djb-eapim/elink-online-common
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: SafeNet HSM 연동 구현 (JDK 8 / SunPKCS11)

Browse Source 
- HsmManager: SunPKCS11 Provider 초기화, Lifecycle 관리
  - JDK 8 / JDK 9+ 분기를 리플렉션으로 처리하는 createProvider() 추가
  - PropManager DB에서 PKCS11_CONFIG / PIN 읽어 초기화
- HsmCryptoService: RSA / AES 암복호화 서비스
  - encryptRsa: 공개키 기반 JVM 소프트웨어 암호화
  - decryptRsa: HSM 내부 복호화 (미초기화 시 HsmException 발생)
  - encryptAes / decryptAes: AES/CBC/PKCS5Padding
- HsmException: HSM 전용 커스텀 예외
- pkcs11-dev.cfg: SoftHSM2용 (slotListIndex = 0)
- pkcs11-prod.cfg: SafeNet ProtectServer 운영용 (slot = 0)
- HsmSoftHsm2IntegrationTest: 저수준 PKCS11 직접 테스트 (8개)
- HsmManagerServiceTest: HsmManager/HsmCryptoService 경유 테스트 (8개)
  Mockito + GenericApplicationContext로 DB 없이 실행 가능

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
curry772
2026-04-28 20:52:14 +09:00
parent 81f7898eb1
commit acdb58049c
7 changed files with 1008 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/com/eactive/eai/common/hsm/HsmManagerServiceTest.java
+304
View File
@@ -0,0 +1,304 @@
package com.eactive.eai.common.hsm;
import static org.junit.jupiter.api.Assertions.*;
import static org.junit.jupiter.api.Assumptions.assumeTrue;
import java.io.File;
import java.io.InputStream;
import java.lang.reflect.Constructor;
import java.nio.file.Files;
import java.security.PublicKey;
import java.util.concurrent.TimeUnit;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.MethodOrderer;
import org.junit.jupiter.api.Order;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.TestMethodOrder;
import org.mockito.Mockito;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.context.support.GenericApplicationContext;
import com.eactive.eai.common.property.PropManager;
import com.eactive.eai.common.util.ApplicationContextProvider;
/**
* HsmManager / HsmCryptoService 통합 테스트 (JDK 8 / SunPKCS11 / SoftHSM2)
*
* 사전 조건:
* SoftHSM2 설치: https://github.com/disig/SoftHSM2-for-Windows/releases
* → C:\SoftHSM2 에 설치 (미설치 시 테스트 자동 건너뜀)
*
* PropManager 는 DB 없이 Mockito Mock 으로 대체하여 테스트합니다.
*/
@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
public class HsmManagerServiceTest {
private static final String SOFTHSM2_DLL = "C:/SoftHSM2/lib/softhsm2-x64.dll";
private static final String SOFTHSM2_UTIL = "C:/SoftHSM2/bin/softhsm2-util.exe";
private static final String TOKEN_LABEL = "eapim-test";
private static final String PIN = "1234";
private static final String RSA_ALIAS = "test-rsa-key";
private static final String AES_ALIAS = "test-aes-key";
private static HsmManager hsmManager;
private static HsmCryptoService hsmCryptoService;
private static GenericApplicationContext springContext;
private static File tempCfgFile;
// -------------------------------------------------------------------------
// 설정 / 해제
// -------------------------------------------------------------------------
@BeforeAll
static void setUp() throws Exception {
System.setProperty("SOFTHSM2_CONF", "C:\\SoftHSM2\\etc\\softhsm2.conf");
assumeTrue(new File(SOFTHSM2_DLL).exists(),
"SoftHSM2 미설치 (C:/SoftHSM2) - 테스트 건너뜀");
// 1. 토큰 초기화 (없으면 신규 생성, 있으면 기존 사용)
ensureTokenInitialized();
// 2. PKCS11 설정 문자열 구성 (slotListIndex = 0 → 첫 번째 초기화 토큰)
String cfgContent = "name = SoftHSM\n"
+ "library = " + SOFTHSM2_DLL.replace("\\", "/") + "\n"
+ "slotListIndex = 0\n";
// keytool 호출 시 파일 경로가 필요하므로 임시 파일에도 저장
tempCfgFile = File.createTempFile("pkcs11-svc-test-", ".cfg");
Files.write(tempCfgFile.toPath(), cfgContent.getBytes("UTF-8"));
// 3. PropManager Mock - DB 없이 HSM 설정값 반환
PropManager mockPropManager = Mockito.mock(PropManager.class);
