I am trying to decrypt a message that has been encrypted with our public key, using Private Key stored on Luna HSM as under:
Connecting To HSM:
private void connectToHSM() throws Exception { try { ks = KeyStore.getInstance("Luna"); logger.debug("Logging in to Luna HSM..."); logger.debug("KS Pw Before toCharArray:" + keyStorePassword); logger.debug("KS Pw:" + keyStorePassword.toCharArray()); ks.load(is1, keyStorePassword.toCharArray()); } catch (KeyStoreException e) { logger.debug("HSM KeyStoreException while loading keystore:"+e.getMessage()); throw new Exception("Unable to create keystore object"); } catch (NoSuchAlgorithmException e) { logger.debug("HSM NoSuchAlgorithmException while loading keystore:"+e.getMessage()); throw new Exception("Unexpected NoSuchAlgorithmException while loading keystore"); } catch (CertificateException e) { logger.debug("HSM CertificateException while loading keystore:"+e.getMessage()); throw new Exception("Unexpected CertificateException while loading keystore"); } catch (IOException e) { logger.debug("HSM IOException while loading keystore:"+e.getMessage()); throw new Exception("Unexpected IOException while loading keystore."); }}The decrypt Function
public byte[] decrypt(byte[] data) throws Exception { byte[] plainData = null; byte[] secretKey = null; PrivateKey privateKey = null; if(data == null || data.length == 0) throw new Exception("byte array data can not be null or blank array."); ByteArraySpliter arrSpliter = new ByteArraySpliter(data); if (!slotManager.getReconnectRequired()) { if(Security.getProvider("LunaProvider")==null){ Security.insertProviderAt(new com.safenetinc.luna.provider.LunaProvider(), 3); } try{ connectToHSM(); }catch (Exception e) { logger.error("HSM ERROR"); e.printStackTrace(); } threadsOnTheFlyCounter.incrementAndGet(); //Access private key from Luna Keystore try{ logger.debug("Alias is : " + alias); privateKey = (PrivateKey)ks.getKey(alias+"-private", keyStorePassword.toCharArray()); if(null == privateKey) logger.debug("KEY not derived from store"); //Decrypt AES symmetric key using Private Key retrieved from Luan Keystore secretKey = decryptSecretKeyData(arrSpliter.getEncryptedSecretKey(), arrSpliter.getIv(), privateKey); } catch (Exception e) { logger.error("Error in DECRYPTION of SYMMETRIC KEY: "+e.getMessage()); e.printStackTrace(); throw new Exception("Error in DECRYPTION of SYMMETRIC KEY: "+e.getMessage()); } finally { // FOR RECONNECT threadsOnTheFlyCounter.decrementAndGet(); } //Decrypt response data using AES symmetric key plainData = decryptData(arrSpliter.getEncryptedData(), arrSpliter.getIv(), secretKey); boolean result = validateHash(plainData); if(!result) throw new Exception( "Integrity Validation Failed : " + "The original data at client side and the decrypted data at server side is not identical"); } return trimHMAC(plainData);}ERROR received while using the above blocks:
2021-12-17 15:00:38,055 - DEBUG [connectToHSM:158] - KS Pw Before toCharArray:12345 2021-12-17 15:00:38,055 - DEBUG [connectToHSM:159] - KS Pw:[C@22297228 2021-12-17 15:00:38,072 - DEBUG [decrypt:202] - Alias is : label1 2021-12-17 15:00:38,078 - DEBUG [decrypt:205] - KEY not derived from store 2021-12-17 15:00:38,078 - DEBUG [decryptSecretKeyData:327] - decryptSecretKeyData function called using LunaParameterSpecOAEP 2021-12-17 15:00:38,078 - ERROR [decrypt:210] - Error in DECRYPTION of SYMMETRIC KEY: Failed to decrypt AES secret key using RSA.```
The private key was imported in the HSM using the CMU function. The original alias of the private key was "swapnil". While I try to use this alias, I got the same error as above. Then I tried modifying the label of the handle on which the private key was unwrapped and changed it to label1, but still the issue persists.
Can anyone please help me with this. I can provide more inputs if required.
