<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div>I have the following work sequence using the PKCS 11 API against SoftHSM:</div><div><br></div><div>1. Generate a number of RSA keys.</div><div>2. Keep the key pairs in the key store.</div><div>3. Later on, retrieve the a RSA key pair of a given modulus size from the key store. The only requirement is that the size of its modulus must be the one specified.</div><div>4. Use the private key from the key pair retrieved to carry out a signature operation.</div><div><br></div><div>I can do the first two steps without any problems. For step number 3 I tried using the following code:</div></div><div><br></div><div><br></div><div><div> CK_KEY_TYPE key_type = CKK_RSA;</div><div> CK_OBJECT_HANDLE rsa_key;</div><div> CK_OBJECT_CLASS type = CKO_PRIVATE_KEY;</div><div> CK_BBOOL true = TRUE;</div><div><br></div><div> CK_ATTRIBUTE keyAttrs[] = {</div><div> { CKA_TOKEN, &true, sizeof(true) },</div><div> { CKA_KEY_TYPE, &key_type, sizeof(key_type) },</div><div> { CKA_CLASS, &class, sizeof(class) },</div><div> { CKA_MODULUS_BITS, &modulus_size, sizeof(modulus_size) }</div><div> };</div><div><br></div><div> CK_ULONG template_size, returned;</div><div> CK_RV rv;</div><div><br></div><div> template_size = sizeof(keyAttrs) / sizeof(CK_ATTRIBUTE);</div><div><br></div><div> rv = f->C_FindObjectsInit(hSession, keyAttrs, template_size);</div><div> if (rv != CKR_OK) {</div><div> printf("C_FindObjectsInit: %d\n", rv);</div><div> break;</div><div> }</div><div><br></div><div> rv = f->C_FindObjects(hSession, key, 1, &returned);</div><div> if (rv != CKR_OK) {</div><div> printf("C_FindObjects: %d\n", rv);</div><div> return rv;</div><div> }</div><div><br></div><div> rv = f->C_FindObjectsFinal(hSession);</div><div> if (rv != CKR_OK) {</div><div> printf("C_FindObjectsFinal: %d\n", rv);</div><div> return rv;</div><div> }</div><div><br></div><div> return rv;</div><div><br></div></div><div><div dir="ltr" data-setdir="false">This does not work. All of the C_Find* calls above return CKR_OK, but C_FindObjects cannot find any private keys matching the attributes in the keyAttrs array: the value of returned is set to 0 when this function returns. However, when I set CK_OBJECT_CLASS type equal to CKO_PUBLIC_KEY, I obtain a public key object handle.</div><div><br></div><div>I am obviously missing something big here, but, what? The PKCS 11 session under which this code is running was opened with CKF_RW_SESSION | CKF_SERIAL_SESSION flags, and the session state at this point is CKS_RW_USER_FUNCTIONS.</div><div><br></div><div>If a private key object handle cannot be obtained as above, how can it be done? I need such an object handle to compute signatures.</div></div><br></div></div></body></html>