Cheers. I'm dealing with HSM via PKCS#11 C/Python interface. I'm wondering is it possible to do some C_Encrypt/C_Decrypt in hardware. By saying "in hardware" I mean encryption/decryption without exposing the result to the caller space. This is mostly aboud decryption as I want to call C_Decrypt and leave the result inside the HSM as arbitrary data to do some other transformations on that data later, saying re-encrypting it on some other key. Thank you in advance.

  • $\begingroup$ I believe this suits more into StackExchange. $\endgroup$ – kelalaka Nov 14 '18 at 9:10
  • $\begingroup$ If you'd use CTR mode encryption then you could encrypt the data with a temporary key, then decrypt the data with the decryption key. You could do the same thing once you know the new key. I don't see how you could use C_Decrypt to a data object on the HSM, as the function expects a pointer to a byte array. $\endgroup$ – Maarten Bodewes Nov 14 '18 at 16:43
  • 1
    $\begingroup$ This question has been reposted on SO. While I don't necessarily see this as off-topic here (see e.g. this recent meta thread), we should still preferably keep all the answers in one place. $\endgroup$ – Ilmari Karonen Nov 14 '18 at 16:58
  • $\begingroup$ @IlmariKaronen, sorry, I just thougth this question suits better for this resource. I'm closing it. $\endgroup$ – Henadzi Matuts Nov 15 '18 at 7:53
  • $\begingroup$ @HenadziMatuts I’ve closed it for your convenience. $\endgroup$ – e-sushi Nov 16 '18 at 2:55