topic Re: Request: Implement C_UnwrapKey in SIMW Top PKCS#11 (SE05X) for CMS ECDH in Secure Authentication

Request: Implement C_UnwrapKey in SIMW Top PKCS#11 (SE05X) for CMS ECDH

vishwaec08 — Mon, 19 Jan 2026 04:31:45 GMT

Hello NXP Team,

We need C_UnwrapKey (AES-CBC/AES-CBC-PAD) implemented in SE05X SDK PKCS#11 to enable CMS ECDH handle-only decrypt on SE05X.

Currently C_UnwrapKey returns CKR_FUNCTION_NOT_SUPPORTED in sss_pkcs11_pal_core.c. The flow requires unwrapping the CMS CEK on-token using the derived AES handle plus the 16-byte IV from CMS.

Regards
Vishwa

Re: Request: Implement C_UnwrapKey in SIMW Top PKCS#11 (SE05X) for CMS ECDH

Kan_Li — Mon, 19 Jan 2026 06:16:40 GMT

Hi @vishwaec08 ，

I have forwarded your feature request to the expert team, and will let you know when I have any feedback from there.

Thanks for your patience!

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: Request: Implement C_UnwrapKey in SIMW Top PKCS#11 (SE05X) for CMS ECDH

vishwaec08 — Mon, 19 Jan 2026 08:39:34 GMT

Hi,

The overall idea is that we want to encrypt and decrypt the data using OpenSSL CMS with an EC key.

For reference, the OpenSSL commands are listed below.

pkcs11-tool --module /usr/lib/libsss_pkcs11.so --slot 1 --keypairgen --key-type EC:prime256v1 --label "sss:20202022"

OPENSSL_CONF=engine.conf openssl req -engine pkcs11 -new -key "pkcs11:object=sss:20202022;type=private" -keyform engine -out ec_req.pem -x509 -subj "/CN=Test EC" -days 365

OPENSSL_CONF=engine.conf openssl x509 -engine pkcs11 -signkey "pkcs11:object=sss:20202022;type=private" -keyform engine -in ec_req.pem -out ec_cert.pem

openssl cms -encrypt -binary -outform DER -aes128 -in smcont.txt -recip ec_cert.pem -out test_ec.cms

OPENSSL_CONF=engine.conf openssl cms -decrypt -binary -inform DER -engine pkcs11 -keyform engine -inkey "pkcs11:object=sss:20202022;type=private" -recip ec_cert.pem -in test_ec.cms -out smtst.txt