ECDH1_DERIVE issues with PCKS11interop and Safenet Network HSM

Question

Been fighting a Gemalto network HSM for a while and its about time i asked for some expert help. I am trying to derive an ECDH1 key from a known public key and a private key stored on the HSM and keep sending the HSM into some sort of panic mode that requires me to reset it before it starts talking again every time i call the derive key function as set out below. Anybody got any pointers?

static string PKCSLibraryPath = @"C:\Program Files (x86)\SafeNet\Protect Toolkit 5\Protect Toolkit C SDK\bin\hsm\cryptoki.dll";
    static Pkcs11 pkc = new Pkcs11(PKCSLibraryPath, AppType.SingleThreaded);

    public string HSM_Interaction(int SlotNumber, string KeyLabel, string Pubkey, string GUID)
    {

        List<Slot> slots = pkc.GetSlotList(SlotsType.WithTokenPresent);
        string pass = "1111";

        //convert putblic key to byte array
        byte[] data = Get_pub_Key(Pubkey);

        //convert password to byte array
        byte[] password = Encoding.ASCII.GetBytes(pass);

        //select correct HSM slot
        Slot S = slots[SlotNumber];

        using (Session Sesh = S.OpenSession(SessionType.ReadWrite))
        {

            Sesh.Login(CKU.CKU_USER, password);
            List<CKM> Mechs = S.GetMechanismList();
            ObjectHandle oPrivKeyObjectHandle;

            //setup search criteria for token
            List<ObjectAttribute> objectAttributes = new List<ObjectAttribute>();
            objectAttributes.Add(new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_PRIVATE_KEY));
            objectAttributes.Add(new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_EC));
            objectAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, KeyLabel));
            Sesh.FindObjectsInit(objectAttributes);
            List<ObjectHandle> oObjCollection = Sesh.FindObjects(1);
            Sesh.FindObjectsFinal();

            if (oObjCollection.Count > 0)
            {  
                oPrivKeyObjectHandle = oObjCollection[0];

                //set template for generated key
                var shared_secret_template = new List<ObjectAttribute>
                {
                    new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                    new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_GENERIC_SECRET),
                    new ObjectAttribute(CKA.CKA_SENSITIVE, false),
                    new ObjectAttribute(CKA.CKA_EXTRACTABLE, true),
                    new ObjectAttribute(CKA.CKA_VALUE_LEN, (ulong)32)
                };


                var deriveAttributes = new List<ObjectAttribute>
                 {
                     new ObjectAttribute(CKA.CKA_TOKEN, false),
                     new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                     new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_GENERIC_SECRET),
                     new ObjectAttribute(CKA.CKA_SENSITIVE, false),
                     new ObjectAttribute(CKA.CKA_EXTRACTABLE, true),
                     new ObjectAttribute(CKA.CKA_ENCRYPT, true),
                     new ObjectAttribute(CKA.CKA_DECRYPT, true),
                     new ObjectAttribute(CKA.CKA_WRAP, true),
                     new ObjectAttribute(CKA.CKA_UNWRAP, true),
                     new ObjectAttribute(CKA.CKA_VALUE_LEN, (ulong)32)
                };


                try
                {
                    //generate derived key

                    byte[] sd = null;
                    CkEcdh1DeriveParams par = new CkEcdh1DeriveParams((ulong)CKD.CKD_NULL, sd, data);
                    par.ToMarshalableStructure();
                    Mechanism m = new Mechanism(CKM.CKM_ECDH1_DERIVE, par);
                    Sesh.DeriveKey(m, oPrivKeyObjectHandle, deriveAttributes);
                    ObjectHandle SSOH = new ObjectHandle();

                    Sesh.GetAttributeValue(SSOH,deriveAttributes);

                }
                catch (Exception ex)
                {
                    string error = ex.Message;
                }
                finally
                {
                    Sesh.Logout();
                }

            }
        }
        return "";
    }
    private byte[] Get_SHA256(string text)
    {
        byte[] bytes = Encoding.UTF8.GetBytes(text);
        SHA256Managed hashstring = new SHA256Managed();
        byte[] hash = hashstring.ComputeHash(bytes);
        string hashString = string.Empty;
        foreach (byte x in hash)
        {
            hashString += String.Format("{0:x2}", x);
        }

        return hash;

    }

    private byte[] Get_pub_Key(string text)
    {
        byte[] Bytes = new byte[65];
        int startpos = 0;
        for (int i = 0; i < (text.Length / 2); i++)
        {
            byte b = Convert.ToByte(text.Substring(startpos, 2), 16);
            Bytes[i] = b;
            startpos += 2;
        }
        return Bytes;
    }
}

Receiving error:

Net.Pkcs11Interop.Common.Pkcs11Exception: 'Method C_DeriveKey returned 2147484548'

Tail of messages log from the HSM:

Mar 21 07:59:10 hsm1 kernel: ERR:  viper0: _do_smachine: hsm kernel crashed
Mar 21 07:59:10 hsm1 kernel: ERR:  viper0: _do_smachine: device error
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0: HSM is being shut down, discarding pending requests...
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0:    DMA buffers:          0000
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0:    HSM commands:         0001
Mar 21 07:59:10 hsm1 kernel: NOTE: viper0:    Callback requests:    0000
Mar 21 07:59:10 hsm1 etnetserver[990]: MDV2_SendReceiveCmd(): MD_SendReceive() 
error: Internal error - unknown error

Answer 1

Exception you are getting says that low level PKCS#11 function C_DeriveKey returned vendor specific error 0x80000384 (2147484548 dec) known as CKR_SMS_ERROR. You will need to discuss documentation provided by the device vendor or contact vendor support to get better understanding how to handle or avoid this specific error.

This exact error was also discussed in an older question where it was caused by an incorrect usage of PKCS#11 API in a multithreaded environment.