Add a PKCS#11 interface for libzpc - #50
Open
ifranzki wants to merge 17 commits into
Open
Conversation
Add the initial skeleton for a PKCS#11 v3.2 shared library (zpcpkcs11). Implement C_Initialize, C_Finalize, C_GetInfo, C_GetFunctionList, C_GetInterfaceList, and C_GetInterface. All other functions return CKR_FUNCTION_NOT_SUPPORTED. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Report a single slot (ID 0) and a read-only token named "ZPC" as present and initialized. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Create a dedicated OpenSSL library context and load the default, base, and zpc provider into it. The context is used for all subsequent key loading and cryptographic operations. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add config.c which parses the PKCS#11 configuration file (default: /etc/zpcpkcs11/zpcpkcs11.conf, overridden via ZPCPKCS11_CONFIG). Each non-comment line is expected in the form '<label>=<uri>' and is passed to a caller-supplied callback for further processing. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use the OpenSSL STORE API to load each key URI from the config file into an EVP_PKEY. Extract the EC/EdDSA curve parameters, public key point, and SPKI encoding so they can be stored as PKCS#11 objects. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add utils.c with a generic dynamic array (dyn_array) implementation used throughout the PKCS#11 layer to store lists of objects and sessions without a fixed upper bound. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add object.c with helpers to allocate, populate, and free PKCS#11 object structures. Provide functions to build default CKA_* attribute sets for EC and EdDSA public and private key objects. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add a module-level object list backed by a dyn_array. Provide object_list_init, object_list_term, object_list_add, object_list_get, and object_list_find for managing PKCS#11 objects at runtime. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Wire up openssl_load_keys to call config_process and pass each loaded EVP_PKEY to object_add_ec_ed_private_key or object_add_ec_ed_public_key so that keys become queryable PKCS#11 objects after C_Initialize. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add session.c with a module-level session list. Provide helpers to initialize and terminate the list, open and close sessions, query session counts, and manage per-session operation state. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Implement C_OpenSession, C_CloseSession, C_CloseAllSessions, C_GetSessionInfo, C_Login, C_LoginUser, and C_Logout using the session list. Report live session counts in C_GetTokenInfo. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Implement C_FindObjectsInit, C_FindObjects, and C_FindObjectsFinal. The init function searches the object list for entries matching the supplied attribute template and stores the results in the session. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Implement C_GetObjectSize and C_GetAttributeValue to allow callers to query the size and individual attributes of a PKCS#11 object. Mark C_CreateObject, C_CopyObject, and C_DestroyObject as CKR_TOKEN_WRITE_PROTECTED since the token is read-only. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Implement C_GetMechanismList and C_GetMechanismInfo. Advertise ECDSA with SHA-1/224/256/384/512/SHA3 variants for P-256 to P-521, and EdDSA for Ed25519/Ed448. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add signature.c and implement C_SignInit, C_Sign, C_SignUpdate, C_SignFinal, C_VerifyInit, C_Verify, C_VerifyUpdate, and C_VerifyFinal. Support ECDSA (with raw hash or prehash variants) and EdDSA using the OpenSSL EVP signing API. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add zpcpkcs11(7) describing the library, its token/session/login model, and the full function support table. Add zpcpkcs11.conf(5) describing the key configuration file format. Assisted-by: IBM Bob:2.0.3 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add three bash test scripts using TAP output: - t_pkcs11_uv_prepconf: generate test keys and a config file - t_pkcs11_uv_list: list keys via p11tool or pkcs11-tool - t_pkcs11_uv_sign_verify: sign and verify data for each key type Assisted-by: IBM Bob:2.0.3 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Contributor
Author
|
Close + reopen to trigger Travis .... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allow to use hardware backed keys via a PKCS#11 interface. Under the covers the zpc provider is used to perform the crypto operations.