Mockito.when(mockPropManager.getProperty("HSM", "PKCS11_CONFIG")).thenReturn(cfgContent);
Mockito.when(mockPropManager.getProperty("HSM", "PIN")).thenReturn(PIN);
// 4. HsmManager 인스턴스 생성 (private 생성자 → 리플렉션)
Constructor<HsmManager> ctor = HsmManager.class.getDeclaredConstructor();
ctor.setAccessible(true);
hsmManager = ctor.newInstance();
// 5. Spring ApplicationContext 구성
// ApplicationContextProvider.context 를 세팅하여
// HsmManager.getInstance() / PropManager.getInstance() 가 동작하게 함
springContext = new GenericApplicationContext();
springContext.getBeanFactory().registerSingleton("propManager", mockPropManager);
springContext.getBeanFactory().registerSingleton("hsmManager", hsmManager);
springContext.registerBeanDefinition("applicationContextProvider",
BeanDefinitionBuilder.genericBeanDefinition(ApplicationContextProvider.class)
.getBeanDefinition());
springContext.refresh();
// 6. HsmManager 시작 (SunPKCS11 Provider 초기화 + KeyStore 오픈)
hsmManager.start();
assertTrue(hsmManager.isReady(), "HsmManager 초기화 실패");
System.out.println("[HsmManager] 초기화 완료. provider=" + hsmManager.getPkcs11Provider().getName());
// 7. RSA 키쌍 생성 (없는 경우에만)
if (!hsmManager.getKeyStore().containsAlias(RSA_ALIAS)) {
generateRsaKeyPair();
hsmManager.getKeyStore().load(null, PIN.toCharArray()); // keytool 결과 반영
}
// 8. AES 키 생성 (없는 경우에만)
if (!hsmManager.getKeyStore().containsAlias(AES_ALIAS)) {
generateAesKey();
}
// 9. HsmCryptoService 생성 (HsmManager.getInstance() 를 내부에서 사용)
hsmCryptoService = new HsmCryptoService();
}
@AfterAll
static void tearDown() throws Exception {
if (hsmManager != null && hsmManager.isStarted()) {
hsmManager.stop();
}
if (springContext != null) {
springContext.close();
}
if (tempCfgFile != null) {
tempCfgFile.delete();
}
}
// -------------------------------------------------------------------------
// 테스트: HsmManager 상태
// -------------------------------------------------------------------------
@Test
@Order(1)
void testHsmManagerReady() {
assertTrue(hsmManager.isReady());
assertNotNull(hsmManager.getPkcs11Provider());
assertNotNull(hsmManager.getKeyStore());
System.out.println("[HsmManager] isReady=true / provider="
+ hsmManager.getPkcs11Provider().getName());
}
// -------------------------------------------------------------------------
// 테스트: HsmCryptoService - 키 조회
// -------------------------------------------------------------------------
@Test
@Order(2)
void testGetPublicKey() throws Exception {
PublicKey pk = hsmCryptoService.getPublicKey(RSA_ALIAS);
assertNotNull(pk);
assertEquals("RSA", pk.getAlgorithm());
System.out.println("[HsmCryptoService] getPublicKey: algorithm=" + pk.getAlgorithm()
+ " / format=" + pk.getFormat());
}
@Test
@Order(3)
void testGetSecretKey() throws Exception {
SecretKey sk = hsmCryptoService.getSecretKey(AES_ALIAS);
assertNotNull(sk);
assertEquals("AES", sk.getAlgorithm());
System.out.println("[HsmCryptoService] getSecretKey: algorithm=" + sk.getAlgorithm());
}
// -------------------------------------------------------------------------
// 테스트: HsmCryptoService - RSA 암복호화
// -------------------------------------------------------------------------
@Test
@Order(4)
void testEncryptRsaByAlias() throws Exception {
byte[] plaintext = "RSA alias 암호화 테스트".getBytes("UTF-8");
byte[] ciphertext = hsmCryptoService.encryptRsa(RSA_ALIAS, plaintext);
assertNotNull(ciphertext);
assertTrue(ciphertext.length > 0);
System.out.println("[HsmCryptoService] encryptRsa(alias): ciphertext.length=" + ciphertext.length);
}
@Test
@Order(5)
void testEncryptRsaByPublicKey() throws Exception {
