softhsm_setup.py

# Test setup script for SoftHSM
#
# I run this with
# PYKCS11LIB=/usr/lib/softhsm/libsofthsm2.so SOFTHSM2_CONF=/home/jkukkonen/src/playground-e2e-signer/softhsm/softhsm2.conf python softhsm_setup.py 
#
# The softhsm2.conf file contains
#     directories.tokendir = /home/jkukkonen/src/playground-e2e-signer/softhsm/tokendir/

from asn1crypto.keys import ECDomainParameters, NamedCurve
from PyKCS11 import PyKCS11, Session

@staticmethod
def _generate_key_pair(session: Session):
    "Create ecdsa (secp384r1) key pair on hsm key id 2"
    params = ECDomainParameters(
        name="named", value=NamedCurve("secp384r1")
    ).dump()
    public_template = [
        (PyKCS11.CKA_CLASS, PyKCS11.CKO_PUBLIC_KEY),
        (PyKCS11.CKA_PRIVATE, PyKCS11.CK_FALSE),
        (PyKCS11.CKA_TOKEN, PyKCS11.CK_TRUE),
        (PyKCS11.CKA_ENCRYPT, PyKCS11.CK_FALSE),
        (PyKCS11.CKA_VERIFY, PyKCS11.CK_TRUE),
        (PyKCS11.CKA_WRAP, PyKCS11.CK_FALSE),
        (PyKCS11.CKA_KEY_TYPE, PyKCS11.CKK_ECDSA),
        (PyKCS11.CKA_EC_PARAMS, params),
        (PyKCS11.CKA_LABEL, "secp384r1"),
        (PyKCS11.CKA_ID, (2,)),
    ]
    private_template = [
        (PyKCS11.CKA_CLASS, PyKCS11.CKO_PRIVATE_KEY),
        (PyKCS11.CKA_KEY_TYPE, PyKCS11.CKK_ECDSA),
        (PyKCS11.CKA_TOKEN, PyKCS11.CK_TRUE),
        (PyKCS11.CKA_SENSITIVE, PyKCS11.CK_TRUE),
        (PyKCS11.CKA_DECRYPT, PyKCS11.CK_FALSE),
        (PyKCS11.CKA_SIGN, PyKCS11.CK_TRUE),
        (PyKCS11.CKA_UNWRAP, PyKCS11.CK_FALSE),
        (PyKCS11.CKA_LABEL, "secp384r1"),
        (PyKCS11.CKA_ID, (2,)),
    ]

    session.generateKeyPair(
        public_template,
        private_template,
        mecha=PyKCS11.MechanismECGENERATEKEYPAIR,
    )


# SOFTHSM2_CONF and  PYKCS11LIB env variables have to be set at this point
lib = PyKCS11.PyKCS11Lib()
lib.load()
slot = lib.getSlotList(tokenPresent=True)[0]
lib.initToken(slot, "0000", "test token")

# set pin
session = lib.openSession(slot, PyKCS11.CKF_RW_SESSION)
session.login("0000", PyKCS11.CKU_SO)
session.initPin("1111")
session.logout()


session.login("1111")
# Add keys to token
_generate_key_pair(session)
session.logout()
session.closeSession()





# DEBUG PART: TEST SIGNING

from securesystemslib.signer import HSMSigner, Signer

uri, key = HSMSigner.import_()
signer = Signer.from_priv_key_uri(uri, key, lambda pin: "1111")
signer.sign(b"DATA")