0

我正在尝试使用存储在 Luna HSM 上的私钥解密已使用我们的公钥加密的消息，如下所示：

  1. 连接到 HSM：

     private void connectToHSM() throws Exception {
 try {
     ks = KeyStore.getInstance("Luna");
     logger.debug("Logging in to Luna HSM...");
     logger.debug("KS Pw Before toCharArray:" + keyStorePassword);
     logger.debug("KS Pw:" + keyStorePassword.toCharArray());
     ks.load(is1, keyStorePassword.toCharArray());
 } catch (KeyStoreException e) {
     logger.debug("HSM KeyStoreException while loading keystore:"+e.getMessage());
     throw new Exception("Unable to create keystore object");
 } catch (NoSuchAlgorithmException e) {
     logger.debug("HSM NoSuchAlgorithmException while loading keystore:"+e.getMessage());
     throw new Exception("Unexpected NoSuchAlgorithmException while loading keystore");
 } catch (CertificateException e) {
     logger.debug("HSM CertificateException while loading keystore:"+e.getMessage());
     throw new Exception("Unexpected CertificateException while loading keystore");
 } catch (IOException e) {
     logger.debug("HSM IOException while loading keystore:"+e.getMessage());
     throw new Exception("Unexpected IOException while loading keystore.");
 }}

  2. 解密函数

     public byte[] decrypt(byte[] data) throws Exception {
 byte[] plainData      = null;
 byte[] secretKey      = null;
 PrivateKey privateKey = null;

 if(data == null || data.length == 0)
     throw new Exception("byte array data can not be null or blank array.");

 ByteArraySpliter arrSpliter = new ByteArraySpliter(data);
 if (!slotManager.getReconnectRequired()) {
     if(Security.getProvider("LunaProvider")==null){
         Security.insertProviderAt(new com.safenetinc.luna.provider.LunaProvider(), 3);
     }
     try{
     connectToHSM();
     }catch (Exception e) {
         logger.error("HSM ERROR");
         e.printStackTrace();
     }

     threadsOnTheFlyCounter.incrementAndGet();

     //Access private key from Luna Keystore
     try{
         logger.debug("Alias is : " + alias);
         privateKey    = (PrivateKey)ks.getKey(alias+"-private", keyStorePassword.toCharArray());
         if(null == privateKey)
         logger.debug("KEY not derived from store");

         //Decrypt AES symmetric key using Private Key retrieved from Luan Keystore
         secretKey = decryptSecretKeyData(arrSpliter.getEncryptedSecretKey(), arrSpliter.getIv(), privateKey);

     } catch (Exception e) {
         logger.error("Error in DECRYPTION of SYMMETRIC KEY: "+e.getMessage());
         e.printStackTrace();
         throw new Exception("Error in  DECRYPTION of SYMMETRIC KEY: "+e.getMessage());

     } finally {
     // FOR RECONNECT
         threadsOnTheFlyCounter.decrementAndGet();
     }

     //Decrypt response data using AES symmetric key
     plainData = decryptData(arrSpliter.getEncryptedData(), arrSpliter.getIv(), secretKey);

     boolean result = validateHash(plainData);
     if(!result) 
     throw new Exception( "Integrity Validation Failed : " +
         "The original data at client side and the decrypted data at server side is not identical");
 }

 return trimHMAC(plainData);}

  3. 使用上述块时收到错误：

    2021-12-17 15:00:38,055 - DEBUG [connectToHSM:158] - KS Pw Before toCharArray:12345
2021-12-17 15:00:38,055 - DEBUG [connectToHSM:159] - KS Pw:[C@22297228
2021-12-17 15:00:38,072 - DEBUG [decrypt:202] - Alias is : label1
2021-12-17 15:00:38,078 - DEBUG [decrypt:205] - KEY not derived from store
2021-12-17 15:00:38,078 - DEBUG [decryptSecretKeyData:327] - decryptSecretKeyData function called using LunaParameterSpecOAEP
2021-12-17 15:00:38,078 - ERROR [decrypt:210] - Error in DECRYPTION of SYMMETRIC KEY: Failed to decrypt AES secret key using RSA.```

使用 CMU 功能将私钥导入 HSM。私钥的原始别名是“swapnil”。当我尝试使用这个别名时，我得到了与上面相同的错误。然后我尝试修改解包私钥的句柄标签并将其更改为label1，但问题仍然存在。

谁能帮我解决这个问题。如果需要，我可以提供更多输入。

4

0 回答 0