search

aws-samples / aws-cloudhsm-pkcs11-examples

Sample applications demonstrating how to use the CloudHSM PKCS#11 library
Other
52 stars 37 forks source link

Sample to demonstrate any operation on data (Encryption, Signing etc) using the key already present in aws cloudhsm. #78

Open anushka-settlemint opened 1 month ago

anushka-settlemint commented 1 month ago

I need to perform signing/verification and/or encryption/decryption using a key present in hsm. To elaborate, I wan to fetch the key from aws cloudhsm and the use that key to perform crypto operations. I am able to fetch the key using C_FindObjectsInit, C_FindObjects and C_FindObjectsFinal function. But when performing the cryptographic operations like signing or encryption, initialisation itself it failing i.e. C_EncryptInit / C_SignInit is giving error.

kladd commented 1 month ago

A couple of things to try:

  1. Check that the session handle used for FindObjects (example) is the same as the one used for Encrypt/Sign init (example). Object handles are session specific.
  2. If you have 1 HSM in your cluster, you may need to turn off "key availability check" (https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sdk-5.html#ex4)

Otherwise please share the error.

anushka-settlemint commented 4 weeks ago

Hi @kladd thanks for the reply. Step 2 helped me solve the issue.

anushka-settlemint commented 3 weeks ago

Hi, I am facing another issue now. I am able to successfully sign a transaction but while recovering the public key from the signature, I am getting a different public key as compared to the original one. Any idea how I can solve this issue? I have also raised the same on stack exchange, Please refer for details https://ethereum.stackexchange.com/questions/164017/getting-random-public-key-address-from-cloudhsm-signature-in-nodejs

kladd commented 3 weeks ago

Hi @anushka-settlemint, glad to here you were able to get the sample working, and sorry to hear you're still facing issues. Since ecrecover is outside the scope of these samples I can't be of much help here. On the topic of the sample, and maybe relevant to your issue, is that the sample always uses a 256 byte buffer to store the signature and uses a signature_len pointer to capture the actual signature length. For a 256-bit EC key, I'd expect the signature to be twice as long or 64 bytes (r & s, we would not return a v component).