title: Sign and decrypt data using private keys located on a HSM
body: <p>I have a task to sign and decrypt data, but the private keys are located at a HSM ( Luna SA, / Safenet ). I installed all the client software and connected the Luna SA CSP to the test servers.</p>
  
  <p>Using the PKCS#11 functions provided, I am able to list and export the public keys on the HSM as <code>PCCERT_CONTEXT</code> (<code>CertCreateCertificateContext</code>). When I try to acquire the private key (using CryptoAPI function <code>CryptAcquireCertificatePrivateKey</code>), I receive an error code <code>CRYPT_E_NO_KEY_PROPERTY</code>.</p>
  
  <p>I am probably missing the link between the certificate data and the CSP/HSM. Has anybody done something similar and can give any hints?</p>
  
  <h3>EDIT</h3>
  
  <hr>
  
  <p>I sucessfully created CER files from all the keys located on the HSM.
  When i know use <code>signtool.exe</code> (<a href="http://msdn.microsoft.com/en-us/library/8s9b9yaz(v=vs.110).aspx" rel="nofollow noreferrer">the one that ships with Microsoft Plattform SDK</a>) i am able to sign a dll with a key on the HSM (the tool wizard lets me choose key container, key spec, ...). I tried to use the information the tool shows me and set the private key</p>
  
  <pre><code>bool LinkPrivateKey(PCCERT_CONTEXT cert)
  {
      CRYPT_KEY_PROV_INFO cryptKeyProvInfo;
      memset(&amp;cryptKeyProvInfo, 0, sizeof(cryptKeyProvInfo));
      cryptKeyProvInfo.pwszContainerName = L"MSS";
      cryptKeyProvInfo.pwszProvName = L"Luna Cryptographic Services for Microsoft Windows";
      cryptKeyProvInfo.dwProvType = PROV_RSA_FULL;
      cryptKeyProvInfo.dwFlags = CRYPT_MACHINE_KEYSET; // CERT_SET_KEY_CONTEXT_PROP_ID | CERT_SET_KEY_PROV_HANDLE_PROP_ID;
      cryptKeyProvInfo.cProvParam = 0;
      cryptKeyProvInfo.dwKeySpec = AT_SIGNATURE;
  
      return CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &amp;cryptKeyProvInfo) != FALSE;
  }
  </code></pre>
  
  <p>but CryptAcquirePrivateKey still gives me the same error. I believe I am missing only a small bit here, since the signtool is able to access the private key </p>
  
  <p><img src="https://i.stack.imgur.com/0EdaB.png" alt="enter image description here"></p>
  
  <h3>Edit2</h3>
  
  <hr>
  
  <p>The screnshot shows KEYEXCHANGE but I chose SIGNATURE</p>
  
  <h3>Edit3</h3>
  
  <hr>
  
  <p>I changed the <code>LinkPrivateKey</code>function a little bit, now it works</p>
  
  <pre><code>bool LinkPrivateKey(PCCERT_CONTEXT cert)
  {
      CRYPT_KEY_PROV_INFO cryptKeyProvInfo;
      memset(&amp;cryptKeyProvInfo, 0, sizeof(cryptKeyProvInfo));
      cryptKeyProvInfo.pwszContainerName = L"MSS";
      cryptKeyProvInfo.pwszProvName = L"Luna Cryptographic Services for Microsoft Windows";
      cryptKeyProvInfo.dwProvType = PROV_RSA_FULL;
      cryptKeyProvInfo.dwFlags = 1; // CERT_SET_KEY_CONTEXT_PROP_ID | CERT_SET_KEY_PROV_HANDLE_PROP_ID;
      cryptKeyProvInfo.dwKeySpec = AT_SIGNATURE;
  
      return CertSetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &amp;cryptKeyProvInfo) != FALSE;
  }
  </code></pre>