1

I'm trying to export/import private & public keys. According to pkcs11Admin those actions aren't supported currently.

Any idea how to do it? Relevant attributes for key generation before exporting (CKA_SENSITIVE, CKA_EXTRACTABLE)? Should I wrap the private key before exporting it?

Maarten Bodewes
  • 90,524
  • 13
  • 150
  • 263
tos
  • 11
  • 1
  • I'd be amazed if you cannot export *public* keys. Yes, retrieving a wrapped key (one operation, as far as I know) would be the best option. Of course, you'd need to create a wrapping key on the device for which the secret / private key is outside the device for that. Some devices do not allow extraction at all, and some also provide proprietary (backup) options. – Maarten Bodewes Nov 13 '18 at 12:04
  • 2
    Pkcs11Admin is GUI application which currently lacks a lot of features :) On the other side Pkcs11Interop is fully featured .NET library that wraps PKCS#11 library provided by your HSM vendor and surely can export and import keys if your HSM supports those operations. If you need more specific answer then please describe your use case in more detail. – jariq Nov 14 '18 at 23:34
  • Thank You! I managed to import & export keys. In the beginning I didn't find which attributes are mandatory for those operations. The attributes are written in "PKCS #11 v2.20: Cryptographic Token Interface Standard" sections 12.1.2 -12.1.3 – tos Nov 27 '18 at 06:51
  • 2
    @tos I meet same question. Could u help me? thanks – beehuang Jul 16 '21 at 04:11

0 Answers0