How to save secret key in the NSS certDB and then retrieve it through Java?

Question

Hi,
I 'm pretty new trying to handle keying material for NSS fips mode.
After following the guidelines from http://java.sun.com/javase/6/docs/technotes/guides/security/p11guide.html#NSS I need my code to use SecretKeyFactory method generateSecret with DESedeKeySpec parameter in the following way:
Provider nss = new sun.security.pkcs11.SunPKCS11(configFileName);
Security.addProvider(nss);
SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DESede", nss);
DESedeKeySpec keySpec = new DESedeKeySpec(new String("abcdefghijklmnopqrstuvw").getBytes("UTF-8"));
SecretKey key = keyFactory.generateSecret(keySpec);
The question is: what are the steps needed to save secret key "abcdefghijklmnopqrstuvw" in NSS certDB in the fips mode (nssModule = fips in pkcs#11 conf. file) and how should it be retrieved in the Java code?
Any help will be appreciated...

Answer 1

OK...I didn't test this in FIPS mode, but it works in keystore mode (which says persistent storage of keys)
KeyGenerator kg = KeyGenerator.getInstance("DESede",nss);
kg.init(192);  //yields 168-bit key
SecretKey tripleDesKey = kg.generateKey();
KeyStore.SecretKeyEntry skEntry = new KeyStore.SecretKeyEntry(tripleDesKey);
ks.setEntry(randAlias, skEntry, new KeyStore.PasswordProtection(password));I was generating some random bytes and base64'ing them to get a random alias on each execution of the program. I'd also loop through and print out the aliases before I generated another key to ensure it was storing the key in between runs which it was.
Command-line proof the keys are in db:
symkeyutil -L -d .
Enter Password or Pin for "NSS Certificate DB":
     Name            Len Strength     Type    Data
NSS Certificate DB:
7i/XoKcaLhU=          24    168         des3  <restricted>
Yzjt7W+AIgc=          24    168         des3  <restricted>
RkOTZssCEQM=          24    168         des3  <restricted>
S2BHRcFUyAA=          24    168         des3  <restricted>
secretKeyAlias        24    168         des3  <restricted>
R/DaVy1z1MM=          24    168         des3  <restricted>
IdpdnIDzOYs=          24    168         des3  <restricted>
SeVASW8PrOc=          24    168         des3  <restricted>
c6Ml/9I7thQ=          24    168         des3  <restricted>Edited by: dstutz on May 15, 2008 12:28 PM
Edit again:
I changed the mode in the cfg file to fips and used modutil to change module to fips mode and it still works...all the keys I created in keystore mode are still there and I can add new ones.
C:\nss>symkeyutil -L -d .
Enter Password or Pin for "NSS FIPS 140-2 Certificate DB":
     Name            Len Strength     Type    Data
NSS FIPS 140-2 Certificate DB:
LmsZDBaaCw8=          24    168         des3  <restricted>
EQaX3wdJ1cY=          24    168         des3  <restricted>
7i/XoKcaLhU=          24    168         des3  <restricted>
Yzjt7W+AIgc=          24    168         des3  <restricted>
RkOTZssCEQM=          24    168         des3  <restricted>
S2BHRcFUyAA=          24    168         des3  <restricted>
secretKeyAlias        24    168         des3  <restricted>
UsY23mwSzEM=          24    168         des3  <restricted>
B/auMw2OTvE=          24    168         des3  <restricted>
coqyCAAJpsk=          24    168         des3  <restricted>
vVBHLg1r3cY=          24    168         des3  <restricted>
R/DaVy1z1MM=          24    168         des3  <restricted>
IdpdnIDzOYs=          24    168         des3  <restricted>
SeVASW8PrOc=          24    168         des3  <restricted>
c6Ml/9I7thQ=          24    168         des3  <restricted>Edited by: dstutz on May 15, 2008 12:56 PM