resource: add PKCS11 resource back-end #533
Draft
+178
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
PKCS11 is a generic interface for carrying-out cryptographic operations using devices like HSMs. This commit adds very basic support for storing KBS resources in an HSM with PKCS11 One of the many things supported by PKCS11 is storing keys in a device. Usually these keys are wrapped and/or generated by the device itself, which is not a good fit for the KBS resource model. Instead, we use one particular generic secret key type that allows the KBS to read and write the plaintext secret value. This might not capture the full potential of an HSM, but keep in mind that the default backend simply stores the secrets in the filesystem. To fully take advantage of key wrapping, we will need to add PKCS11 support to the CDH or possibly introduce a plugin. This backend allows users to provision keys to the HSM as well. In fact, it is more reliable to use this interface than it is to provision keys separately. The cryptoki api is not thread safe so a Mutex is used. This backend might not be as performant as the file system backend, especially when using a real HSM. Signed-off-by: Tobin Feldman-Fitzthum <[email protected]>
Xynnn007
reviewed
Oct 16, 2024
|
|
||
| /// The index of the slot to be used | ||
| /// If not provided, the first slot will be used. | ||
| slot_index: Option<u8>, |
There was a problem hiding this comment.
If we want this to be a config item, String or i64 might be better?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Some very basic PKCS11 support for resources. There are some limitations to what we can do with the current design. See commit message for more info.
I will be OOO for the rest of the week, but I will add a test when I get back. This will probably need a rebase after the plugins PR goes in.