(JavaScript) PKCS11 Generate a RSA Key that stays on the HSM

See more PKCS11 Examples

Note: This example requires Chilkat v9.5.0.96 or later.

Note

This example is intended for running within a Chilkat.Js embedded JavaScript engine. All Chilkat JavaScript examples require Chilkat v11.4.0 or greater.

var success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

var pkcs11 = new CkPkcs11();

// Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
// (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
pkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll";

// Establish a logged-on session.
// Use your actual PIN here.
var pin = "0000";
var userType = 1;
success = pkcs11.QuickSession(userType,pin);
if (success == false) {
    console.log(pkcs11.LastErrorText);
    return;
}

// Specify attributes and abilities (how this key can be used) by providing a JSON template.
// One template is for the public key, and the other for the private key.
var pubKeyAttr = new CkJsonObject();

// Generate a RSA key that remains on the HSM by setting the "token" attribute equal to true
pubKeyAttr.UpdateBool("token",true);

// Given that our key will reside on the token, we should give it two attributes (id and label) to help us
// find it in future sessions.

// First, we can give it an arbitrary ID.  ID's are binary, so we specify bytes as either 
// "id_hex" for hexidecimal bytes, 
// "id_ascii" for the bytes of an ascii string, 
// "id" for bytes in base64 format.
var keyId = "48656C6C6F";
pubKeyAttr.UpdateString("id_hex",keyId);

// We can also give our key a label with any descriptive string.
var keyLabel = "2048-bit RSA key for testing";
pubKeyAttr.UpdateString("label",keyLabel);

// -----------------------------------------------------------------------------------
// IMPORTANT: The ID for the public key must be the same as the ID for the private key.
// -----------------------------------------------------------------------------------

// Allow the public key to be used for encryption, signature verification, and symmetric key wrapping.
// These attributes are optional.
pubKeyAttr.UpdateBool("encrypt",true);
pubKeyAttr.UpdateBool("verify",true);
pubKeyAttr.UpdateBool("wrap",true);

// Generate a 2048-bit RSA key.
// This attribute is required.
pubKeyAttr.UpdateInt("modulus_bits",2048);

var privKeyAttr = new CkJsonObject();

// Generate a RSA key that remains on the HSM by setting the "token" attribute equal to true
privKeyAttr.UpdateBool("token",true);

// Make sure we give the private key the same ID as the public key.
privKeyAttr.UpdateString("id_hex",keyId);

// We can also give our key a label with any descriptive string.
// (Best to use the same label as for the public key)
privKeyAttr.UpdateString("label",keyLabel);

// Allow the private key to be used for signing and decryption.
privKeyAttr.UpdateBool("sign",true);
privKeyAttr.UpdateBool("decrypt",true);

// Provide a JSON object to receive the public and private key handles.
var jsonHandles = new CkJsonObject();
jsonHandles.EmitCompact = false;

// Provide a Chilkat public key object to receive the public key.
var pubKey = new CkPublicKey();

success = pkcs11.GenRsaKey(pubKeyAttr,privKeyAttr,jsonHandles,pubKey);
if (success == false) {
    console.log(pkcs11.LastErrorText);
    console.log("Failed to generate an RSA key.");
}
else {
    // Sample JSON handles:
    // {
    //   "public_key_handle": 18415630,
    //   "private_key_handle": 74842125
    // }
    console.log(jsonHandles.Emit());
    console.log("public_key_handle: " + jsonHandles.UIntOf("public_key_handle"));
    console.log("private_key_handle: " + jsonHandles.UIntOf("private_key_handle"));
    console.log("public key JWK:");
    console.log(pubKey.GetJwk());
    // Sample JWK:
    // {"kty":"RSA","n":"1sQMSAntY80L .... If9jqfMp4omQ","e":"AQAB"}
    console.log("Success.");
}

pkcs11.Logout();
pkcs11.CloseSession();