Python PKCS#11 Module with Pico HSM

[B00148917]

I'm trying to use the Python module - https://python-pkcs11.readthedocs.io/en/latest/ to interact with the Pico-HSM on a PicoW.

using either of
##export PKCS11_MODULE=/usr/local/lib/pkcs11/opensc-pkcs11.so
##export PKCS11_MODULE=/usr/local/lib/libsc-hsm-pkcs11.so

---

import pkcs11
import os

Initialise our PKCS#11 library

lib = pkcs11.lib(os.environ['PKCS11_MODULE'])
token = lib.get_token(token_label='SmartCard-HSM (UserPIN)')

data = b'INPUT DATA'

Open a session on our token

with token.open(user_pin='123456') as session:
# Generate an AES key in this session
key = session.generate_key(pkcs11.KeyType.AES, 256)

# Get an initialisation vector
iv = session.generate_random(128)  # AES blocks are fixed at 128 bits
# Encrypt our data
crypttext = key.encrypt(data, mechanism_param=iv)
print(crypttext)

Throws error that the function is not supported

Traceback (most recent call last):
File "/home/mark/M1/MyHSM/PyTest1.py", line 13, in
key = session.generate_key(pkcs11.KeyType.AES, 256)
File "pkcs11/_pkcs11.pyx", line 488, in pkcs11._pkcs11.Session.generate_key
File "pkcs11/_errors.pyx", line 88, in pkcs11._pkcs11.assertRV
pkcs11.exceptions.FunctionNotSupported

Any guidance on how to use the two together?

M

[polhenarejos]

Unfortunately OpenSC does not provide AES support for HSM. This is explained in https://www.picokeys.com/2022/07/10/aes/ and mainly you must use the sc-hsm-embedded driver:

https://github.com/CardContact/sc-hsm-embedded

In the article there is an example on generating and ciphering with AES.

[B00148917]

Thank you for your guidance. M