How to use the same keypair for both encrypt/decryprt-SunPKCS#11

Question

Dear All,
Subject: To access iKey 2032 token, to retrieve public/private key from iKey 2032 token using pkcs#11 in sdk1.5, to encrypt/decrypt files.
When I separate the encrypt and decrypt part of java program, encryption program works well, whereas decryption program does not decrypt anything in the decrypt file (But there is no error). I printed out the public and private key in both encrypt and decrypt part of java program, its displayed differently::
Encrypt program:
SunPKCS11-rainbow_token RSA public key, 1024 bits (id 10, session object)
modulus: 114338469922835728259534620463489934081917342509275191892563243582065
74380495029336519036972702864998634664269499641616889325482699399559620370181624
72068116957594402738459932902481604823224406859575930392708524033619120886256353
58738237376491107769961041015109436347533548940674900728805627968145581222172729
public exponent: 65537
SunPKCS11-rainbow_token RSA private key, 1024 bits (id 11, session object, sensi
tive, unextractable)
Decrypt Program::
SunPKCS11-rainbow_token RSA public key, 1024 bits (id 12, session object)
modulus: 138556361758970660122782926386849783732271581948935425587968692317930
09262429353977097956605140384961825974398004270547046620971835394362397699233738
54481804748731546655197744692886754946373745924825650876065903334173666990347814
83727290962956934521650035029131176614982652900659797194703065074407857754883163
public exponent: 65537
SunPKCS11-rainbow_token RSA private key, 1024 bits (id 13, session object, sensi
tive, unextractable)
I suspect that every time program generates different set of key, therefore we need to store the generated key during encryption part (i believe it is to be in the keystore) and to use the same for decryption part. Could you please give me a tips how to do this?
Encrypt Program ::
import java.io.*;
import java.util.*;
import java.lang.*;
import java.sql.*;
import java.text.*;
import java.math.*;
import java.security.*;
import java.security.cert.*;
import java.security.interfaces.*;
import javax.crypto.interfaces.*;
import javax.net.ssl.*;
import javax.crypto.*;
import javax.crypto.spec.DESKeySpec;
import java.security.KeyStore.*;
* A class of Encrypt.
public class Encrypt
public Encrypt(){}
public void loginToken() {
     Provider p = new sun.security.pkcs11.SunPKCS11(MQConfig.getvalue("SecurityPropertyPath"));
     Security.addProvider(p);
     KeyStore ks = null;
     try{
          String password = General.ReadFiles(MQConfig.getvalue("logFilePath"),"Simple");
          password = password.trim();
          char pin[] = password.toCharArray();
          ks = KeyStore.getInstance("pkcs11");
          ks.load(null,pin);
     KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA",p);
          KeyPair kp = kpg.genKeyPair();
          kpg.initialize(1024, new java.security.SecureRandom());
          FileInputStream in = new FileInputStream("C:\\ReportDBBE.properties");
          FileOutputStream out = new FileOutputStream("C:\\ReportDBAE.properties");
          Cipher cp=Cipher.getInstance("RSA/ECB/PKCS1Padding", p);
          cp.init(cp.ENCRYPT_MODE,kp.getPublic());
          CipherOutputStream cout=new CipherOutputStream(out,cp);
          byte[] input=new byte[8];
          int byteread=in.read(input);
          while(byteread!=-1){
               cout.write(input,0,byteread);
               byteread=in.read(input);
          cout.flush();
          in.close();
          cout.close();
     catch(NoSuchAlgorithmException nsae)
     System.out.println("No Such Algorithm Exception " + nsae.getMessage());
     catch(NoSuchPaddingException nspe)
     System.out.println("No Such Padding Exception " + nspe.getMessage());
     catch(InvalidKeyException ike)
     System.out.println("Invalid Key Exception " + ike.getMessage());
     catch(IllegalStateException ise)
     System.out.println("Illegal State Exception " + ise.getMessage());
     catch(KeyStoreException kse)
     System.out.println("Key Store Exception " + kse.getMessage());
     catch(CertificateException ce)
     System.out.println("Certificate Exception " + ce.getMessage());
     catch(IOException ioe)
     System.out.println("IO Exception " + ioe.getMessage());
public static void main (String args[]) throws Exception {
     try{
     Encrypt tl = new Encrypt();
     tl.loginToken();
     }catch(Exception e){
     e.printStackTrace();
Decrypt Program ::
import java.io.*;
import java.util.*;
import java.lang.*;
import java.sql.*;
import java.text.*;
import java.math.*;
import java.security.*;
import java.security.cert.*;
import java.security.interfaces.*;
import javax.crypto.interfaces.*;
import javax.net.ssl.*;
import javax.crypto.*;
import javax.crypto.spec.DESKeySpec;
import java.security.KeyStore.*;
* A class of Decrypt.