PublicKey pk = hsmCryptoService.getPublicKey(RSA_ALIAS);
byte[] plaintext = "RSA PublicKey 직접 암호화 테스트".getBytes("UTF-8");
byte[] ciphertext = hsmCryptoService.encryptRsa(pk, plaintext);
assertNotNull(ciphertext);
assertTrue(ciphertext.length > 0);
System.out.println("[HsmCryptoService] encryptRsa(PublicKey): ciphertext.length=" + ciphertext.length);
}
@Test
@Order(6)
void testRsaRoundTrip() throws Exception {
byte[] plaintext = "HSM RSA 암복호화 통합 테스트 - HsmCryptoService".getBytes("UTF-8");
// 암호화: 공개키 → JVM 소프트웨어 (encryptRsa 내부에서 Provider 미명시)
byte[] ciphertext = hsmCryptoService.encryptRsa(RSA_ALIAS, plaintext);
// 복호화: 개인키 핸들 → HSM 내부 (decryptRsa 내부에서 pkcs11Provider 명시)
byte[] decrypted = hsmCryptoService.decryptRsa(RSA_ALIAS, PIN.toCharArray(), ciphertext);
assertArrayEquals(plaintext, decrypted);
System.out.println("[HsmCryptoService] RSA 암복호화 성공: " + new String(decrypted, "UTF-8"));
}
// -------------------------------------------------------------------------
// 테스트: HsmCryptoService - AES 암복호화
// -------------------------------------------------------------------------
@Test
@Order(7)
void testAesRoundTrip() throws Exception {
byte[] plaintext = "HSM AES 암복호화 통합 테스트 - HsmCryptoService".getBytes("UTF-8");
byte[] iv = "1234567890123456".getBytes("UTF-8"); // 16바이트
SecretKey sk = hsmCryptoService.getSecretKey(AES_ALIAS);
byte[] ciphertext = hsmCryptoService.encryptAes(sk, iv, plaintext);
byte[] decrypted = hsmCryptoService.decryptAes(sk, iv, ciphertext);
assertArrayEquals(plaintext, decrypted);
System.out.println("[HsmCryptoService] AES 암복호화 성공: " + new String(decrypted, "UTF-8"));
}
// -------------------------------------------------------------------------
// 테스트: HsmManager Lifecycle - stop / restart
// -------------------------------------------------------------------------
@Test
@Order(8)
void testHsmManagerStopAndRestart() throws Exception {
// stop
hsmManager.stop();
assertFalse(hsmManager.isStarted());
assertFalse(hsmManager.isReady());
System.out.println("[HsmManager] stop 완료");
// restart - PropManager Mock 에서 재설정 읽어 재초기화
hsmManager.start();
assertTrue(hsmManager.isStarted());
assertTrue(hsmManager.isReady());
System.out.println("[HsmManager] restart 완료. provider="
+ hsmManager.getPkcs11Provider().getName());
}
// -------------------------------------------------------------------------
// 헬퍼
// -------------------------------------------------------------------------
private static void ensureTokenInitialized() throws Exception {
ProcessBuilder pb = new ProcessBuilder(
SOFTHSM2_UTIL, "--init-token", "--free",
"--label", TOKEN_LABEL,
"--pin", PIN,
"--so-pin", PIN);
pb.redirectErrorStream(true);
Process p = pb.start();
String out = readOutput(p);
p.waitFor(10, TimeUnit.SECONDS);
System.out.println("[SoftHSM2] init-token: " + out.trim());
}
private static void generateRsaKeyPair() throws Exception {
ProcessBuilder pb = new ProcessBuilder(
"keytool", "-genkeypair",
"-alias", RSA_ALIAS,
"-keyalg", "RSA",
"-keysize", "2048",
"-storetype", "PKCS11",
"-providerclass", "sun.security.pkcs11.SunPKCS11",
"-providerarg", tempCfgFile.getAbsolutePath(),
"-keystore", "NONE",
"-storepass", PIN,
"-dname", "CN=HSM Test, O=eActive, C=KR",
"-noprompt");
pb.redirectErrorStream(true);
Process p = pb.start();
String out = readOutput(p);
if (!p.waitFor(30, TimeUnit.SECONDS)) {
p.destroy();
throw new RuntimeException("keytool -genkeypair timeout");
}
System.out.println("[keytool] genkeypair exit=" + p.exitValue() + ": " + out.trim());
}
private static void generateAesKey() throws Exception {
