title: How to Set/Create a Key Value for AES Secret Key on Network Luna HSM?
body: <p>When attempting to create a secret key; I'm told that it's not possible to create your own key values and they must be generated/unwrapped onto the HSM. In case this isn't true I've attached both attempts/methods in case I'm missing something. Any help would be greatly appreciated! </p>
  
  <p><strong>Environment:</strong> Network Luna K6 5.1</p>
  
  <p><strong>Library:</strong> PKCS11Interop.Net</p>
  
  <h2><strong>Attempt 1: Using Create Object</strong></h2>
  
  <p><strong>Error:</strong> CKR_TEMPLATE_INCONSISTENT</p>
  
  <pre><code>string keyLabel = "CustomSecretKey"
  byte[] Value = HexStringToByteArray(value);
  
  privateKey = new List&lt;ObjectAttribute&gt;
                                  {
                                     //PKCS11V2.20 Common Attributes Defined @ 12.12.2
                                     new ObjectAttribute(CKA.CKA_LABEL, keyLabel),
                                     new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                                     new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_AES),
                                     new ObjectAttribute(CKA.CKA_TOKEN, true),
                                     new ObjectAttribute(CKA.CKA_ENCRYPT, true),
                                     new ObjectAttribute(CKA.CKA_PRIVATE, true), 
                                     new ObjectAttribute(CKA.CKA_DECRYPT, true), 
                                     new ObjectAttribute(CKA.CKA_VALUE_LEN, 32),
                                     new ObjectAttribute(CKA.CKA_VALUE, Value)    
  
                                 };
  
  session.CreateObject(privateKey);
  </code></pre>
  
  <p>This apparently isn't supported?</p>
  
  <h2><strong>Attempt 2: Using UnWrap Key</strong></h2>
  
  <p><strong>Error:</strong> CKR_WRAPPED_KEY_INVALID</p>
  
  <pre><code>using (Pkcs11 pkcs11 = new Pkcs11(HSM.Instance.vendorDLLPath, AppType.MultiThreaded))
              {
                  List&lt;Slot&gt; slots = pkcs11.GetSlotList(SlotsType.WithTokenPresent); //Checks to see what slots have token on them.
                  Slot slot = slots[HSM.Instance.activeSlot];
                  using (Session session = slot.OpenSession(SessionType.ReadWrite)) // Open RW session
                  {
                      session.Login(CKU.CKU_USER, HSM.Instance.loginPass); // Login as normal user   
                      try
                      {
                          byte[] Value = HexStringToByteArray(value);
  
                          if (!string.IsNullOrEmpty(keyLabel))
                          {
  
                              List&lt;ObjectAttribute&gt; wrapKey = new List&lt;ObjectAttribute&gt;
                              {
                              new ObjectAttribute(CKA.CKA_LABEL, "TempWrapKey"),
                              new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                              new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_AES),
                              new ObjectAttribute(CKA.CKA_TOKEN, true),
                              new ObjectAttribute(CKA.CKA_PRIVATE, true),
                              new ObjectAttribute(CKA.CKA_ENCRYPT, true),
                              new ObjectAttribute(CKA.CKA_DECRYPT, true),
                              new ObjectAttribute(CKA.CKA_SENSITIVE, true),
                              new ObjectAttribute(CKA.CKA_VERIFY, true),
                              new ObjectAttribute(CKA.CKA_SIGN, true),
                              new ObjectAttribute(CKA.CKA_WRAP, true),
                              new ObjectAttribute(CKA.CKA_UNWRAP, true),
                              new ObjectAttribute(CKA.CKA_DERIVE, false),
                              new ObjectAttribute(CKA.CKA_EXTRACTABLE, false),
                              new ObjectAttribute(CKA.CKA_VALUE_LEN, 32)
  
                              };
                              ObjectHandle WrappingKey = session.GenerateKey(new Mechanism(CKM.CKM_AES_KEY_GEN), wrapKey);
  
                              byte[] keyValueBytes = session.Encrypt(new Mechanism(CKM.CKM_AES_ECB), WrappingKey, Value);
  
                              List&lt;ObjectAttribute&gt; privateKeyAttributes = new List&lt;ObjectAttribute&gt;
                              {
  
