<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Why do you assume that the key is generated in software?<br>
You use the KeyGenerator API to generate a key, this key can be
generated on the HSM if you have SunPKCS11 provider configured to be
the most preferred provider. This key should actually just encapsulate
the native key handle (not the actual value/encoding) which you can
then pass it to the KeyStore API and specify an alias. The PKCS11
keystore impl would then take this key object (with the native key
handle) and create a persistent copy on the HSM with the specified
alias.<br>
<br>
Regards,<br>
Valerie<br>
<br>
On 03/29/10 22:57, Tomas Gustavsson wrote:
<blockquote cite="mid:4BB192D2.3000106@primekey.se" type="cite">
<pre wrap="">Hi, thanks for the answer.
Generating a key in software and trying to store it on the HSM violates
the whole idea of using an HSM. Which is to generate and maintain the
keys in the HSM at all times.
Most high security policies *requires* that the keys are generated by
the HSM, inside the HSM.
I also doubt that it would work to store software generated keys using
the keytool API. Many HSMs even forbid this, at least when running in
strict FIPS mode.
Regards,
Tomas
Valerie Peng wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Have you tried saving that key through the KeyStore API which allows you
to specify an alias?
Thanks,
Valerie
On 03/26/10 00:05, Tomas Gustavsson wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Slightly off topic.
Something I would like to see is API support for setting aliases when
using the KeyPairGenerator. This is due to the fact that many HSMs do
not allow changing an alias of private keys after they have been
generated. Since the key pair generator sets a blank alias when using
PKCS#11, HSM key pairs are left with no alias.
You can set an alias by providing it using pkcs11 attributes through
the provider, but that alias is provider global (for all generated key
pairs) which is not very usable.
Regards,
Tomas
On 03/26/2010 12:17 AM, Valerie Peng wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Probably not. Unless explicitly specified through KeyStore APIs, aliases
are constructed using the attributes values associated with the
keys/certs. Thus, this is probably due to some problem with the native
library which generated the keys/certs.
Valerie
On 03/18/10 19:03, Weijun Wang wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Valerie
As described in <a class="moz-txt-link-freetext" href="http://forums.sun.com/thread.jspa?threadID=5432248">http://forums.sun.com/thread.jspa?threadID=5432248</a>,
customer's pkcs11 keystore has aliases ended with '\0'.
Is this something we should fix on the Java side?
Thanks
Max
</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<pre wrap=""><!---->
</pre>
</blockquote>
<br>
</body>
</html>