KeyGenerator kg = KeyGenerator.getInstance("AES", hsmManager.getPkcs11Provider());
kg.init(256);
SecretKey sk = kg.generateKey();
hsmManager.getKeyStore().setKeyEntry(AES_ALIAS, sk, null, null);
System.out.println("[HsmManager] AES-256 키 생성 완료. alias=" + AES_ALIAS);
}
private static String readOutput(Process p) throws Exception {
InputStream is = p.getInputStream();
byte[] buf = new byte[4096];
StringBuilder sb = new StringBuilder();
int len;
while ((len = is.read(buf)) != -1) {
sb.append(new String(buf, 0, len, "UTF-8"));
}
return sb.toString();
}
}
src/test/java/com/eactive/eai/common/hsm/HsmSoftHsm2IntegrationTest.java
+310
View File
@@ -0,0 +1,310 @@
package com.eactive.eai.common.hsm;
import static org.junit.jupiter.api.Assertions.assertArrayEquals;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertInstanceOf;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assumptions.assumeTrue;
import java.io.File;
import java.io.InputStream;
import java.nio.file.Files;
import java.security.Key;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.Provider;
import java.security.PublicKey;
import java.security.Security;
import java.security.cert.Certificate;
import java.util.concurrent.TimeUnit;
import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.MethodOrderer;
import org.junit.jupiter.api.Order;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.TestMethodOrder;
/**
* SoftHSM2 연동 통합 테스트 (JDK 8 / SunPKCS11)
*
* 사전 조건:
* 1. SoftHSM2 설치: https://github.com/disig/SoftHSM2-for-Windows/releases
* → SoftHSM2-*-x64.msi 다운로드 후 C:\SoftHSM2 에 설치
* 2. 토큰 초기화 (최초 1회):
* "C:\SoftHSM2\bin\softhsm2-util.exe" --init-token --free --label "eapim-test" --pin 1234 --so-pin 1234
* → 이미 초기화된 경우 @BeforeAll 에서 자동 처리
*
* SoftHSM2 미설치 시 모든 테스트는 자동으로 건너뜀.
*/
@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
public class HsmSoftHsm2IntegrationTest {
private static final String SOFTHSM2_DLL = "C:/SoftHSM2/lib/softhsm2-x64.dll";
private static final String SOFTHSM2_UTIL = "C:/SoftHSM2/bin/softhsm2-util.exe";
private static final String TOKEN_LABEL = "eapim-test";
private static final String PIN = "1234";
private static final String RSA_ALIAS = "test-rsa-key";
private static final String AES_ALIAS = "test-aes-key";
private static Provider provider;
private static KeyStore keyStore;
private static File tempCfgFile;
// -------------------------------------------------------------------------
// 설정 / 해제
// -------------------------------------------------------------------------
@BeforeAll
static void setUpHsm() throws Exception {
System.setProperty("SOFTHSM2_CONF", "C:\\SoftHSM2\\etc\\softhsm2.conf");
assumeTrue(new File(SOFTHSM2_DLL).exists(),
"SoftHSM2 미설치 (C:/SoftHSM2) - 테스트 건너뜀");
// 1. 토큰 초기화 (이미 존재하면 출력만 남기고 계속 진행)
initToken();
// 2. pkcs11 설정 내용 (slotListIndex = 0 → 첫 번째 초기화된 토큰 사용)
String cfgContent = "name = SoftHSM\n"
+ "library = " + SOFTHSM2_DLL.replace("\\", "/") + "\n"
+ "slotListIndex = 0\n";
// keytool 은 파일 경로를 요구하므로 임시 파일에도 저장
tempCfgFile = File.createTempFile("pkcs11-test-", ".cfg");
Files.write(tempCfgFile.toPath(), cfgContent.getBytes("UTF-8"));
// 3. SunPKCS11 Provider 초기화 (JDK 8 / JDK 9+ 공용)
provider = HsmManager.createProvider(cfgContent);
Provider existing = Security.getProvider(provider.getName());
if (existing != null) {
Security.removeProvider(existing.getName());
}
Security.addProvider(provider);
// 4. PKCS11 KeyStore 오픈
keyStore = KeyStore.getInstance("PKCS11", provider);
keyStore.load(null, PIN.toCharArray());
// 5. RSA 키쌍 생성 (keytool 경유 → 자체서명 인증서 포함)
if (!keyStore.containsAlias(RSA_ALIAS)) {
