1

I'm a bit confused with PKCS11 (v3) standard...
In particular, it's blurry to me if one can invoke C_DeriveKey, passing, say, CKM_SHA512_KEY_DERIVATION (or some HKDF) to it as the mechanism and also set the following in the template:

  • CKA_CLASS = CKO_PRIVATE_KEY
  • CKA_KEY_TYPE = CKK_EC or CKA_KEY_TYPE = CKK_EC_EDWARDS

such that two objects, CKO_PRIVATE_KEY and CKO_PUBLIC_KEY, are created with (respectively) CKA_SIGN and CKA_VERIFY being set to true. So the general intention is to be able to generate a CKO_GENERIC_SECRET and then use that secret with some KDF (e.g., HKDF) to produce multiple ECDSA/EdDSA keypairs, maybe also symmetric keys for AES.

And the reason I'm not sure is that PKCS11 (as well as different interpretations of it) does say things like '[...] the capability of deriving a secret key [...]' and also '[...] these mechanisms allow derivation of keys [...],' but the meaning of 'key' and 'secret key' is ambiguous to me.
Does it mean that CKA_CLASS is limited to symmetric keys only, and so must be CKO_SECRET_KEY? Or does it mean that both CKO_SECRET_KEY and CKO_PRIVATE_KEY can be used?
Intuitively, it should be rather easy and natural to support CKO_PRIVATE_KEY as well — after all, the generation of EC keypair always starts from gathering some entropy that is then interpreted as a big integer modulo something or whatever...

So it would be super helpful if one could advise:

  1. Is it legit, as per PKCS11, to use C_DeriveKey with CKM_SHA512_KEY_DERIVATION/CKM_HKDF_DERIVE/etc to obtain CKO_PRIVATE_KEYs?
  2. If not possible, are there any vendors that do allow it (i.e., the derivation of CKO_PRIVATE_KEY from CKO_SECRET_KEY) via vendor-defined mechanisms?
  3. If it is possible, what are vendors that do support it?

I was trying to figure it out by looking at docs of different vendors (Thales, Nitrokey, nCipher, AWS Cloud HSM, etc.), but that wasn't helpful — mainly, they tell which key types are supported for the hBaseKey, rather than what key types can be generated. Neither was I able to get my hands on a good all-encompassing HSM emulator to play with it...
And while I'm aware of SoftHSM2 and Utimaco simulator, that doesn't help — the SoftHSM2 doesn't support the derivation of asymmetric keys. And Utimaco requires registration, approval of which doesn't come for a week now...

9
  • check your spam folder. Utimaco's supply chain send an email to you, to let you know a) your reg failed because you didn't give legit information, or b) that your account was activated. If you can't find the reg email, you can also just try to log in with the credentials you provided. If you didn't give a legit email, can't help :) (disclosure: I work for Utimaco)
    – rip...
    Commented Oct 19, 2023 at 5:56
  • Looking at the underlying question, I can see a way to do it, but it involves deriving a secret value of the correct length, exporting it as plain text and then re-importing it as C_CreateObject with a suitable template that causes it to be seen as an eg Edwards key. Which, admittedly breaks the fundamental "Idea" of the HSM: Protect the keys.
    – rip...
    Commented Oct 19, 2023 at 6:01
  • @rip... As for "check your spam folder [...]". I did – found nothing... Also, I can't log in: it says "Error:Authentication failed. Please try again.". If I try resetting the password, there's no email either. And the email is correct – the one I'm using on the website regex-matches the one I copied from Gmail UI. And if I try to register with that again, it says that the user already exists. Commented Oct 19, 2023 at 12:28
  • @rip... As for exporting the key as plain text. I was not even considering this approach seriously because, as you said, it is not ... safe. Also, are you trying to say that what I'd like to do is inherently not supported by PKCS and/or HSMs? Commented Oct 19, 2023 at 12:30
  • When I search on your last name, it looks like you provided insufficient information. We are governed by German law, and we can only provide the simulator to verifiable entities. The problem is the company "N/A" and we also can not accept @gmail addresses, sorry. Needs to be a legitimate enterprise, an email linked to that enterprise, and the physical address you provide needs to be for the company you work for.
    – rip...
    Commented Oct 19, 2023 at 16:31

0

You must log in to answer this question.

Browse other questions tagged .