3

我正在使用带有 PKCS11 接口的 SafeNet (Alladin) eToken 到 C#。我需要将没有 eToken 创建的 RSA 密钥导入 eToken。

RSA 密钥的创建通过以下方式完成：

RSACryptoServiceProvider RSA = new RSACryptoServiceProvider();
RSAParameters publicKey = RSA.ExportParameters(false);
RSAParameters privateKey = RSA.ExportParameters(true);
eTokenHelper.WritePrivateKeyToToken(session, privateKey, "private");

上面的 WritePrivateKeyToToken 的实现是：

public static void WritePrivateKeyToToken(PKCS11.Session session, System.Security.Cryptography.RSAParameters publicParams, string label)
    {

        List<PKCS11.Attribute> attList = new List<PKCS11.Attribute>{};


        attList.Add(new PKCS11.Attribute(PKCS11.CKA_CLASS, PKCS11.CKO_PRIVATE_KEY));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_KEY_TYPE, PKCS11.CKK_RSA));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_PRIVATE, true));
        //attList.Add(new PKCS11.Attribute(PKCS11.CKA_SUBJECT, cert.SubjectName.RawData));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_ID, 0xa1));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_LABEL, label));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_TOKEN, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_MODULUS, publicParams.Modulus));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_PUBLIC_EXPONENT, publicParams.Exponent));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_PRIVATE_EXPONENT, publicParams.D));
        // attList.Add(new ObjectAttribute(PKCS11.CKH_CLOCK, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_MODIFIABLE, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_LOCAL, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_EXTRACTABLE, false));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_NEVER_EXTRACTABLE, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_SENSITIVE, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_ALWAYS_SENSITIVE, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_DERIVE, false));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_LOCAL, false));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_DECRYPT, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_SIGN, true));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_SIGN_RECOVER, false));
        attList.Add(new PKCS11.Attribute(PKCS11.CKA_UNWRAP, false));

        PKCS11.Object.Create(session, attList.ToArray());
    }

当我运行这段代码时，我得到了代码异常

public const int CKR_TEMPLATE_INCONSISTENT = 0x000000D1;

（异常出现在最后一行：Create()）。

我将不胜感激任何帮助理解我做错了什么。

谢谢，罗南

4

1 回答 1

3

我有一些问题。顺便说一句，您在代码中设置了两次属性 PKCS11.CKA_LOCAL。它不正确。不要设置属性 PKCS11.CKA_LOCAL - 它是自动设置的。如果设置 PKCS11.SENSITIVE，则无法设置 CKA_EXTRACTABLE、CKA_NEVER_EXTRACTABLE 和 CKA_ALWAYS_SENSITIVE。

此代码应该可以工作：

   List<PKCS11.Attribute> attList = new List<PKCS11.Attribute>{};

    attList.Add(new PKCS11.Attribute(PKCS11.CKA_CLASS, PKCS11.CKO_PRIVATE_KEY));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_KEY_TYPE, PKCS11.CKK_RSA));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_PRIVATE, true));
    //attList.Add(new PKCS11.Attribute(PKCS11.CKA_SUBJECT, cert.SubjectName.RawData));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_ID, 0xa1));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_LABEL, label));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_TOKEN, true));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_MODULUS, publicParams.Modulus));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_PUBLIC_EXPONENT, publicParams.Exponent));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_PRIVATE_EXPONENT, publicParams.D));
    // attList.Add(new ObjectAttribute(PKCS11.CKH_CLOCK, true));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_MODIFIABLE, true));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_SENSITIVE, true));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_DERIVE, false));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_DECRYPT, true));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_SIGN, true));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_SIGN_RECOVER, false));
    attList.Add(new PKCS11.Attribute(PKCS11.CKA_UNWRAP, false));

    PKCS11.Object.Create(session, attList.ToArray());
于 2014-07-07T09:09:54.180 回答