get certificate and CSR id from algorithm object

[MhmodTayel]

[microshine]

@MhmodTayel could you describe for which task you need the id field?

[MhmodTayel]

@microshine There was a problem with the id value for cases when key pairs were generated by another application like graphene-pk11 with a specific id value and this module imports the certificate with auto-generated id value so I need the id filed to set the certificate id with the same id as key pairs

[microshine]

@MhmodTayel thank you. I understand your problem

Here is the simple script where I'm trying to generate a key pair with a custom ID and use it for X509 certificate generation. But it doesn't work 😊. Because it uses node-webcrypto-p11 from NPM.

import { Crypto, Pkcs11ImportAlgorithms } from "node-webcrypto-p11";
import * as x509 from "@peculiar/x509";

async function main() {
  const crypto = new Crypto({
    library: "/usr/local/lib/softhsm/libsofthsm2.so",
    slot: 0,
    pin: "12345",
    readWrite: true,
  });
  try {
    await crypto.keyStorage.clear();
    await crypto.certStorage.clear();

    const alg = {
      name: "RSASSA-PKCS1-v1_5",
      hash: "SHA-256",
      publicExponent: new Uint8Array([1, 0, 1]),
      modulusLength: 2048,
    };
    // custom id
    const id = "0102030405";

    // generate RSA key pair and custom ID
    const keys = await crypto.subtle.generateKey({ ...alg, id } as RsaHashedKeyGenParams, false, ["sign", "verify"]);

    // generate self-signed certificate
    const x509Cert = await x509.X509CertificateGenerator.createSelfSigned({
      serialNumber: "01",
      notBefore: new Date(Date.now()),
      notAfter: new Date(Date.now() + (24 * 60 * 60 * 1000)),
      name: "CN=Test",
      keys,
      signingAlgorithm: alg,
    }, crypto);
    console.log(x509Cert.toString("pem"));

    // import PEM certificate
    const cert = await crypto.certStorage.importCert("pem", x509Cert.toString("pem"), { ...alg, id } as Pkcs11ImportAlgorithms, ["sign", "verify"]);

    // add keys and cert into the token
    const privateKeyIndex = await crypto.keyStorage.setItem(keys.privateKey);
    const certificateIndex = await crypto.certStorage.setItem(cert);

    // receive ID information
    console.log("private key index: %s", privateKeyIndex);
    const tokenPrivateKey = await crypto.keyStorage.getItem(privateKeyIndex);
    console.log("private key CKA_ID: %s", tokenPrivateKey.p11Object.id.toString("hex"));
    console.log("certificate index: %s", certificateIndex);
    const tokenCertificate = await crypto.certStorage.getItem(certificateIndex);
    console.log("certificate CKA_ID: %s", (tokenCertificate as any).p11Object.id.toString("hex"));
  } finally {
    crypto.close();
  }
}

main().catch(e => {
  console.error(e);
  process.exit(1);
});

Output

-----BEGIN CERTIFICATE-----
MIICmzCCAYOgAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDEwRUZXN0
MB4XDTIyMTEwMzA5MTU1N1oXDTIyMTEwNDA5MTU1N1owDzENMAsGA1UEAxMEVGVz
dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOi+aWotwV5552huS8kd
GKrVhbPKxRaX1Kz1hSTBnH7MoigA1rz78m1wTC4IpTI/uRfVq66fBpF0hGTBhXvE
XIyRvzyIyTb8UdqoBWhDxRYdJjI65Smk/M2ESoqV2SbK4bEshCHKTY0h+8Pm3mkj
8TWC0p20OHwbgK0rNuq/+gtDb6RcFaIWjaM1KZp6L1niE0Jy0AYI+aYy3QBhk2SL
D52zlAthuF4UuhyzNJReeiCgCeNFTK/IzPdkrsVQhOMJTlN3fVLCCBZzezC5qrrJ
0tW2nD4aCIEQGKgFMAyKv8AxO/hc1KUbYesasamfDCS/RpOUZon/V6Towv90zqHd
BbUCAwEAAaMCMAAwDQYJKoZIhvcNAQELBQADggEBANWePBZt0cW0fdtMgtGCwk5M
0BGa19gPDrE1GHBOaCvCb+O3cc6MzbMcIbGyCNz1l6X4PJo0WAdN1bhxO5uCZVev
CvHSrNsp4LB5SUBt77pUqA3RRl6jS25cWWIYmIycgpHSzL1urCNTxf7swMQcKkZy
jAmaYL0jbj3lhgcZBfzPdqaGiqcM0K23evaFzQ+5LivejyzdcKS13xvNrwx6elUS
JAgiRsSbTqpIi7img7Y2i7iXB0M5lFw4kKwv5/fXuhmiCyAp8uChncKmVyDV5LhG
2d96IgLImndW2jwFiuRfce/pU1Q3CVanhSpEzAfFSh0Z+ToplxGSEg2okZe3QYo=
-----END CERTIFICATE-----
private key index: private-0800000000000000-1256ebb593cc368659b70c35bb35d778
private key CKA_ID: 1256ebb593cc368659b70c35bb35d778
certificate index: x509-0900000000000000-1256ebb593cc368659b70c35bb35d778
certificate CKA_ID: 1256ebb593cc368659b70c35bb35d778

I think app should support:

• using custom ID value for generateKey, importKey, deriveKey, and unwrapKey methods
• the importCert method should use ID value if it presents in algorithm object, if it doesn't, try to find the existing key (which belongs to the certificate) and use its ID, otherwise compute ID from the public key (like it does)

What do you think?

[microshine]

@MhmodTayel could you add test for your task?