I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM.
I've used pkcs11-tool to generate the key and it took about 5 sec to complete the task:
$ pkcs11-tool --module <modules.so> --key-type aes:32 -p <PIN> --token-label SC_TEST --keygen --id 6887513122
Secret Key Object; AES length 32
Usage: encrypt, decrypt, wrap, unwrap
OpenSSL on the other hand is very fast (does not use a HSM):
$ touch file
$ openssl aes-256-cbc -pbkdf2 -nosalt -P -in file -pass pass:testpassphrase
So I wanted to know why does it take so long to generate keys on the HSM? Or am I doing something wrong?
Note that this is high end and expensive HSM.
I've tried a native tool (nCipher generatekey) and it is a lot faster (roughly 1 sec), but I think that it does not use PKCS11 to communicate with the HSM.