generateRsaKeyPair();
keyStore.load(null, PIN.toCharArray()); // keytool 결과 반영
}
// 6. AES 키 생성 (KeyGenerator 경유)
if (!keyStore.containsAlias(AES_ALIAS)) {
generateAesKey();
}
}
@AfterAll
static void tearDown() {
if (provider != null) {
Security.removeProvider(provider.getName());
}
if (tempCfgFile != null) {
tempCfgFile.delete();
}
}
// -------------------------------------------------------------------------
// 테스트: Provider / KeyStore
// -------------------------------------------------------------------------
@Test
@Order(1)
void testProviderInitialized() {
assertNotNull(provider);
assertTrue(provider.getName().startsWith("SunPKCS11"),
"예상 Provider 이름: SunPKCS11-*, 실제: " + provider.getName());
System.out.println("[HSM] Provider: " + provider.getName()
+ " / version: " + provider.getVersion());
}
@Test
@Order(2)
void testKeyStoreContainsRsaAlias() throws Exception {
assertTrue(keyStore.containsAlias(RSA_ALIAS),
"RSA 키 없음. alias=" + RSA_ALIAS);
}
@Test
@Order(3)
void testKeyStoreContainsAesAlias() throws Exception {
assertTrue(keyStore.containsAlias(AES_ALIAS),
"AES 키 없음. alias=" + AES_ALIAS);
}
// -------------------------------------------------------------------------
// 테스트: 키 조회 (HsmCryptoService.getPublicKey / getSecretKey 해당)
// -------------------------------------------------------------------------
@Test
@Order(4)
void testGetPublicKey() throws Exception {
Certificate cert = keyStore.getCertificate(RSA_ALIAS);
assertNotNull(cert, "인증서 없음. alias=" + RSA_ALIAS);
PublicKey pk = cert.getPublicKey();
assertNotNull(pk);
assertEquals("RSA", pk.getAlgorithm());
System.out.println("[HSM] PublicKey algorithm=" + pk.getAlgorithm()
+ " / format=" + pk.getFormat());
}
@Test
@Order(5)
void testGetSecretKey() throws Exception {
Key key = keyStore.getKey(AES_ALIAS, null);
assertNotNull(key, "AES 키 없음. alias=" + AES_ALIAS);
assertInstanceOf(SecretKey.class, key);
assertEquals("AES", key.getAlgorithm());
System.out.println("[HSM] SecretKey algorithm=" + key.getAlgorithm());
}
// -------------------------------------------------------------------------
// 테스트: RSA 암복호화 (HsmCryptoService.encryptRsa / decryptRsa 해당)
// -------------------------------------------------------------------------
@Test
@Order(6)
void testRsaEncrypt() throws Exception {
PublicKey publicKey = keyStore.getCertificate(RSA_ALIAS).getPublicKey();
// Provider 미명시 → JVM SunRsaSign 으로 암호화 (HsmCryptoService.encryptRsa 동작)
Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
byte[] ciphertext = cipher.doFinal("테스트 평문".getBytes("UTF-8"));
assertNotNull(ciphertext);
assertTrue(ciphertext.length > 0);
System.out.println("[HSM] RSA 암호화 성공. ciphertext.length=" + ciphertext.length
+ " / provider=" + cipher.getProvider().getName());
}
@Test
@Order(7)
void testRsaEncryptDecryptRoundTrip() throws Exception {
byte[] plaintext = "HSM RSA 암복호화 테스트 - eapim-online".getBytes("UTF-8");
// 암호화: 공개키 → JVM 소프트웨어 (Provider 미명시)
PublicKey publicKey = keyStore.getCertificate(RSA_ALIAS).getPublicKey();
Cipher encCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
encCipher.init(Cipher.ENCRYPT_MODE, publicKey);
byte[] ciphertext = encCipher.doFinal(plaintext);
// 복호화: 개인키 핸들 → HSM 내부 수행 (pkcs11Provider 명시)
PrivateKey privateKey = (PrivateKey) keyStore.getKey(RSA_ALIAS, PIN.toCharArray());
Cipher decCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", provider);
decCipher.init(Cipher.DECRYPT_MODE, privateKey);
byte[] decrypted = decCipher.doFinal(ciphertext);
assertArrayEquals(plaintext, decrypted);
System.out.println("[HSM] RSA 암복호화 성공."
