HSM创建密钥报CKR_TEMPLATE_INCONSISTENT，改用UnwrapKey遇CKR_WRAPPED_KEY_INVALID

我用PKCS#11的C#封装在HSM上创建密钥时，碰到CKR_TEMPLATE_INCONSISTENT错误。这段代码在SoftHSM上运行正常，但在网络HSM上报错，就算加上CKA_VALUE_LEN属性（值设为32）也解决不了。

后来按Sam Paul的建议改用另一段代码尝试，结果又出现Method C_UnwrapKey returned CKR_WRAPPED_KEY_INVALID错误。

第一段代码 #

public void GenerateKeyByName(ISession session, string keyName, string keyContent,string requestId)
{
    byte[] ckaId = session.GenerateRandom(20);
    byte[] contentbyte = ConvertUtils.HexStringToBytes(keyContent);
    List<IObjectAttribute> objectAttributes = new List<IObjectAttribute>();

    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_KEY_TYPE, CKK.CKK_AES));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_TOKEN, true));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_ENCRYPT, true));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_DECRYPT, true));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_PRIVATE, true));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_LABEL, keyName));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_ID, ckaId));
    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_VALUE, contentbyte));

    objectAttributes.Add(session.Factories.ObjectAttributeFactory.Create(CKA.CKA_VALUE_LEN, 32));
    IObjectHandle objectHandle = session.CreateObject(objectAttributes);
}

第二段代码 #

byte[] contentbyte = ConvertUtils.HexStringToBytes("33333333333333333333333333333333");

int keySizeBytes = contentbyte.Length; // Ensures the length matches the ZMK provided
byte[] ckaId = session.GenerateRandom(20);

// Step 2: Create the Wrapping Key Attributes
List<IObjectAttribute> wrappingKeyAttributes = new List<IObjectAttribute>()
{
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_TOKEN, false),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_PRIVATE, true),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_KEY_TYPE, CKK.CKK_DES3), // Ensure 3DES
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_ENCRYPT, true), // Enable encryption
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_UNWRAP, true), // Enable wrapping
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_LABEL, "TempAESImportKey"),
};  

IObjectHandle wrappingKeyHandle = session.GenerateKey(session.Factories.MechanismFactory.Create(CKM.CKM_DES3_KEY_GEN), wrappingKeyAttributes);
Console.WriteLine("Wrapping key created successfully.");

IMechanism encryptMechanism = session.Factories.MechanismFactory.Create(CKM.CKM_DES3_ECB);
byte[] encryptedData = session.Encrypt(encryptMechanism, wrappingKeyHandle, contentbyte);
Console.WriteLine("Encryption done successfully.");

List<IObjectAttribute> unwrappingKeyAttributes = new List<IObjectAttribute>()
{
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_TOKEN, true),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_PRIVATE, true),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_KEY_TYPE, CKK.CKK_DES3),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_ENCRYPT, true),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_DECRYPT, true),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_UNWRAP, true),
    session.Factories.ObjectAttributeFactory.Create(CKA.CKA_LABEL, "ZMK"),
};

IObjectHandle unwrappingKeyHandle = session.GenerateKey(session.Factories.MechanismFactory.Create(CKM.CKM_DES3_KEY_GEN), unwrappingKeyAttributes);
Console.WriteLine("Unwrapping key created successfully.");
// Step 5: Unwrap the ZMK using zmkValue as the wrapped data
// Unwrap the ZMK
IMechanism unwrapMechanism = session.Factories.MechanismFactory.Create(CKM.CKM_DES3_ECB);

//IObjectHandle importedKeyHandle = session.UnwrapKey(unwrapMechanism, unwrappingKeyHandle, encryptedData, unwrappingKeyAttributes);
IObjectHandle importedKeyHandle = session.UnwrapKey(unwrapMechanism, wrappingKeyHandle, encryptedData, unwrappingKeyAttributes);

Console.WriteLine("ZMK imported successfully into the HSM.");

内容的提问来源于stack exchange，提问作者Usama Alam