Using SunPKCS11 provider when there are multiple keys with same label
843811Feb 17 2010 — edited Feb 19 2010I am using sun.security.pkcs11.SunPKCS11 to access keys stored in HSM which implements PKCS11 interface. Everything works as expected, when there are no keys with same label(CKA_LABEL) in HSM. I am using Luna HSM. I get the following exception when I run my code -
java.io.IOException: load failed
at sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:751)
at java.security.KeyStore.load(KeyStore.java:1150)
at com.arcot.crypto.impl.NCipherSampleOne.main(Sample.java:41)
*Caused by: java.security.KeyStoreException: invalid KeyStore state: found multiple secret keys sharing same CKA_LABEL [+<KeyWithDuplicateInHSM>+]*
at sun.security.pkcs11.P11KeyStore.mapLabels(P11KeyStore.java:2308)
at sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:739)
... 2 more
Here is the code I am using -
Properties map = new Properties();
// Set properties that are used to initialize SunPKCS11 Provider
map.setProperty("name", "luna");
map.setProperty("library", "D:/Program Files/LunaSA/cryptoki.dll"); // path of the DLL which implements PKCS#11 interface
map.setProperty("slotListIndex", "0");
ByteArrayInputStream bin = getInputStreamFromProps(map); // gets an input stream from the properties provided
SunPKCS11 p = new sun.security.pkcs11.SunPKCS11(bin);
Security.addProvider(p);
String hsmPin = "Place Holder For HSMPin"; // TODO: Replace this string with HSM Pin
KeyStore ks = KeyStore.getInstance("PKCS11");
ks.load(null, hsmPin.toCharArray()); *// This fails if there are multiple secret keys in HSM with same label.*
Key keyN = ks.getKey("TestTripleDESKey", null);
System.out.println(keyN);
// perform decryption operation using this keyN secret key.
// This can be done using Standard javax.crypto.Cipher Class.
Please let me know how to get rid of this error. Is there any additional property that can be passed to SunPKCS11 constructor that might solve this problem ?