+ " enc.provider=" + encCipher.getProvider().getName()
+ " / dec.provider=" + decCipher.getProvider().getName()
+ " / plaintext=" + new String(decrypted, "UTF-8"));
}
// -------------------------------------------------------------------------
// 테스트: AES 암복호화 (HsmCryptoService.encryptAes / decryptAes 해당)
// -------------------------------------------------------------------------
@Test
@Order(8)
void testAesEncryptDecryptRoundTrip() throws Exception {
byte[] plaintext = "HSM AES 암복호화 테스트 - eapim-online".getBytes("UTF-8");
byte[] iv = "1234567890123456".getBytes("UTF-8"); // 16바이트 IV
SecretKey secretKey = (SecretKey) keyStore.getKey(AES_ALIAS, null);
// 암호화
Cipher encCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
encCipher.init(Cipher.ENCRYPT_MODE, secretKey, new IvParameterSpec(iv));
byte[] ciphertext = encCipher.doFinal(plaintext);
// 복호화
Cipher decCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
decCipher.init(Cipher.DECRYPT_MODE, secretKey, new IvParameterSpec(iv));
byte[] decrypted = decCipher.doFinal(ciphertext);
assertArrayEquals(plaintext, decrypted);
System.out.println("[HSM] AES 암복호화 성공. plaintext=" + new String(decrypted, "UTF-8"));
}
// -------------------------------------------------------------------------
// 헬퍼
// -------------------------------------------------------------------------
private static void initToken() throws Exception {
ProcessBuilder pb = new ProcessBuilder(
SOFTHSM2_UTIL, "--init-token", "--free",
"--label", TOKEN_LABEL,
"--pin", PIN,
"--so-pin", PIN);
pb.redirectErrorStream(true);
Process p = pb.start();
String output = readOutput(p);
p.waitFor(10, TimeUnit.SECONDS);
// 이미 초기화된 슬롯이 없으면 실패할 수 있으나 무시 (기존 토큰 재사용)
System.out.println("[SoftHSM2] init-token: " + output.trim());
}
/**
* keytool 로 RSA 키쌍 + 자체서명 인증서를 PKCS11 토큰에 생성.
* 인증서가 있어야 PKCS11 KeyStore 에서 alias 로 조회 가능.
*/
private static void generateRsaKeyPair() throws Exception {
ProcessBuilder pb = new ProcessBuilder(
"keytool", "-genkeypair",
"-alias", RSA_ALIAS,
"-keyalg", "RSA",
"-keysize", "2048",
"-storetype", "PKCS11",
"-providerclass", "sun.security.pkcs11.SunPKCS11",
"-providerarg", tempCfgFile.getAbsolutePath(),
"-keystore", "NONE",
"-storepass", PIN,
"-dname", "CN=HSM Test, O=eActive, C=KR",
"-noprompt");
pb.redirectErrorStream(true);
Process p = pb.start();
String output = readOutput(p);
boolean finished = p.waitFor(30, TimeUnit.SECONDS);
if (!finished) {
p.destroy();
throw new RuntimeException("keytool -genkeypair timeout");
}
System.out.println("[keytool] genkeypair exit=" + p.exitValue() + ": " + output.trim());
}
/**
* KeyGenerator 로 AES-256 키를 HSM 토큰에 직접 생성.
* SoftHSM2 의 AES 키는 기본적으로 extractable(추출 가능).
*/
private static void generateAesKey() throws Exception {
KeyGenerator kg = KeyGenerator.getInstance("AES", provider);
kg.init(256);
SecretKey sk = kg.generateKey();
keyStore.setKeyEntry(AES_ALIAS, sk, null, null);
System.out.println("[HSM] AES-256 키 생성 완료. alias=" + AES_ALIAS);
}
private static String readOutput(Process p) throws Exception {
InputStream is = p.getInputStream();
byte[] buf = new byte[4096];
StringBuilder sb = new StringBuilder();
int len;
while ((len = is.read(buf)) != -1) {
sb.append(new String(buf, 0, len, "UTF-8"));
}
return sb.toString();
}
}