Java

Import an SSH Key to an HSM using PKCS11

See more PKCS11 Examples

Demonstrates how to import an SSH private key to an HSM (smartcard or token).

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat2 Java

import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.JsonObject;
import com.chilkatsoft.chilkat2.Pkcs11;
import com.chilkatsoft.chilkat2.SshKey;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

        Pkcs11 pkcs11 = new Pkcs11();

        // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
        // For example:
        pkcs11.setSharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll");

        // Use your HSM's PIN.
        String pin = "0000";

        // Normal user = 1
        int userType = 1;

        // Establish a logged-on user session with the HSM.
        try {
            pkcs11.quickSession(userType, pin);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Create a PKCS11 template for importing the SSH key.
        JsonObject jsonTemplate = new JsonObject();

        // Indicate the key is to be stored on the token (i.e. it is not a session-only key)
        jsonTemplate.updateBool("token", true);
        // The key should have the ability to sign
        jsonTemplate.updateBool("sign", true);

        // Let's provide a few attributes to help us find the this key at a later time.
        // See SSH Public-Key Authentication using an HSM

        // The ID is byte data, so it should be base64 or hex.
        // Specify "id" if passing base64 data, "id_hex" for hexidecimal, or "id_ascii" for directly copying the ascii bytes of the string.
        // You can provide any ID of your choice.  It is optional.
        jsonTemplate.updateString("id_hex", "0A0B0C0D01020304");

        // Optionally specify a label.
        jsonTemplate.updateString("label", "MySshKey");

        // Load the SSH key to be imported to the HSM (smartcard or token)
        SshKey sshKey = new SshKey();
        sshKey.setPassword("password_of_the_encrypted_ppk_file");
        String ppkContents = sshKey.loadText("c:/my_ssh_keys/someSshKey.ppk");
        try {
            sshKey.fromPuttyPrivateKey(ppkContents);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Import the SSH private key onto the HSM.
        // The PKCS11 handle to the imported private key is returned.
        // A 0 is returned on failure.
        long privKeyHandle = pkcs11.importSshKey(sshKey, jsonTemplate);
        if (privKeyHandle == 0) {
            System.out.println(pkcs11.getLastErrorText());
            return;
        }

        // The private key handle is only valid during the PKCS11 session.
        // If you wish to use the private key in another PKCS11 session,
        // you'll first need to find it.  See  SSH Public-Key Authentication using a Smartcard
        System.out.println("private key handle: " + privKeyHandle);

        System.out.println("Successfully imported the SSH key onto the HSM.");

        pkcs11.logout();
        pkcs11.closeSession();
    }
}