c++ - 如何在 C++ 中使用 X509 证书模数在 token 中查找私钥

Question

在使用 pkcs#11 的 C++ 代码中，我们试图找到私钥并在 token 中安装相应的 x509 证书。但是无法使用模数在 token 中找到 key 对。下面是我的代码示例。

    //Install certificate

    const char bytes[] = "-----BEGIN CERTIFICATE-----" "\n"
        ....
        "-----END CERTIFICATE-----" "\n";
    BIO *bio_mem = BIO_new(BIO_s_mem());
    BIO_puts(bio_mem, bytes);
    X509 * x509 = PEM_read_bio_X509(bio_mem, NULL, NULL, NULL);
    //
    BIO *bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);

    EVP_PKEY *pkey = X509_get_pubkey(x509);

    RSA *rsa_key;
    DSA *dsa_key;
    char *rsa_e_dec, *rsa_n_hex, *dsa_p_hex,
        *dsa_q_hex, *dsa_g_hex, *dsa_y_hex;

    rsa_key = pkey->pkey.rsa;
    //IFNULL_FAIL(rsa_e_dec, "unable to extract rsa exponent");
    CK_BYTE_PTR modulus, exponent;

    modulus = (unsigned char *)malloc(256);
    int mo = BN_bn2bin(rsa_key->n, modulus);
    //EVP_PKEY_free(pkey);
//  CK_RV result;
    CK_OBJECT_HANDLE hObject;
    CK_OBJECT_HANDLE hObjects[100];
    CK_OBJECT_HANDLE_PTR hObject_PTR = NULL;
    CK_ULONG count;
    vector<CK_OBJECT_HANDLE> *handles = new vector<CK_OBJECT_HANDLE>();
    //Object class attribute
    CK_OBJECT_CLASS classValue = CKO_PRIVATE_KEY;
    CK_OBJECT_CLASS keytype = CKK_RSA;

    CK_ATTRIBUTE privKeySearchTemplate[] = {
        { CKA_CLASS, &classValue,sizeof(classValue) },
    { CKA_KEY_TYPE, &keytype,sizeof(keytype) },
    { CKA_MODULUS, &modulus, sizeof(modulus) },
    };
    //
    //{ CKA_PUBLIC_EXPONENT, exponent},

    // Read label and ID from private key handle
    CK_ATTRIBUTE privKeyAttrsToRead[] =
    { { CKA_LABEL, NULL_PTR, 0 },
    { CKA_ID, NULL_PTR, 0 },
    };
    //WriteToLog(modulus, modulus_len11);
    // Find all objects with the template specified
    result = m_pPKCS11->C_FindObjectsInit(m_SessionHandle, privKeySearchTemplate, 2);


    do {

        // Find the next object
        result = m_pPKCS11->C_FindObjects(m_SessionHandle, &hObject, 1, &count);


        if (count != 0)
            handles->push_back(hObject);

    } while (count != 0);

    result = m_pPKCS11->C_FindObjectsFinal(m_SessionHandle);

Answer 1

这里有几个错误:

{ CKA_MODULUS, &modulus, sizeof(modulus) }

像往常一样，sizeof(modulus) 是指针的大小，根据您的系统，它是 4 或 8。这应该是您的模数的大小，在您的情况下是 mo。此外，请在此处使用正确的类型:

CK_KEY_TYPE keytype = CKK_RSA;

这里还有一个错误:

m_pPKCS11->C_FindObjectsInit(m_SessionHandle, privKeySearchTemplate, 2);

您正在搜索具有 3 个属性的模板，但您将属性数设置为 2。通常您需要编写这样的代码来防止此类错误:

m_pPKCS11->C_FindObjectsInit(m_SessionHandle, privKeySearchTemplate, sizeof(privKeySearchTemplate) / sizeof(CK_ATTRIBUTE));

最后，在使用BN_bn2bin 之前，您需要为您的模数分配足够的内存，除非您希望获得内存异常。分配 256 字节可能不够。