Testing with RSA Key

1. Generate the RSA key using p11tool2

# p11tool2 slot=2 LoginUser=123456 PubKeyAttr=CKA_LABEL="TestRSAKey" PrvKeyAttr=CKA_LABEL="TestRSAKey" GenerateKeyPair=RSA

2. Verify that the keys are generated onto the HSM using the following command

# p11tool2 LoginUser=<cryptouser_password> ListObjects

Example

# p11tool2 slot=2 LoginUser=123456 ListObjects

CKO_PUBLIC_KEY:

+ 1.1
CKA_KEY_TYPE	= CKK_RSA
CKA_LABEL	= TestRSAKey
CKA_ID	=

CKO_PRIVATE_KEY:

+ 2.1
CKA_KEY_TYPE = CKK_RSA
CKA_SENSITIVE = CK_TRUE
CKA_EXTRACTABLE = CK_FALSE
CKA_LABEL = TestRSAKey
CKA_ID 

3. Generate a self-signed certificate

# openssl req -engine pkcs11 -new -key "pkcs11:token=OpensslSlot;object= TestRSAKey" -keyform engine -out TestRSACSR.csr

Here, OpensslSlot is the token label and TestRSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

Figure 5:Certificate request output

Figure 6:Content of certificate request file

4. Create the self-signed certificate based on the generated key

# openssl req -engine pkcs11 -new -x509 -days 365 -key "pkcs11:token=OpensslSlot;object=TestRSAKey" -keyform engine -out TestRSA.cert

Here, OpensslSlot is the token label and TestRSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

Figure 7: Self signed certificate generation output

Figure 8: Content of self-signed certificate file

5. Create a sample text file with any content inside it

# touch message.txt

Figure 9: Content of message.txt

6. Sign the message file

# openssl cms -engine pkcs11 -sign -in message.txt -signer TestRSA.cert - inkey "pkcs11:token=OpensslSlot;object=TestRSAKey" -keyform engine -out signedRSAmessage.txt

Here, OpensslSlot is the token label and TestRSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

Figure 10: Content of signed message file

7. Encrypt the signed message file

# openssl cms -engine pkcs11 -encrypt -in signedRSAmessage.txt-out encryptedRSAsignedmessage.txt TestRSA.cert

Figure 11: Content of encrypted signed message file

8. Decrypt the encrypted signed message file

# openssl cms -engine pkcs11 -decrypt -in encryptedRSAsignedmessage.txt - inkey "pkcs11:token=OpensslSlot;object=TestRSAKey" -keyform engine -out decryptedRSAsignedmessage.txt

Here, OpensslSlot is the token label and TestRSAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

Figure 12: Content of decrypted signed message file

9. Verify the decrypted signed message file

# openssl cms -engine pkcs11 -verify -in decryptedRSAsignedmessage.txt - CAfile TestRSA.cert -out originalmessage.txt TestRSA.cert

Figure 13: Output of openssl verification command

Figure 14: Content of original message file