Hi,

Sorry for the late reply, I could not login to the forum.
Thank you for your previous answer. I could generate the secret as long as I fallback of the software implementation to generate the key pair.

But my purpose is to generate the key pair with my token (Can do) and use the generated public key to create the secret (cannot do).

I manage to use my token to generate the key pair, but it is not possible for me to re-inject the public key into the SSL context after the callback. I am stuck on this for a few weeks...

entry point: cryptocb.c
the key has been initialized but empty in order to let the token generate the public key in the "key" structure.

#ifdef HAVE_ECC
int wc_CryptoCb_MakeEccKey(WC_RNG* rng, int keySize, ecc_key* key, int curveId)
{
    printf("\n wc crypto Make ecc key. keySize= %d  \n", keySize);
    int ret = CRYPTOCB_UNAVAILABLE;
    CryptoCb* dev;

    if (key == NULL)
        return ret;

    /* locate registered callback */
    dev = wc_CryptoCb_FindDevice(key->devId);
    if (dev && dev->cb) {
        wc_CryptoInfo cryptoInfo;
        XMEMSET(&cryptoInfo, 0, sizeof(cryptoInfo));
        cryptoInfo.algo_type = WC_ALGO_TYPE_PK;
        cryptoInfo.pk.type = WC_PK_TYPE_EC_KEYGEN;
        cryptoInfo.pk.eckg.rng = rng;
        cryptoInfo.pk.eckg.size = keySize;
        cryptoInfo.pk.eckg.key = key;
        cryptoInfo.pk.eckg.curveId = curveId;

        ret = dev->cb(dev->devId, &cryptoInfo, dev->ctx);

          printf("\n INSIDE THE CALLBACK....  \n");

         #define FOURK_BUF 4096
            byte  der[FOURK_BUF];
            int derSz = 0;

            derSz = wc_EccKeyToDer(key, der, FOURK_BUF);
            int i;
            for (i = 0; i <= derSz;i++){
                printf("%02x:", der[i]);
                if (((i+1)%16)==0){
                    printf("\n");
                }
            }
            printf("\n");
    }

    return wc_CryptoCb_TranslateErrorCode(ret);
}

in my pkcs11 interface the following code allows me to generate the CKA-points for the public key:

static int Pkcs11EcKeyGen(Pkcs11Session* session, wc_CryptoInfo* info)
{
    int               ret = 0;
    ecc_key*          key = info->pk.eckg.key;

...

rv = session->func->C_GenerateKeyPair(session->handle, &mech,
                                                       pubKeyTmpl, pubTmplCnt,
                                                       privKeyTmpl, privTmplCnt,
                                                       &pubKey, &privKey);

...
Pkcs11GetEccPublicKey(key, session, pubKey);
pkcs11_dump_template(pubKeyTmpl, pubTmplCnt); 

Ecc Public Key
             CKA_EC_POINT: 67
                           0x04,0x41,0x04,0x80,0xf6,0x67,0x7a,0x5b,
                           0xac,0x31,0x25,0xf8,0x2e,0xa7,0xc8,0x32,
                           0x12,0xf9,0xad,0xd9,0x33,0x01,0x6d,0xe0,
                           0x17,0x50,0xcb,0x2d,0x36,0xb1,0x28,0xf6,
                           0x32,0x2a,0xf0,0x55,0x75,0x6e,0xe3,0xc9,
                           0xff,0x7f,0xf4,0x0f,0xe2,0xce,0x4c,0x35,
                           0xbd,0x30,0x92,0x47,0x86,0x0f,0xc3,0x25,
                           0x3f,0xaa,0xeb,0x1c,0xb4,0x58,0x98,0x9a,
                           0x5e,0x02,0x1a,
            CKA_EC_PARAMS: 10
                           0x06,0x08,0x2a,0x86,0x48,0xce,0x3d,0x03,
                           0x01,0x07,

from here, the key structure must have the public key. I can print the public key CKA points just nice as expected.

When this function ends I am going back to the callback (first sample of the code above.)

And then I try to display the public key after the printf : printf("\n INSIDE THE CALLBACK....  \n");
But i always get error -173 =>     BAD_FUNC_ARG       = -173,  /* Bad function argument provided */

INSIDE THE CALLBACK....
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:

So I believe the public key is not getting updated in the 'ecc_key' structure. it is quite hard to debug.

inside the Pkcs11 implementation i have tried to:

-check the "ecc_key key" with:

check_result = wc_ecc_check_key(key);

-> success
           

- Copy the point from the template that display the CKA points to the "ecc_key key" structure.

point = wc_ecc_new_point();
int copy_return = wc_ecc_copy_point(&key->pubkey,  &info->pk.eckg.key->pubkey);

-> success.

- Compare the CKA points inside the "ecc_key key" with:

 int cmp_result = wc_ecc_cmp_point(&key->pubkey, &info->pk.eckg.key->pubkey);

-> success

- Export the points into byte array to print them with:

       word32 buffSz = 64;
        byte  der[buffSz];
        XMEMSET(der, 0, sizeof(der));
        wc_ecc_export_point_der(key->dp->id, &key->pubkey, der,  &buffSz);

->  not successful

I am short of idea, I am not sure where the keys goes and in which format the key is represented.

Any help would highly appreciated.