Sign and verify¶

Signing is a useful first check of Pico HSM: the host receives a signature while the private key stays inside the device.

Prepare sample data¶

echo "This is a test string. Be safe, be secure." > data

Export the public key:

pkcs11-tool --read-object --type pubkey --id 1 --output-file rsa_pub.der
openssl rsa -inform DER -pubin -in rsa_pub.der -out rsa_pub.pem

Sign:

pkcs11-tool \
  --sign \
  --id 1 \
  --pin 648219 \
  --mechanism RSA-PKCS \
  -i data \
  -o data.sig

Verify:

openssl dgst -sha256 -verify rsa_pub.pem -signature data.sig data

Warning

RSA-PKCS is widely interoperable but not the first choice for new designs. Prefer RSA-PSS where your tooling supports it.

Export the public key:

pkcs11-tool --read-object --type pubkey --id 11 --output-file ec_pub.der
openssl ec -inform DER -pubin -in ec_pub.der -out ec_pub.pem

Sign:

pkcs11-tool \
  --sign \
  --id 11 \
  --pin 648219 \
  --mechanism ECDSA \
  -i data \
  -o data.sig

Verify:

openssl dgst -sha256 -verify ec_pub.pem -signature data.sig data

host tools differ on whether hashing is implicit or explicit
some mechanisms exist in firmware but are awkward in generic CLI tooling
signature success proves the session, PIN, and key object are all aligned correctly

For this reason, sign-and-verify is a useful diagnostic workflow after provisioning.