public class Decrypt
public Decrypt(){}
public void loginToken() {
     Provider p = new sun.security.pkcs11.SunPKCS11(MQConfig.getvalue("SecurityPropertyPath"));
     Security.addProvider(p);
     KeyStore ks = null;
     try{
          String password = General.ReadFiles(MQConfig.getvalue("logFilePath"),"Simple");
          password = password.trim();
          char pin[] = password.toCharArray();
          ks = KeyStore.getInstance("pkcs11");
          ks.load(null,pin);
     KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA",p);
          KeyPair kp = kpg.genKeyPair();
          kpg.initialize(1024, new java.security.SecureRandom());
          FileInputStream in1 = new FileInputStream("C:\\ReportDBAE.properties");
          FileOutputStream out1 = new FileOutputStream("C:\\ReportDBAD.properties");
          Cipher cipher=Cipher.getInstance("RSA/ECB/PKCS1Padding", p);
          AlgorithmParameters algParams = cipher.getParameters();
          cipher.init(Cipher.DECRYPT_MODE,kp.getPrivate(),algParams);
          CipherInputStream cin1=new CipherInputStream(in1,cipher);
          byte[] input1=new byte[8];
          int byteread1=cin1.read(input1);
          while(byteread1!=-1){
               out1.write(input1,0,byteread1);
               byteread1=cin1.read(input1);
          out1.flush();
          in1.close();
          out1.close();
          cin1.close();
     catch(NoSuchAlgorithmException nsae)
     System.out.println("No Such Algorithm Exception " + nsae.getMessage());
     catch(NoSuchPaddingException nspe)
     System.out.println("No Such Padding Exception " + nspe.getMessage());
     catch(InvalidKeyException ike)
     System.out.println("Invalid Key Exception " + ike.getMessage());
     catch(IllegalStateException ise)
     System.out.println("Illegal State Exception " + ise.getMessage());
     catch(InvalidAlgorithmParameterException iape)
     System.out.println("Invalid Algorithm ParameterException " + iape.getMessage());
     catch(KeyStoreException kse)
     System.out.println("Key Store Exception " + kse.getMessage());
     catch(CertificateException ce)
     System.out.println("Certificate Exception " + ce.getMessage());
     catch(IOException ioe)
     System.out.println("IO Exception " + ioe.getMessage());
public static void main (String args[]) throws Exception {
     try{
     Decrypt tl = new Decrypt();
     tl.loginToken();
     }catch(Exception e){
     e.printStackTrace();
Configuration file::
name = rainbow_token
library = c:\winnt\system32\dkck201.dll
attributes(*,CKO_PRIVATE_KEY,*) = {
CKA_SIGN = true
attributes(*,CKO_PRIVATE_KEY,CKK_DH) = {
CKA_SIGN = null
attributes(*,CKO_PRIVATE_KEY,CKK_RSA) = {
CKA_DECRYPT = true
}

Answer 1

Hi all,
Now i manage to use the same keypair for both encrypt/decryprt-SunPKCS#11. Below is my code woks well. In my code i hard coded alias name of certificate, did anyone knows how to read alias name of certificate from iKey token 2032??
