Install SoftHSMv2 and use it via OpenSSL and PKCS #11

func main() {
        generateRSAKeyPair(31331403)
        // cipherData(31331403, "Hello, World!")
        // decipherData(31331403)
        // signData(31331403)
        // verifySignedData(31331403)
}

// getAvailableSlots retrieves available slots and return them
func getAvailableSlots(module p11.Module) []p11.Slot {
        slots, err := module.Slots()
        if err != nil {
                log.Fatalln(err)
        }
        return slots
}

// findRequestedSlot finds the requested slot given in parameter and return its instance if exists
func findRequestedSlot(module p11.Module, slotID uint) *p11.Slot {
        slots := getAvailableSlots(module)

        var slot *p11.Slot

        found := false

        // Loop through the available slots returned by the function getAvailableSlots
        for _, availableSlot := range slots {
                if availableSlot.ID() == slotID {
                        // Fill the structure
                        slot = &availableSlot
                        found = true
                        break
                }
        }

        if !found {
                log.Fatalf("Failed to find slot with ID %d\n", slotID)
        }

        return slot
}

// generateRSAKeyPairRequest generates a request to generate an RSA key pair and returns a p11.GenerateKeyPairRequest
func generateRSAKeyPairRequest(objectLabel string) p11.GenerateKeyPairRequest {
        // Define the mechanism to generate an RSA key pair
        mechanism := *pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_KEY_PAIR_GEN, nil)

        publicKeyTemplate := []*pkcs11.Attribute{
                pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PUBLIC_KEY),
                // The type of the key
                pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_RSA),
                // The CKA_TOKEN attribute identifies whether the object is a token object or a session object
                pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
                // The CKA_VERIFY attribute of the verification key, which indicates whether the key supports verification where the signature is an appendix to the data
                pkcs11.NewAttribute(pkcs11.CKA_VERIFY, true),
                // The CKA_ENCRYPT attribute of the encryption key, which indicates whether the key supports encryption
                pkcs11.NewAttribute(pkcs11.CKA_ENCRYPT, true),
                // Public exponent e
                pkcs11.NewAttribute(pkcs11.CKA_PUBLIC_EXPONENT, []byte{1, 0, 1}),
                // Key length
                pkcs11.NewAttribute(pkcs11.CKA_MODULUS_BITS, 4096),
                // The CKA_LABEL attribute is intended to assist users in browsing
                pkcs11.NewAttribute(pkcs11.CKA_LABEL, objectLabel),
        }

        privateKeyTemplate := []*pkcs11.Attribute{
                pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),
                pkcs11.NewAttribute(pkcs11.CKA_KEY_TYPE, pkcs11.CKK_RSA),
                pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
                // The CKA_DECRYPT attribute of the decryption key, which indicates whether the key supports decryption
                pkcs11.NewAttribute(pkcs11.CKA_DECRYPT, true),
                // When the CKA_PRIVATE attribute is CK_TRUE (true), a user may not access the object until the user has been authenticated to the token.
                pkcs11.NewAttribute(pkcs11.CKA_PRIVATE, true),
                // The CKA_EXTRACTABLE attribute is CK_FALSE (false), then certain attributes of the secret key cannot be revealed in plaintext outside the token
                pkcs11.NewAttribute(pkcs11.CKA_EXTRACTABLE, false),
                pkcs11.NewAttribute(pkcs11.CKA_LABEL, objectLabel),
        }

        // Return the request with the different information
        return p11.GenerateKeyPairRequest{
                Mechanism:            mechanism,
                PublicKeyAttributes:  publicKeyTemplate,
                PrivateKeyAttributes: privateKeyTemplate,
        }
}

// generateRSAKeyPair generates an RSA key pair based on a request
func generateRSAKeyPair(slotID uint) {
        // Load the shared library
        module, err := p11.OpenModule("/usr/local/lib/softhsm/libsofthsm2.so")
        defer module.Destroy()
        if err != nil {
                log.Fatalln(err)
        }

        // Check if the slot ID given in parameter is available
        slot := findRequestedSlot(module, slotID)

        // Open a RW session
        session, err := slot.OpenWriteSession()
        if err != nil {
                log.Fatalln(err)
        }

        // Login to the token, 123456 is the User PIN defined during the command `softhsm2-util --init-token --free --label "Test token"`
        if err := session.Login("123456"); err != nil {
                log.Fatalln(err)
        }

        // Generate the RSA key pair with label `RSA4096SD`
        request := generateRSAKeyPairRequest("RSA4096SD")
        _, err = session.GenerateKeyPair(request)
        if err != nil {
                log.Fatalln(err)
        }

        log.Println("RSA key pair successfully generated")
}

// cipherData ciphers data with a public key
func cipherData(slotID uint, data string) {
        // Load the shared library
        module, err := p11.OpenModule("/usr/local/lib/softhsm/libsofthsm2.so")
        defer module.Destroy()
        if err != nil {
                log.Fatalln(err)
        }

        // Check if the slot ID given in parameter is available
        slot := findRequestedSlot(module, slotID)

        // Open a RO session
        session, err := slot.OpenSession()
        if err != nil {
                log.Fatalln(err)
        }

        // Create a template to find the public key
        template := []*pkcs11.Attribute{
                pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PUBLIC_KEY),
                pkcs11.NewAttribute(pkcs11.CKA_LABEL, "RSA4096SD"),
        }

        // Find the object based on template
        publicKeyObject, err := session.FindObject(template)
        if err != nil {
                log.Fatalln(err)
        }

