如何使用存储在HSM中的公共密钥来加密JSON字符串为JWE（JSON Web加密）？
我想使用存储在HSM中的公共密钥加密JSON数据。我将.NET框架或.NET核心库中的net.pkcs11interop.highlevelapi与HSM进行通信。 我搜索了许多示例Java或.NET核心样本代码，但它们都由本地存储的.cer/.pem键进行加密。我只想通过使用HSM来执行此操作，并想处理JWE加密格式而不是普通的加密字符串结果。
I want to encrypt a json data as JWE using a public key stored in HSM. I use .Net framework or .Net core libraries for Net.Pkcs11Interop.HighLevelAPI for communication with HSM.
I searched lots of sample java or .net core sample code but they all encrypted by local stored .cer/.pem keys. I only want to do this by using HSM and want to handle JWE encrypted format not a normal encrypted string result.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
默认情况下，PKCS11 Interop代码包装PKCS11提供商。默认提供商只是围绕最小P11实现的包装，或者SOFTHSM之类的东西（我不知道）。相反，您会告诉它使用HSM供应商提供的P11提供商。更改P11提供商会更改访问硬件的方式，但否则不会改变Interop的行为。
但是除了更改之外，除了在用户auth（pkcs11-Speac中的C_Login）之外，外部代码（使用Interop的代码）将没有差异，MFA等）。
我会寻找HSMS提供商，并将其添加到您的搜索词中。假设供应商的提供商实施确实有一些奇怪的东西，则可能有一份集成指南。大多数HSM都使用P11基于标准的方式（大多数供应商都在P11标准委员会中），因此，假设如果提供了集成指南，它将很短，很可能与其他供应商的实施很少或很少或没有更改:)
披露：我为HSM供应商工作，它确实与Interop一起使用，不，我们没有专门用于支持Interop的集成指南。
By default, the pkcs11Interop code wraps a PKCS11 provider. The default provider is simply a wrapper around either a minimal P11 implementation, or SoftHSM or something (I don't know). Instead, you would tell it to use the P11 provider supplied by the vendor of the HSM. Changing the P11 provider changes how the hardware is accessed, but otherwise does not change the behavior of Interop.
But other than that change, there will be no difference in the outer code (the code that is using Interop), except maybe at the user auth (C_Login in PKCS11-speak), as different vendors may have slightly different capabilities there (dual control, MFA, etc).
I would look for the HSMs provider and add that to your search terms. Possibly there is an integration guide available, assuming there is something truly weird about the vendor's Provider implementation. Most HSMs are using P11 the standards-based way (most of the Vendors are on the P11 standards committee), so assume that if an integration guide is provided, it will be very short, and very probably work with another vendor's implementation with little or no change :)
Disclosure: I work for an HSM vendor, it does work with Interop, and no, we don't have an Integration Guide dedicated to support of Interop.