search

opendnssec / SoftHSMv2

SoftHSM version 2
http://www.softhsm.org/
Other
740 stars 335 forks source link

problem with importing public keys / aes keys using "softhsm2-util --import" #709

Open catfish-amine opened 1 year ago

catfish-amine commented 1 year ago

Hello, First I wanted to know if there is any doc for the softhsm2-util especially using "import" action. Because I am having a few problems when I'm trying to import a RSA public keys that are - as far as I understood - can't be in PKCS8 format, to resolve that I tried to work around this issue by using the "--aes" option but I don't think that it is the proper way to do it.

On the other hand, when I am trying to use an AES secret key (successfully imported using --aes ) I keep getting this error: 68 ErrorCode corresponding to: KEY_FUNCTION_NOT_PERMITTED maybe it is coming from the format I am using for my AES key as it also can't be in PKCS8 format and there is no specifications on how it should be handled.

reznik99 commented 1 year ago

To Import an RSA Public Key, it should be in X.509 SubjectPublicKeyInfo (SPKI) format. PEM with the -----BEGIN PUBLIC KEY----- header.

catfish-amine commented 1 year ago

This is how I generate my pair of RSA keys:

openssl genpkey -algorithm RSA -out private.pem -pkeyopt rsa_keygen_bits:1024 openssl pkcs8 -topk8 -nocrypt -in private.pem -out private_pkcs8.key openssl rsa -pubout -in private_pkcs8.key -out public.pem

and then I try to import them like this :

softhsm2-util --import private_pkcs8.key --token "TEST" --label "TEST_PRIV" --id A001 --force => The key pair has been imported.

softhsm2-util --import public.pem --token "TEST" --label "TEST_PUB" --id A002 --force => ERROR: Could not read the PKCS#8 file. Maybe it is encypted (--file-pin )

So basically I am not able to import the public key even that it is actually in the format mentioned in the answer above