R: Problems with encrypted CMS with Luna HSM and JBOSS

Consider we’re using an HA slot on the HSM wich is a virtual slot on two partions, so yes we access the same HSM on two different virtual slots (one per client) which link to the same slots.



Da: Massimiliano Ziccardi [mailto:[email protected]]
Inviato: lunedì 27 maggio 2019 14:53
A: Emiliano Latini
Cc: [email protected]
Oggetto: Re: [dev-crypto] Problems with encrypted CMS with Luna HSM and JBOSS

The question could sound stupid, but have you ensured that both servers are accessing the same HSM and the same slots?



Il giorno lun 27 mag 2019 alle ore 12:59 Emiliano Latini <[email protected]<mailto:[email protected]>> ha scritto:
Hi there.
I’m trying to decrypt an encrypted p7m using BC along with HSM.
The code works well on a standalone machine i.e tomcat, if I run it in a Jboss Domain mode I get only one node to work.
The other gets this exception: function 'C_UnwrapKey' returns 0x110 on key=xxxxxxx note this key doesn’t exist on the HSM so I suppose it’s trying to put the extracted key

This is part of the stack :

Caused by: com.safenetinc.luna.exception.LunaException: Unable to inject key
            at com.safenetinc.luna.provider.key.LunaKey.injectKey(LunaKey.java:801)
            at com.safenetinc.luna.provider.key.LunaSecretKey.InjectSecretKey(LunaSecretKey.java:139)
            at com.safenetinc.luna.provider.key.LunaSecretKey.InjectSecretKey(LunaSecretKey.java:121)
            at com.safenetinc.luna.provider.keyfactory.LunaSecretKeyFactoryDES3.engineTranslateKey(LunaSecretKeyFactoryDES3.java:91)
            at javax.crypto.SecretKeyFactory.translateKey(SecretKeyFactory.java:409)
            at com.safenetinc.luna.provider.cipher.LunaCipher.engineInit(LunaCipher.java:336)
            at com.safenetinc.luna.provider.cipher.LunaCipherIv.engineInit(LunaCipherIv.java:64)
            at javax.crypto.Cipher.init(Cipher.java:1393)
            at javax.crypto.Cipher.init(Cipher.java:1326)
            at org.bouncycastle.cms.jcajce.EnvelopedDataHelper$1.doInJCE(Unknown Source)
            at org.bouncycastle.cms.jcajce.EnvelopedDataHelper.execute(Unknown Source)
            at org.bouncycastle.cms.jcajce.EnvelopedDataHelper.createContentCipher(Unknown Source)
            at org.bouncycastle.cms.jcajce.JceKeyTransEnvelopedRecipient.getRecipientOperator(Unknown Source)
            at org.bouncycastle.cms.KeyTransRecipientInformation.getRecipientOperator(Unknown Source)
            at org.bouncycastle.cms.RecipientInformation.getContentStream(Unknown Source)


And this is the code I use for it:

            RecipientInformation recipient = recipients.get(new JceKeyTransRecipientId((java.security.cert.X509Certificate)jcaProvider.getKeystore().getCertificate(alias)));
                        if (recipient != null) {
                                   log.info<http://log.info>("recipient!=null getting trans");

                                   JceKeyTransEnvelopedRecipient trans=new JceKeyTransEnvelopedRecipient((PrivateKey)jcaProvider.getKeystore().getKey(alias,jcaProvider.getPwd().toCharArray()));

                                   trans.setMustProduceEncodableUnwrappedKey(true);
                                   trans.setProvider(provider);

                                   log.info<http://log.info>("returning content!");

                                   CMSTypedStream cmsTs= recipient.getContentStream(trans);
                                   return cmsTs.getContentStream();


}

Still don’t understand why it works only on a node since it seems a problem with keys…any ideas?
Thank you


Emiliano Latini
Engineering's Software Laboratory
Direct:                     +39 06 87594577
Mobile:                    +39 347  7906590

E-mail :                    [email protected]<mailto:[email protected]>
Engineering Ingegneria Informatica spa
Piazzale dell’Agricoltura, 24 - 00144 Roma
Segui Engineering su Twitter! (@EngineeringSpA)
www.eng.it<http://www.eng.it/>