Skip to Main Content

Java Security

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Using SunPKCS11 provider when there are multiple keys with same label

843811Feb 17 2010 — edited Feb 19 2010
I am using sun.security.pkcs11.SunPKCS11 to access keys stored in HSM which implements PKCS11 interface. Everything works as expected, when there are no keys with same label(CKA_LABEL) in HSM. I am using Luna HSM. I get the following exception when I run my code -

java.io.IOException: load failed
at sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:751)
at java.security.KeyStore.load(KeyStore.java:1150)
at com.arcot.crypto.impl.NCipherSampleOne.main(Sample.java:41)
*Caused by: java.security.KeyStoreException: invalid KeyStore state: found multiple secret keys sharing same CKA_LABEL [+<KeyWithDuplicateInHSM>+]*
at sun.security.pkcs11.P11KeyStore.mapLabels(P11KeyStore.java:2308)
at sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:739)
... 2 more

Here is the code I am using -

Properties map = new Properties();

// Set properties that are used to initialize SunPKCS11 Provider
map.setProperty("name", "luna");
map.setProperty("library", "D:/Program Files/LunaSA/cryptoki.dll"); // path of the DLL which implements PKCS#11 interface
map.setProperty("slotListIndex", "0");

ByteArrayInputStream bin = getInputStreamFromProps(map); // gets an input stream from the properties provided
SunPKCS11 p = new sun.security.pkcs11.SunPKCS11(bin);
Security.addProvider(p);

String hsmPin = "Place Holder For HSMPin"; // TODO: Replace this string with HSM Pin
KeyStore ks = KeyStore.getInstance("PKCS11");
ks.load(null, hsmPin.toCharArray()); *// This fails if there are multiple secret keys in HSM with same label.*
Key keyN = ks.getKey("TestTripleDESKey", null);
System.out.println(keyN);

// perform decryption operation using this keyN secret key.
// This can be done using Standard javax.crypto.Cipher Class.

Please let me know how to get rid of this error. Is there any additional property that can be passed to SunPKCS11 constructor that might solve this problem ?
Comments
Locked Post
New comments cannot be posted to this locked post.
Post Details
Locked on Mar 19 2010
Added on Feb 17 2010
6 comments
6,833 views