PKCS#11 support (targetting nShield HSMs and SoftHSM) #1369
Conversation
Necessary because HSM users expect key to be generated by HSM, not generated on host and imported. `notary key generate` and `rotate` can take `--keystore` and `--token`. These are intended to control key generation on an HSM (concrete support for a real HSM isn't in this commit). Signed-off-by: Richard Kettlewell <Richard.Kettlewell@thales-esecurity.net>
This is added (finally) to key store lists. Instead of expecting it to automatically claim suitable keys the user must specify this key store; otherwise they will get software keys. Signed-off-by: Richard Kettlewell <Richard.Kettlewell@thales-esecurity.net>
Signed-off-by: Richard Kettlewell <Richard.Kettlewell@thales-esecurity.net>
The signer has a new storage backend, pkcs11. signer.Dockerfile switches to a Debian base, because the nShield PKCS#11 provider needs some Glibc symbols (at least in my build of it). Signed-off-by: Richard Kettlewell <Richard.Kettlewell@thales-esecurity.net>
|
Can one of the admins verify this patch? |
|
|
||
| This key store appears (by default) last in the list of supported key stores. | ||
| So by default keys will be created in software and no HSM used. | ||
| To enable use of an HSM, the new `--keystore` and `--token` arguments must be used |
There was a problem hiding this comment.
--keystore and --token are mentioned as required but not used in any examples.
There was a problem hiding this comment.
In examples used -K / -T respectively.
|
@optnfast Hello. |
|
@optnfast are you still available? I'd really like to see support for other HSM's than just the yubikey. Supporting more HSM vendor/types ( like the yubihsm2) is important. @vikstrous Normally you should be able to find the token with p11tool from gnutls. |
|
@stafwag Things have changed here and I don't have an immediate use case for TUF. So while more HSM integrations are a good thing from my perspective, there's a fairly low limit on how much time I could realistically spend on this PR in the foreseeable future. |
This PR adds a new
pkcs11key store. I have tested with nShield and SoftHSM. Usage is described intrustmanager/p11store/pkcs11.md.Overview
Discussion
I originally raised this project on one of the other PKCS#11-related issues, with my original plan here.
The only discussion arising was that Florian suggested supporting multiple classes of HSM concurrently. I've not done this since it's not a use case I have, but I'd be happy to retest against nShield if someone needs this idea enough to implement it.
In the end I didn't attempt to share code with the existing PKCS#11 implementation. I felt that the differing assumptions about (for example) the number of slots on the token and the interpretation of
CKA_IDmade this impractical.Availability
Unfortunately I will have poor availability in the next week or two (i.e. early July 2018) - so I apologise in advance if I'm slow to respond to any feedback.