2
$\begingroup$

I want to compute an HMAC value of a data set using CKM_SHA256_HMAC mechanism with AES key. I have the error code CKR_KEY_TYPE_INCONSISTENT because it seems that I need to use a key of key_type GENERIC_SECRET instead. Is it possible to use AES key_type with this mechanism? If yes, how can I do it? Can you provide an example?

$\endgroup$
  • 2
    $\begingroup$ AES-CMAC would be functionally equivalent to HMAC - except for the output size. That may be of little consolation if your protocol requires HMAC of course. Same problem with fgrieu's answer: if the protocol doesn't define a KDF and cannot be changed then inserting one is not an option. $\endgroup$ – Maarten - reinstate Monica Feb 28 at 14:39
2
$\begingroup$

I see no way. Typed keys are typed to prevent them from being used for another task than being the key to the designated algorithm.

What you maybe could do is use the key to derive another, and use it as an HMAC key. But I do not immediately see how we could avoid that the HMAC key could leak of the PKCS#11 device.
Note: this comment sketches an option. But I can't remember of a key derivation mechanism in a PKCS#11 device that allows to derive a key remaining internal but where the new key is for a completely unrelated algorithm (even as a proprietary extension). Also, if the intended algorithm is not fed to the derivation, that could be susceptible to attack by using the same key for a variety of algorithms. For example DES to get 56 bits out of the first 64, then two-keys 3DES for 112 out of 128, then AES-128 for 128 out of 128, and so on.

If compatibility with standard HMAC is not needed, then an option is to compute an AES-based MAC of the SHA-512 of the message, which is possible with the key in the PKCS#11 device, and can likely be much faster since the SHA-512 of the message can be computed externally.

$\endgroup$
  • $\begingroup$ There are generally AES key derivation mechanisms available, maybe those could be used (generally they are little more than AES / ECB or AES / CBC over input data, where the output is treated as a key if I remember correctly). $\endgroup$ – Maarten - reinstate Monica Feb 28 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.