Testing with ECC Key (Linux)

1. Generate the ECC key using p11tool2

# p11tool2 slot=2 LoginUser=123456 PubKeyAttr=CKA_LABEL="TestECDSAKey" PrvKeyAttr=CKA_LABEL="TestECDSAKey",CKA_DERIVE=CK_TRUE

GenerateKeyPair=ECC

Once key generation complete then add CKA_ID for both public and private ECC keys using PKCS11# CryptoServer Administration tool. Also make sure to set CKA_DERIVE=CK_TRUE in above command.

2. Verify that the keys are generated onto the HSM using following command

# p11tool2 slot=<Slot_No.> LoginUser=<CryptoUser_PIN> ListObjects

Example

[root@Openssl-RHEL9 bin]# ./p11tool2 slot=1 LoginUser=ask ListObjects Enter normal user PIN:

CKO_PUBLIC_KEY:

+ 1.1

CKA_KEY_TYPE	= CKK_ECDSA

CKA_UNIQUE_ID	= 87E13F2D-A49F-497C-B49C-CFEB9725EBEB

CKA_LABEL	= TestECDSAKey

CKA_ID	=

CKO_PRIVATE_KEY:

+ 2.1

CKA_KEY_TYPE	= CKK_ECDSA

CKA_UNIQUE_ID	= F1C1638F-41B3-4447-BF77-22E9EC04F2E5

CKA_SENSITIVE	= CK_TRUE

CKA_EXTRACTABLE	= CK_FALSE

CKA_LABEL	= TestECDSAKey

CKA_ID	=

3. Generate a certificate request

# openssl req -engine pkcs11 -new -key "pkcs11:token=SSLCertNew;object=TestECDSAKey" -keyform engine -out TestECDSACSR.csr

Figure 15: Generate certificate request and Content of generated certificate request

Here SSLCertNew is the token label and TestECDSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

4. Create a self-signed certificate based on the generated key

# openssl req -engine pkcs11 -new -x509 -days 365 -key "pkcs11:token=SSLCertNew;object=TestECDSAKey" -keyform engine -out TestECDSA.cert

Here SSLCertNew is the token label and TestECDSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

Figure 16: Content of self-signed certificate

5. Create a sample text file and write any content inside it

# touch message.txt

Figure 17: Content of message file

6. Sign the message file

# openssl cms -engine pkcs11 -sign -in message.txt -signer TestECDSA.cert

-inkey "pkcs11:token=SSLCertNew;object=TestECDSAKey" -keyform engine -out signedECDSAmessage.txt

Here SSLCertNew is the token label and TestECDSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

Figure 18: Content of signed message file

7. Verify the signed message file

# openssl cms -engine pkcs11 -verify -in signedECDSAmessage.txt -CAfile TestECDSA.cert -out originalmessage.txt TestECDSA.cert

8. Open the content of originalmessage.txt and verify it is same as original content.

Figure 19: Content of original message file