Comments (12)
It shouldn't ignore the mechanism being passed in. It only uses DEFAULT_WRAP_MECHANISMS
if mechanism
is None
. How are you calling the key wrap function? What is most likely is that it's unhappy for some other reason. Many PKCS#11 libraries let you set environment variables for more useful debugging of the actual error.
My HSM devices don't support AES_KEY_WRAP
and while recent versions of SoftHSM2 allegedly do, it's not appearing in the mechanism list for me. I suspect this is related to my version of OpenSSL.
Could you add a test case in test_aes.py
that highlights the issue?
from python-pkcs11.
thanks danni, i'll try to round up some more info, but in the meantime, how can i export an aes key then? what i am doing is generating a key, which i need to share with a remote party. i wanted to export the key and wrap it with rsa/public to send to them so they can rsa/private decrypt is and use the AES key.. is there another way i can generate an AES key and then send it RSA encrypted to the remote party?
from python-pkcs11.
If you're trying to wrap an AES key with an RSA key that will be why you're getting invalid mechanism
. The mechanism is invalid for the key type. You'll need to use an RSA mechanism, e.g. RSA_PKCS_OAEP
(which is the default).
The mechanisms document gives the full details: http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/errata01/os/pkcs11-curr-v2.40-errata01-os-complete.html#_Toc441850412
Your key also needs to be EXTRACTABLE
(and sometimes not SENSITIVE
depending on the PKCS#11 implementation). See http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/errata01/os/pkcs11-base-v2.40-errata01-os-complete.html#_Toc323024158 Not all implementations return not wrappable
as documented they should.
test_rsa.test_key_wrap
shows an example of wrapping an AES key in an RSA key.
from python-pkcs11.
OK i think i know what is happening. you define:
AES_KEY_WRAP = 0x00001090
whereas the current pkcs#11 spec (as per oasis above) defines:
#define CKM_AES_KEY_WRAP 0x00002109
so AWS is throwing back an error: invalid mechanism
from python-pkcs11.
What have they done? They've moved the mechanism and then reassigned the number. All within the same version number header, the 2013 v2.40 and 2016 v2.40 files are different.
from python-pkcs11.
yes it wasn't obvious. i am now past the 'invalid mechanism' response from cloudhsm (yay), but am now getting an 'inconsistent template' message returned. getting there...
from python-pkcs11.
I will work on a branch that updates to the 2016 spec.
from python-pkcs11.
#16 updates for the new headers. Also adds an AES_KEY_WRAP
example that works with SoftHSM at least. I would be super keen to see a PR that updates/improves the testcases for CloudHSM.
from python-pkcs11.
thanks danni, that worked a treat; i can wrap and unwrap keys for import (i need to import because i have one remote partner who sends me his transport key). however for cloudhsm i needed to set:
pkcs11.Attribute.SENSITIVE: True
to avoid an 'inconsistent template' message. i think i can fly cloudhsm ok now. this is the Cavium model (from AWS's getHSMInfo): https://www.cavium.com/pdfFiles/NITROXIII_NFBE_PB_Rev1.pdf?x=3
from python-pkcs11.
Yeah, the attributes required are not well specified and most of the HSMs do something completely different. Does #16 pass the tests for you? I have it passing against SoftHSM locally, but not in Travis (again suspect OpenSSL version). Neither my Thales HSM, my Nitrokey HSM nor the TPM stuff supports the mechanism, so I have no real devices to test with.
from python-pkcs11.
yes, as long as i set sensitive to true, i can unwrap fine. thanks for the prompt support, much appreciated.
from python-pkcs11.
Released v0.5.0 with this fix.
from python-pkcs11.
Related Issues (20)
- Broken by unpinned Cython 0.29.31: CYTHON_ATOMICS error: lvalue required as left operand of assignment HOT 10
- OverflowError: Python int too large to convert to C ssize_t
- lack of support for generation of `CKK_GENERIC_SECRET` key type.
- Errors in _pkcs11.pyx file: change operand "is" by "=="
- Error received when installing: 'TypeError: can only concatenate tuple (not "list") to tuple' is back HOT 2
- Small Typo in _pkcs11.pyx HOT 5
- How to import X.509v3 digital certificate inside the token or hsm
- 0.7.0: issue with testing🤔 HOT 6
- Can't extract public key from Nitrokey HSM after creation HOT 3
- test opensession softhsmv2 HOT 1
- BUG: sign DATA over 512 bytes doesn't work HOT 3
- Typo in "Applied" docs - Generating Keys
- Python3.6 and earlier do not have annotations HOT 3
- Question regarding get_keys()
- New realese with support for python >= 3.10 on Windows HOT 4
- Cannot install python-pkcs11 using python 3.12 HOT 4
- New release needed HOT 6
- Unable to use 64-bit PKCS#11 libraries (drivers) HOT 2
- segfaulting only on github action
- get_objects() fails with missing enum value HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from python-pkcs11.