import java.io.*;
import java.util.*;
import java.lang.*;
import java.sql.*;
import java.text.*;
import java.math.*;
import java.security.*;
import java.security.cert.*;
import java.security.interfaces.*;
import javax.crypto.interfaces.*;
import javax.net.ssl.*;
import javax.crypto.*;
import javax.crypto.spec.DESKeySpec;
import java.security.KeyStore.*;
* A class of Encrypt.
public class Encrypt
public Encrypt(){}
public void loginToken() {
     Provider p = new sun.security.pkcs11.SunPKCS11(MQConfig.getvalue("SecurityPropertyPath"));
     String myAlias = "349eefd1-845b-4ba4-9f88-06e9f5cb82f6";
     /** to view alias name
     keytool -list -v -keystore NONE -storetype PKCS11 -storepass PASSWORD
     Security.addProvider(p);
     KeyStore ks = null;
     PrivateKey privKey = null;
     PublicKey pubKey = null;
     try{
          String password = General.ReadFiles(MQConfig.getvalue("logFilePath"),"Simple");
          password = password.trim();
          char pin[] = password.toCharArray();
          ks = KeyStore.getInstance("pkcs11");
          ks.load(null,pin);
          java.security.cert.Certificate cert = ks.getCertificate(myAlias);
          Key key = ks.getKey(myAlias, pin);
          if(key != null) {
               System.out.println("key class: " + key.getClass().getName()); // -> sun.security.pkcs11.P11Key$P11PrivateKey
               System.out.println("key bytes: " + key.getEncoded()); // -> null!!!!!!!
     if(PrivateKey.class.isInstance(key)) {
     privKey = (PrivateKey)key;
     System.out.println("algo: " + privKey.getAlgorithm()); // -> RSA
     //Signature rsasig = Signature.getInstance("SHA1withRSA");
     //rsasig.initSign(privKey);
     //rsasig.update(data.getBytes());
     //byte[] sigBytes = rsasig.sign();
     pubKey = cert.getPublicKey();
     //System.out.println("signed bytes: " +sigBytes);
     //return sigBytes;
     //KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA",p);
          //KeyPair kp = kpg.genKeyPair();
          //KeyPair kp = kpg.generateKeyPair();
          //kpg.initialize(1024, new java.security.SecureRandom());
          FileInputStream in = new FileInputStream("C:\\ReportDBBE.properties");
          FileOutputStream out = new FileOutputStream("C:\\ReportDBAE.properties");
          Cipher cp=Cipher.getInstance("RSA/ECB/PKCS1Padding", p);
//cp.init(cp.ENCRYPT_MODE,kp.getPublic());
          cp.init(cp.ENCRYPT_MODE,pubKey);
          CipherOutputStream cout=new CipherOutputStream(out,cp);
          byte[] input=new byte[8];
          int byteread=in.read(input);
          while(byteread!=-1){
               cout.write(input,0,byteread);
               byteread=in.read(input);
          cout.flush();
          in.close();
          cout.close();
     catch(NoSuchAlgorithmException nsae)
     System.out.println("No Such Algorithm Exception " + nsae.getMessage());
     catch(NoSuchPaddingException nspe)
     System.out.println("No Such Padding Exception " + nspe.getMessage());
     catch(InvalidKeyException ike)
     System.out.println("Invalid Key Exception " + ike.getMessage());
     ike.printStackTrace();
     catch(IllegalStateException ise)
     System.out.println("Illegal State Exception " + ise.getMessage());
     catch(KeyStoreException kse)
     System.out.println("Key Store Exception " + kse.getMessage());
     catch(CertificateException ce)
     System.out.println("Certificate Exception " + ce.getMessage());
     catch(IOException ioe)
     System.out.println("IO Exception " + ioe.getMessage());
     catch(UnrecoverableKeyException unrke)
     System.out.println("Unrecoverable Key Exception " + unrke.getMessage());
public static void main (String args[]) throws Exception {
     try{
     Encrypt tl = new Encrypt();
     tl.loginToken();
     }catch(Exception e){
     e.printStackTrace();
Your help is very much appreciated!!!!