        // Cast the p11.Object to p11.PublicKey
        publicKey := p11.PublicKey(publicKeyObject)

        // Define the mechanism to cipher and decipher
        mechanism := *pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS, nil)

        // Cipher the message
        cipheredData, err := publicKey.Encrypt(mechanism, []byte(data))
        if err != nil {
                log.Fatalln(err)
        }

        // Write the ciphered data to a file
        if err := os.WriteFile("hello.txt.ciphered", cipheredData, 0644); err != nil {
                log.Fatalln(err)
        }

        fmt.Println("Ciphered data written into hello.txt.ciphered")
}

// decipherData deciphers data with a private key
func decipherData(slotID uint) {
        // Load the shared library
        module, err := p11.OpenModule("/usr/local/lib/softhsm/libsofthsm2.so")
        defer module.Destroy()
        if err != nil {
                log.Fatalln(err)
        }

        // Check if the slot ID given in parameter is available
        slot := findRequestedSlot(module, slotID)

        // Open a RO session
        session, err := slot.OpenSession()

        // Login to the token, 123456 is the User PIN defined during the command `softhsm2-util --init-token --free --label "Test token"`
        if err := session.Login("123456"); err != nil {
                log.Fatalln(err)
        }

        // Create a template to find the private key
        template := []*pkcs11.Attribute{
                pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),
                pkcs11.NewAttribute(pkcs11.CKA_LABEL, "RSA4096SD"),
        }

        // Find the object based on template
        privateKeyObject, err := session.FindObject(template)
        if err != nil {
                log.Fatalln(err)
        }

        // Cast the p11.Object to p11.PrivateKey
        privateKey := p11.PrivateKey(privateKeyObject)

        // Define the mechanism to cipher and decipher
        mechanism := *pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS, nil)

        // Read the ciphered data
        data, err := os.ReadFile("./hello.txt.ciphered")
        if err != nil {
                log.Fatalln(err)
        }

        // Decipher the data
        decipheredMessage, err := privateKey.Decrypt(mechanism, data)
        if err != nil {
                log.Fatalln(err)
        }

        fmt.Println(string(decipheredMessage))
}

// signData signs data with a private key
func signData(slotID uint) {
        // Load the shared library
        module, err := p11.OpenModule("/usr/local/lib/softhsm/libsofthsm2.so")
        defer module.Destroy()
        if err != nil {
                log.Fatalln(err)
        }

        // Check if the slot ID given in parameter is available
        slot := findRequestedSlot(module, slotID)

        // Open a RO session
        session, err := slot.OpenSession()

        // Login to the token, 123456 is the User PIN defined during the command `softhsm2-util --init-token --free --label "Test token"`
        if err := session.Login("123456"); err != nil {
                log.Fatalln(err)
        }

        // Create a template to find the private key
        template := []*pkcs11.Attribute{
                pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PRIVATE_KEY),
                pkcs11.NewAttribute(pkcs11.CKA_LABEL, "RSA4096SD"),
        }

        // Find the object based on template
        privateKeyObject, err := session.FindObject(template)
        if err != nil {
                log.Fatalln(err)
        }

        // Cast the p11.Object to p11.PrivateKey
        privateKey := p11.PrivateKey(privateKeyObject)

        // Define the mechanism to sign/verify
        mechanism := *pkcs11.NewMechanism(pkcs11.CKM_SHA384_RSA_PKCS, nil)

        // Read the ciphered data
        data, err := os.ReadFile("./hello.txt.ciphered")
        if err != nil {
                log.Fatalln(err)
        }

        // Sign data
        signedData, err := privateKey.Sign(mechanism, data)
        if err != nil {
                log.Fatalln(err)
        }

        // Write the signed data to a file
        if err := os.WriteFile("hello.txt.sig", signedData, 0644); err != nil {
                log.Fatalln(err)
        }

        fmt.Println("Signed data written into hello.txt.sig")
}

// verifySignedData verifies signed data with a public key
func verifySignedData(slotID uint) {
        // Load the shared library
        module, err := p11.OpenModule("/usr/local/lib/softhsm/libsofthsm2.so")
        defer module.Destroy()
        if err != nil {
                log.Fatalln(err)
        }

        // Check if the slot ID given in parameter is available
        slot := findRequestedSlot(module, slotID)

        // Open a RO session
        session, err := slot.OpenSession()

        // Create a template to find the public key
        template := []*pkcs11.Attribute{
                pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_PUBLIC_KEY),
                pkcs11.NewAttribute(pkcs11.CKA_LABEL, "RSA4096SD"),
        }

        // Find the object based on template
        publicKeyObject, err := session.FindObject(template)
        if err != nil {
                log.Fatalln(err)
        }

        // Cast the p11.Object to p11.PublicKey
        publicKey := p11.PublicKey(publicKeyObject)

        // Define the mechanism to sign/verify
        mechanism := *pkcs11.NewMechanism(pkcs11.CKM_SHA384_RSA_PKCS, nil)

        // Read the unsigned data
        data, err := os.ReadFile("hello.txt.ciphered")
        if err != nil {
                log.Fatalln(err)
        }

        // Read the signed data
        signedData, err := os.ReadFile("hello.txt.sig")
        if err != nil {
                log.Fatalln(err)
        }

        // Verify signature
        if err := publicKey.Verify(mechanism, data, signedData); err != nil {
                log.Fatalln(err)
        }

        fmt.Println("Verification OK")
}