无法使用 HSM 中的私钥解密消息答案

【问题标题】：Unable to use Private Key from HSM to decrypt message无法使用 HSM 中的私钥解密消息
【发布时间】：2022-08-02 23:35:02
【问题描述】：

我正在尝试使用存储在 Luna HSM 上的私钥解密已使用我们的公钥加密的消息，如下所示：

连接到 HSM：

 private void connectToHSM() throws Exception {
 try {
     ks = KeyStore.getInstance(\"Luna\");
     logger.debug(\"Logging in to Luna HSM...\");
     logger.debug(\"KS Pw Before toCharArray:\" + keyStorePassword);
     logger.debug(\"KS Pw:\" + keyStorePassword.toCharArray());
     ks.load(is1, keyStorePassword.toCharArray());
 } catch (KeyStoreException e) {
     logger.debug(\"HSM KeyStoreException while loading keystore:\"+e.getMessage());
     throw new Exception(\"Unable to create keystore object\");
 } catch (NoSuchAlgorithmException e) {
     logger.debug(\"HSM NoSuchAlgorithmException while loading keystore:\"+e.getMessage());
     throw new Exception(\"Unexpected NoSuchAlgorithmException while loading keystore\");
 } catch (CertificateException e) {
     logger.debug(\"HSM CertificateException while loading keystore:\"+e.getMessage());
     throw new Exception(\"Unexpected CertificateException while loading keystore\");
 } catch (IOException e) {
     logger.debug(\"HSM IOException while loading keystore:\"+e.getMessage());
     throw new Exception(\"Unexpected IOException while loading keystore.\");
 }}

解密函数

 public byte[] decrypt(byte[] data) throws Exception {
 byte[] plainData      = null;
 byte[] secretKey      = null;
 PrivateKey privateKey = null;

 if(data == null || data.length == 0)
     throw new Exception(\"byte array data can not be null or blank array.\");

 ByteArraySpliter arrSpliter = new ByteArraySpliter(data);
 if (!slotManager.getReconnectRequired()) {
     if(Security.getProvider(\"LunaProvider\")==null){
         Security.insertProviderAt(new com.safenetinc.luna.provider.LunaProvider(), 3);
     }
     try{
     connectToHSM();
     }catch (Exception e) {
         logger.error(\"HSM ERROR\");
         e.printStackTrace();
     }

     threadsOnTheFlyCounter.incrementAndGet();

     //Access private key from Luna Keystore
     try{
         logger.debug(\"Alias is : \" + alias);
         privateKey    = (PrivateKey)ks.getKey(alias+\"-private\", keyStorePassword.toCharArray());
         if(null == privateKey)
         logger.debug(\"KEY not derived from store\");

         //Decrypt AES symmetric key using Private Key retrieved from Luan Keystore
         secretKey = decryptSecretKeyData(arrSpliter.getEncryptedSecretKey(), arrSpliter.getIv(), privateKey);

     } catch (Exception e) {
         logger.error(\"Error in DECRYPTION of SYMMETRIC KEY: \"+e.getMessage());
         e.printStackTrace();
         throw new Exception(\"Error in  DECRYPTION of SYMMETRIC KEY: \"+e.getMessage());

     } finally {
     // FOR RECONNECT
         threadsOnTheFlyCounter.decrementAndGet();
     }

     //Decrypt response data using AES symmetric key
     plainData = decryptData(arrSpliter.getEncryptedData(), arrSpliter.getIv(), secretKey);

     boolean result = validateHash(plainData);
     if(!result) 
     throw new Exception( \"Integrity Validation Failed : \" +
         \"The original data at client side and the decrypted data at server side is not identical\");
 }

 return trimHMAC(plainData);}

使用上述块时收到错误：

2021-12-17 15:00:38,055 - DEBUG [connectToHSM:158] - KS Pw Before toCharArray:12345
2021-12-17 15:00:38,055 - DEBUG [connectToHSM:159] - KS Pw:[C@22297228
2021-12-17 15:00:38,072 - DEBUG [decrypt:202] - Alias is : label1
2021-12-17 15:00:38,078 - DEBUG [decrypt:205] - KEY not derived from store
2021-12-17 15:00:38,078 - DEBUG [decryptSecretKeyData:327] - decryptSecretKeyData function called using LunaParameterSpecOAEP
2021-12-17 15:00:38,078 - ERROR [decrypt:210] - Error in DECRYPTION of SYMMETRIC KEY: Failed to decrypt AES secret key using RSA.```

使用 CMU 功能将私钥导入 HSM。私钥的原始别名是“swapnil”。当我尝试使用这个别名时，我得到了与上面相同的错误。然后我尝试修改解包私钥的句柄标签并将其更改为label1，但问题仍然存在。

谁能帮我解决这个问题。如果需要，我可以提供更多输入。

标签： java hsm safenet

【解决方案1】：

如果没有特定的 PKCS #11 返回代码 (CKR_XXX)，就无法判断失败的原因和原因。您粘贴的日志消息不显示任何 PKCS #11 错误。

【讨论】：