AES GCM mode examples

[tstiemerling]

Are there any examples of using AES GCM mode? I am trying to use graphene with SoftHSM2 (windows build) and I getting CKR_BUFFER_TOO_SMALL returned on decrypt (unit test). The offending SoftHSM code seems to be here:

c:\build\src\softhsm-2.5.0-x64\src\lib\softhsm.cpp(3256): Output buffer too short ulEncryptedDataLen: 0x10 output buffer size: 0x20 blockSize: 0x10 remainingSize: 0x100 maxSize: 0x110

[microshine]

@tstiemerling Have you seen these tests https://github.com/PeculiarVentures/graphene/blob/master/test/aes.ts#L140-L164?

Here is simple example

const graphene = require("graphene-pk11");
const crypto = require("crypto");

const Module = graphene.Module;

const lib = "/usr/local/lib/softhsm/libsofthsm2.so"; // Path to SoftHSM lib
const slotIndex = 0; // Slot index
const pin = "12345"; // User PIN

const mod = Module.load(lib, "SoftHSM");
mod.initialize();

const slot = mod.getSlots(slotIndex, true);
if (!slot)
  throw new Error("Slot is not found");

const session = slot.open(graphene.SessionFlag.RW_SESSION | graphene.SessionFlag.SERIAL_SESSION);
session.login(pin);

// Generate AES key
const aesKey = session.generateKey(graphene.KeyGenMechanism.AES, {
  keyType: graphene.KeyType.AES,
  valueLen: 256 / 8,
  encrypt: true,
  decrypt: true,
  token: false,
});

// Encrypt data
const iv = crypto.randomBytes(12);
const alg = {
  name: "AES_GCM",
  params: new graphene.AesGcmParams(iv),
};
const cipher = session.createCipher(alg, aesKey);
const data = Buffer.from("Hello World!");
const enc = Buffer.concat([cipher.update(data), cipher.final()]);

// Decrypt data
const decipher = session.createDecipher(alg, aesKey);

const dec = Buffer.concat([decipher.update(enc), decipher.final()]);

console.log("Decrypted data:", dec.toString());

session.logout();
session.close();
mod.finalize();

[tstiemerling]

Thanks for the sample. This fails with the same error as before. I will try on Ubuntu as this may be an issue only with the Windows build of SoftHSM2.

Pkcs11Error: CKR_BUFFER_TOO_SMALL
at prepareError (C:\Users\tstiemerling\Work\hsm\node_modules\pkcs11js\index.js:58:12)
at handleError (C:\Users\tstiemerling\Work\hsm\node_modules\pkcs11js\index.js:67:9)
at PKCS11. (C:\Users\tstiemerling\Work\hsm\node_modules\pkcs11js\index.js:85:7)
at obj. [as C_DecryptFinal] (C:\Users\tstiemerling\Work\hsm\node_modules\pkcs11js\index.js:119:30)
at Decipher.final (C:\Users\tstiemerling\Work\hsm\node_modules\graphene-pk11\build\cjs\crypto\decipher.js:34:30)
at Object. (C:\Users\tstiemerling\Work\hsm\softhsm2\aes-gcm.js:50:44)
at Module._compile (node:internal/modules/cjs/loader:1368:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1426:10)
at Module.load (node:internal/modules/cjs/loader:1205:32)
at Module._load (node:internal/modules/cjs/loader:1021:12) {
method: '',
nativeStack: ' at PKCS11. (C:\Users\tstiemerling\Work\hsm\node_modules\pkcs11js\index.js:77:22)\n' +
' at obj. [as C_DecryptFinal] (C:\Users\tstiemerling\Work\hsm\node_modules\pkcs11js\index.js:119:30)\n' +
' at Decipher.final (C:\Users\tstiemerling\Work\hsm\node_modules\graphene-pk11\build\cjs\crypto\decipher.js:34:30)\n' +
' at Object. (C:\Users\tstiemerling\Work\hsm\softhsm2\aes-gcm.js:50:44)\n' +
' at Module._compile (node:internal/modules/cjs/loader:1368:14)\n' +
' at Module._extensions..js (node:internal/modules/cjs/loader:1426:10)\n' +
' at Module.load (node:internal/modules/cjs/loader:1205:32)\n' +
' at Module._load (node:internal/modules/cjs/loader:1021:12)\n' +
' at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:142:12)\n' +
' at node:internal/main/run_main_module:28:49',
code: 336
}

Node.js v21.7.1

[tstiemerling]

Another data point. If I change the plaintext to be "Hello World!" then the sample succeeds. If I keep it as "Encrypted message" then it fails. Is the message data per update meant to be <= block length?