Digital Sign A Document with Apache Poi by HSM

Question

I try to sign a Office Document with HSM in java. When I use p12 or pfx file. Sign success and no problem. But when I try to use HSM (Utimaco) to do that, I have a Exeption: java.lang.UnsupportedOperationException: Private Exponent value is sensitive. May be in Apache Poi, load private key from HSM is not allowed. I can sign pdf( with itext) ỏ sign XML with HSM => no problem

What should I do in this case?

I hope someone have solution for my case and help me. Thank so much!

Answer 1

This is my method to connect HSM by IAIK. I use sample sign document of POI in github.

public IAIKPkcs11 initProvider() throws KMSException {
    Properties pkcs11ProviderConfig = new Properties();
    pkcs11ProviderConfig.setProperty(Constants.PKCS11_NATIVE_MODULE, pkcs11Module);
    Module pkcs11Module = IAIKPkcs11.getModule(pkcs11ProviderConfig);
    try {
        log.info(" ********** Connect HSM **********");
        log.info(" **/  PKCS#11 Module: " + pkcs11Module + "  /**");
        log.info(" **/  Slot Label: " + slotLabel + "  /**");
        log.info(" **/  Slot Pin: " + StringCommon.hidePinCode(slotPin) + "  /**");
        Slot[] slotList = pkcs11Module.getSlotList(Module.SlotRequirement.ALL_SLOTS);
        Integer slotIndex = null;
        String slotID = "";
        for (int i = 0; i < slotList.length; i++) {
            if (!StringUtils.isBlank(slotList[i].getToken().getTokenInfo().getLabel())
                    && slotLabel.trim().equals(slotList[i].getToken().getTokenInfo().getLabel().trim())) {
                slotIndex = i;
                break;
            }
        }
        slotID = "[" + String.valueOf(slotIndex) + "]";
        pkcs11ProviderConfig.setProperty(Constants.SLOT_ID, slotID);
        pkcs11ProviderConfig.setProperty(Constants.USER_PIN, slotPin);
        IAIKPkcs11 pkcs11Provider = new IAIKPkcs11(pkcs11ProviderConfig);
        Security.addProvider(pkcs11Provider);
        log.info(" **/  Provider Info: " + pkcs11Provider + "  /**");
        log.info(" ********** Connect HSM **********");
        return pkcs11Provider;
    } catch (Exception e) {
        // TODO: handle exception
        Sentry.captureException(e);
        log.error(e.getMessage());
        throw new KMSException(ErrorCode.ERROR_CONNECT_HSM, e.getMessage());
    }
}

And this is sign method:

OPCPackage pkg = null;
                        try {
                            pkg = OPCPackage.open(tempDoc);
                        } catch (InvalidFormatException ex) {
                            ex.printStackTrace();
                        }
                        Provider provider = null;
                        if (StringUtils.equalsIgnoreCase(env.getProperty("hsm.test"), Constant.TRUE)) {
                            provider = new BouncyCastleProvider();
                            Security.addProvider(provider);
                        } else {
                            ProviderConfig providerConfig = new ProviderConfig(cryptoSource.getModule(), cryptoSource.getSlot(),
                                    cryptoSource.getPin());
                            provider = providerConfig.getProvider();
                            Security.addProvider(provider);
                        }
                        SignatureConfig sic = new SignatureConfig();
                        sic.setKey(keyAndCert.getPrivateKey());
                       sic.setSigningCertificateChain(Collections.singletonList(keyAndCert.getCertificate()));
                        sic.setIncludeEntireCertificateChain(false);
                        sic.setSignatureDescription("Thích");
                        sic.setExecutionTime(new Date());

                        SignatureInfo si = new SignatureInfo();
                        si.setSignatureConfig(sic);
                        si.setOpcPackage(pkg);
                        si.confirmSignature();

                       boolean b = si.verifySignature();
                       assert (b);
                        pkg.close();
                        byte[] bFile = FileUtils.readFileToByteArray(new File(tempDoc));
                        if (StringUtils.equalsIgnoreCase(env.getProperty("hsm.test"), Constant.TRUE)) {

                            String DEST = "F://" + UUID.randomUUID() + ".doc";
                            File f = new File(DEST);
                            FileOutputStream outputStream = new FileOutputStream(f);
                            outputStream.write(bFile);
                            outputStream.flush();
                            outputStream.close();
                        }