                                  new ObjectAttribute(CKA.CKA_LABEL, keyLabel),
                                  new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_SECRET_KEY),
                                  new ObjectAttribute(CKA.CKA_KEY_TYPE, CKK.CKK_AES),
                                  new ObjectAttribute(CKA.CKA_TOKEN, true),
                                  new ObjectAttribute(CKA.CKA_PRIVATE, true),
                                  new ObjectAttribute(CKA.CKA_ENCRYPT, true),
                                  new ObjectAttribute(CKA.CKA_DECRYPT, true),
                                  new ObjectAttribute(CKA.CKA_SENSITIVE, true),
                                  new ObjectAttribute(CKA.CKA_VERIFY, true),
                                  new ObjectAttribute(CKA.CKA_SIGN, true),
                                  new ObjectAttribute(CKA.CKA_WRAP, true),
                                  new ObjectAttribute(CKA.CKA_UNWRAP, true),
                                  new ObjectAttribute(CKA.CKA_DERIVE, false),
                                  new ObjectAttribute(CKA.CKA_EXTRACTABLE, false),
                                  new ObjectAttribute(CKA.CKA_VALUE_LEN, 32)
  
                              };
  
  
                              session.UnwrapKey(new Mechanism(CKM.CKM_AES_ECB), WrappingKey, keyValueBytes, privateKeyAttributes);
                              session.DestroyObject(WrappingKey);
                              response.ErrorText = "Key Created?";
  </code></pre>
  
  <p><strong>The logs of attempt 2:</strong> </p>
  
  <pre><code>12:02:28 03696-5152:STRTOpenSession {Slot=1 Flgs=6 }
  12:02:28 03696-5152:FINIOpenSession CKR_OK(1609ms) {Sesn=1 }
  
  12:02:28 03696-5152:STRTLogin {Sesn=1 User=1 PIN="********" }
  12:02:28 03696-5152:FINILogin CKR_OK(1734ms) {}
  
  12:02:28 03696-5152:STRTGenerateKey {Sesn=1 Mech=(CKM_AES_KEY_GEN,"") AttrList={CKA_CLASS="04000000" CKA_KEY_TYPE="1f000000" CKA_TOKEN="01" CKA_ENCRYPT="01" CKA_LABEL="TempWrapKey" CKA_CLASS="04000000" CKA_KEY_TYPE="1f000000" CKA_TOKEN="01" CKA_ENCRYPT="01" CKA_PRIVATE="01" CKA_DECRYPT="01" CKA_VALUE_LEN="20000000" CKA_WRAP="01" CKA_UNWRAP="01" CKA_SENSITIVE="01" CKA_SIGN="01" CKA_DERIVE="00" CKA_EXTRACTABLE="00" } }
  12:02:29 03696-5152:FINIGenerateKey CKR_OK(1750ms) {Obj=2000001 }
  
  12:02:29 03696-5152:STRTEncrypt_Init {Sesn=1 Mech=(CKM_AES_ECB,"") Obj=2000001 }
  12:02:29 03696-5152:FINIEncrypt_Init CKR_OK(1750ms) {}
  
  12:02:29 03696-5152:STRTEncrypt {Sesn=1 "23724cf301e85a53fc3f5aea6384c16e" pusEncryptedDataLen=0xf91ddca0 *pusEncryptedDataLen=0 }
  12:02:29 03696-5152:FINIEncrypt CKR_OK(1750ms) {"" pusEncryptedDataLen=0xf91ddca0 *pusEncryptedDataLen=16 }
  
  12:02:29 03696-5152:STRTEncrypt {Sesn=1 "23724cf301e85a53fc3f5aea6384c16e" pusEncryptedDataLen=0xf91ddca0 *pusEncryptedDataLen=16 }
  12:02:29 03696-5152:FINIEncrypt CKR_OK(1750ms) {"2e151cc889470864b5fb5a24146fecb2" pusEncryptedDataLen=0xf91ddca0 *pusEncryptedDataLen=16 }
  
  12:02:29 03696-5152:STRTUnwrapKey {Sesn=1 Mech=(CKM_AES_ECB,"") Obj=2000001 "2e151cc889470864b5fb5a24146fecb2" AttrList={CKA_LABEL="Key2372" CKA_CLASS="04000000" CKA_KEY_TYPE="1f000000" CKA_TOKEN="01" CKA_PRIVATE="01" CKA_ENCRYPT="01" CKA_DECRYPT="01" CKA_SENSITIVE="01" CKA_VERIFY="01" CKA_SIGN="01" CKA_WRAP="01" CKA_UNWRAP="01" CKA_DERIVE="00" CKA_EXTRACTABLE="00" CKA_VALUE_LEN="20000000" } }
  12:02:29 03696-5152:FINIUnwrapKey ***CKR_WRAPPED_KEY_INVALID***(1750ms) {Obj=0 }
  
  12:02:29 03696-5152:STRTCloseSession {Sesn=1 }
  12:02:29 03696-5152:FINICloseSession CKR_OK(1765ms) {}
  </code></pre>
  
  <p>Should I generate another key and use that to be unwrapped?</p>