Lua Requires Chilkat v9.5.0.96+

PKCS11 Import an Existing AES Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing AES symmetric encrytion key onto the smartcard/token. The imported AES key is a session object, and only exists for the duration of the PKCS11 session. (AES keys are typically used for wrapping/unwrapping RSA and EC keys.) Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

local pkcs11 = chilkat.Pkcs11.new()

-- Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
-- (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
pkcs11.shared_lib_path = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

-- Establish a logged-on session.
local pin = "0000"
local userType = 1
local success = pkcs11:quick_session(userType, pin)
if not success then
    print(pkcs11.last_error_text)
    return
end

-- Generate a 256-bit AES key.
-- (32 bytes is 256 bits)
-- Append 32 bytes of random data in the base64 encoding.
local sbAesKey = chilkat.StringBuilder.new()
sbAesKey:append_random(32, "base64")

local attrs = chilkat.JsonObject.new()
-- Specify the type of object, and the type of key.
attrs:update_string("class", "CKO_SECRET_KEY")
attrs:update_string("key_type", "CKK_AES")
-- Add an optional label if desired.
attrs:update_string("label", "My AES wrapping/unwrapping key")
-- Allow the key to be use for wrapping and unwrapping operations.
attrs:update_bool("wrap", true)
attrs:update_bool("unwrap", true)

-- Provide the AES key material.
attrs:update_string("value", sbAesKey:get_as_string())

-- Create the object (i.e. create the AES key with the given key material.)
-- Returns the PKCS11 object handle of the created AES session key.
local objHandle = pkcs11:create_pkcs11_object(attrs)
if objHandle == 0 then
    print(pkcs11.last_error_text)
    print("Failed.")
else
    print("PKCS11 object handle = " .. objHandle)
    print("Successfully created a 256-bit AES session key.")
end

-- Typically, you would do other things in the PKCS11 session that use the handle of AES key we just created.
-- ...
-- ...

pkcs11:logout()
pkcs11:close_session()