How to use AES on NitroKey HSM2

[szszszsz]

@Josu

Since my last post I kept trying with sc-hsm-embedded. The fail I complaint about was related to using the latest release version. Once I moved to the “aes” branch and compiled myself the “sc-hsm-pkcs11.dll” I was able to get rid of it. Sadly when I tried to use pkcs11-tool to generate the AES key using the compiled module it failed because the mechanism is not available.

Hi!

I see. By this I understand there is some partial support for that.
@sc-hsm: Hi! Is the aes branch of the sc-hsm-embedded project planned for the merge to master?

@Josu

On the other hand with the “Smart card shells” key manager I was able to create an AES key as user “tkalkanci” stated in the post your referred. I’m not a big fan of this method, I would rather be able to create it with pkcs11-tool or so but so far so good.

SCSH3 is the vendor’s tools’ suite, and as such I expect it to be always up-to-date. As for OpenSC, it may lag with some features, which hopefully will change in the future. Please feel free to create proper tickets to OpenSC.

@Josu

Now the big question is whether encrypting and decrypting with that key is possible. I have read about doing so with APDU commands but it looks like the method requires passing the key as parameter which would be a security issue.

I would expect this would take the key slot number, not the actual raw secret. I do not know any details about it unfortunately. Please join the CardContact Developer Network, where you should get the specialized help.
Please see following site for more details:

• SmartCard-HSM Support

–
Szczepan