(JavaScript) PKCS11 Generate a Session EC Key on the HSM

See more PKCS11 Examples

Note: This example requires Chilkat v9.5.0.96 or later.

Note

This example is intended for running within a Chilkat.Js embedded JavaScript engine. All Chilkat JavaScript examples require Chilkat v11.4.0 or greater.

var success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

var pkcs11 = new CkPkcs11();

// Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
// (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
pkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll";

// Establish a logged-on session.
var pin = "0000";
var userType = 1;
success = pkcs11.QuickSession(userType,pin);
if (success == false) {
    console.log(pkcs11.LastErrorText);
    return;
}

// Specify attributes and abilities (how this key can be used) by providing a JSON template.
// One template is for the public key, and the other for the private key.
var pubKeyAttr = new CkJsonObject();

// Allow the public key to be used for signature verification
pubKeyAttr.UpdateBool("verify",true);

// Specify the kind of EC key to generate by the curve name
// Possible curve names are:
// secp256r1  (also known as P-256 and prime256v1)
// secp384r1  (also known as P-384)
// secp521r1  (also known as P-521)
// secp256k1 (This is the curve used for Bitcoin)
// secp192r1
// secp224r1
// brainpoolP160r1
// brainpoolP192r1
// brainpoolP192r1
// brainpoolP224r1
// brainpoolP256r1
// brainpoolP320r1
// brainpoolP384r1
// brainpoolP512r1
// Note: Your smart card or token might not support all of the above EC curves (assuming it supports EC at all).

// This attribute is required.
pubKeyAttr.UpdateString("ec_params","secp256r1");

var privKeyAttr = new CkJsonObject();

// Generate a session EC key.
// A session key exists only for the duration of the PKS11 session.
// To generate an EC key that resides on the HSM, set the "token" attribute equal to true
privKeyAttr.UpdateBool("token",false);

// Allow the private key to be used for signing.
privKeyAttr.UpdateBool("sign",true);

// Provide a JSON object to receive the public and private key handles.
var jsonHandles = new CkJsonObject();
jsonHandles.EmitCompact = false;

// Provide a Chilkat public key object to receive the public key.
var pubKey = new CkPublicKey();

success = pkcs11.GenEcKey(pubKeyAttr,privKeyAttr,jsonHandles,pubKey);
if (success == false) {
    console.log(pkcs11.LastErrorText);
    console.log("Failed to generate an EC key.");
}
else {
    // Sample JSON handles:
    // {
    //   "public_key_handle": 18415630,
    //   "private_key_handle": 74842125
    // }
    console.log(jsonHandles.Emit());
    console.log("public_key_handle: " + jsonHandles.UIntOf("public_key_handle"));
    console.log("private_key_handle: " + jsonHandles.UIntOf("private_key_handle"));
    console.log("public key JWK:");
    console.log(pubKey.GetJwk());
    // Sample JWK:
    // {"kty":"EC","crv":"P-256","x":"EDy-Sxl0DZ8tvzy_qnIYl6DYPFjTVnyJ2I9ZTCfKds4","y":"yBZ4HK2yF7F7ZEOn59CgTQp2ApQJ8ZOF736yZxY6LOE"}
    console.log("Success.");
}

pkcs11.Logout();
pkcs11.CloseSession();