Extract key Value form HSM

Question

I have created an AES key in my HSM, and I would like to get the key value, I tried C_FindObjects but it only return the key hundel.

    public long Find_AES_Key(String label) {
            long hkey = -1L; 
            try {
                 AESSecretKey keyTemplate = new AESSecretKey();
                 keyTemplate.getLabel().setCharArrayValue(label.toCharArray());
                 CK_ATTRIBUTE[] attributes = iaik.pkcs.pkcs11.objects.Object.getSetAttributes(keyTemplate);
                    
                 cryptoki.C_FindObjectsInit(ckiSession, attributes, false);
                 long[] found = cryptoki.C_FindObjects(ckiSession, 1L);
                 cryptoki.C_FindObjectsFinal(ckiSession);
                 
                 hkey = found[0];
                 // cryptoki.C_GetAttributeValue(ckiSession, hkey, attributes, true);
                                 
             }catch(Exception e) {
                 e.printStackTrace();
             }
            return hkey;
         }

Thank you for your help.

Alexander · Answer 1 · 2021-02-26T07:56:42.510

1

It depends on your HSM, but in most cases keys are nor "readable" if they are borned inside of HSM.

If it is possible you can Wrap and export it using C_DeriveKey/C_WrapKey calls.

Check your key's CKA_WRAP attribute.

edited Feb 26 '21 at 07:56

answered Feb 25 '21 at 16:51

Alexander

1,232
1
15
24

Being able to extract the key from a HSM would be seen as a severe design flaw on a security point of view... – Serge Ballesta Feb 25 '21 at 16:54
It is not a flaw if HSM will allow to wrap the key. – Alexander Feb 25 '21 at 17:02
an alternative solution that I am using is to wrap then decrypt the wraped key. But I hop to find an easiest way to get directly the key value. – zero Feb 26 '21 at 20:54
It is already the easiest way. Directly get the key value possible only for public keys. – Alexander Feb 26 '21 at 22:09

Extract key Value form HSM

1 Answers1