CODEWITHSUNDEEP
ccryptographypkcs#11key-pair
MichaelW
MichaelW

Reputation: 1466

Why does C_GenerateKeyPair return error (PKCS#11)?

I want to create a ECC key pair on a security card via PKCS#11. The curve to be used shall be BrainpoolP256r1 (1.3.36.3.3.2.8.1.1.7), the DER encoding is 06 09 2b 24 03 03 02 08 01 01 07

The function is:

CK_RV create_ECC_key_pair()
{
     CK_RV rv;
     CK_OBJECT_HANDLE publicKey, privateKey;
     CK_MECHANISM mechanism = {
          CKM_EC_KEY_PAIR_GEN, NULL_PTR, 0
     };

     CK_BYTE subject[] = "myKey";
     CK_BYTE id[] = {0xa1};
     CK_BBOOL xtrue = CK_TRUE;
     CK_BBOOL xfalse = CK_FALSE;
     CK_BYTE ecparams[] = {0x06, 0x09, 0x2b, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x07};

     CK_ATTRIBUTE publicKeyTemplate[] = {
         {CKA_LABEL,      subject,     sizeof(subject)},
         {CKA_TOKEN,      &xtrue,      sizeof(xtrue)},
         {CKA_MODIFIABLE, &xfalse,     sizeof(xfalse)},
         {CKA_EC_PARAMS,  &ecparams,   sizeof(ecparams)}
     };

     CK_ATTRIBUTE privateKeyTemplate[] = {
          {CKA_TOKEN,        &xtrue,      sizeof(xtrue)},
          {CKA_MODIFIABLE,   &xfalse,     sizeof(xfalse)},
          {CKA_LABEL,        subject,     sizeof(subject)}
     };

     rv = FunctionPtr->C_GenerateKeyPair(Session,
                            &mechanism,
                            publicKeyTemplate, 4,
                            privateKeyTemplate, 3,
                            &publicKey,
                            &privateKey);
     if (rv != CKR_OK) 
     {
        printf("Error C_GenerateKeyPair (ECC): 0x%X\n", rv);
        return rv;
     }

     return CKR_OK;
}

The C_GenerateKeyPair call returns 0x13 = CKR_ATTRIBUTE_VALUE_INVALID

I have no idea what attribute could be wrong. I know that the information is poor, but I tried different things and have still this error. Is something fundamentally wrong?

Upvotes: 1

Views: 2003

Answers (1)

Maarten Bodewes
Maarten Bodewes

Reputation: 94038

Presuming that other curves do work, it is likely that the curve is simply not installed on the card/PKCS#11 module. In that case you could try another curve (e.g. P-256) or you should explicitly give the domain parameters by value instead of by name (OID).

Upvotes: 1

Related Questions