERIC_SECRET),
                    new ObjectAttribute(CKA.CKA_SENSITIVE, false),
                    new ObjectAttribute(CKA.CKA_EXTRACTABLE, true),
                    new ObjectAttribute(CKA.CKA_VALUE_LEN, (ulong)32)
                };


                var deriveAttributes = new List<ObjectAttribute>
                 {
                     new ObjectAttribute(CKA.CKA_TOKEN, false),
                     new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                     new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_GENERIC_SECRET),
                     new ObjectAttribute(CKA.CKA_SENSITIVE, false),
                     new ObjectAttribute(CKA.CKA_EXTRACTABLE, true),
                     new ObjectAttribute(CKA.CKA_ENCRYPT, true),
                     new ObjectAttribute(CKA.CKA_DECRYPT, true),
                     new ObjectAttribute(CKA.CKA_WRAP, true),
                     new ObjectAttribute(CKA.CKA_UNWRAP, true),
                     new ObjectAttribute(CKA.CKA_VALUE_LEN, (ulong)32)
                };


                try
                {
                    //generate derived key

                    byte[] sd = null;
                    CkEcdh1DeriveParams par = new CkEcdh1DeriveParams((ulong)CKD.CKD_NULL, sd, data);
                    par.ToMarshalableStructure();
                    Mechanism m = new Mechanism(CKM.CKM_ECDH1_DERIVE, par);
                    Sesh.DeriveKey(m, oPrivKeyObjectHandle, deriveAttributes);
                    ObjectHandle SSOH = new ObjectHandle();

                    Sesh.GetAttributeValue(SSOH,deriveAttributes);

                }
                catch (Exception ex)
                {
                    string error = ex.Message;
                }
                finally
                {
                    Sesh.Logout();
                }

            }
        }
        return "";
    }
    private byte[] Get_SHA256(string text)
    {
        byte[] bytes = Encoding.UTF8.GetBytes(text);
        SHA256Managed hashstring = new SHA256Managed();
        byte[] hash = hashstring.ComputeHash(bytes);
        string hashString = string.Empty;
        foreach (byte x in hash)
        {
            hashString += String.Format("{0:x2}", x);
        }

        return hash;

    }

    private byte[] Get_pub_Key(string text)
    {
        byte[] Bytes = new byte[65];
        int startpos = 0;
        for (int i = 0; i < (text.Length / 2); i++)
        {
            byte b = Convert.ToByte(text.Substring(startpos, 2), 16);
            Bytes[i] = b;
            startpos += 2;
        }
        return Bytes;
    }
}

接收错误:

Net.Pkcs11Interop.Common.Pkcs11Exception: 'Method C_DeriveKey returned 2147484548'

来自HSM的消息日志尾部:

Mar 21 07:59:10 hsm1 kernel: ERR:  viper0: _do_smachine: hsm kernel crashed
Mar 21 07:59:10 hsm1 kernel: ERR:  viper0: _do_smachine: device error
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0: HSM is being shut down, discarding pending requests...
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0:    DMA buffers:          0000
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0:    HSM commands:         0001
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0:    Callback requests:    0000
Mar 21 07:59:10 hsm1 etnetserver[990]: MDV2_SendReceiveCmd(): MD_SendReceive()
error: Internal error - unknown error

最佳答案

您得到的异常是，低级PKCS＃11函数C_DeriveKey返回了供应商特定的错误0x80000384(2147484548 dec)，称为CKR_SMS_ERROR。您将需要讨论设备供应商提供的文档或与供应商支持联系，以更好地了解如何处理或避免此特定错误。

此确切错误was also discussed in an older question是由多线程环境中不正确使用PKCS＃11 API引起的。

关于pkcs#11 - 与PCKS11interop和Safenet网络HSM ECDH1_DERIVE问题，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/49383728/