PKCS11 Safenet HSM Setup

[jwomackgsa]

I am trying to test step-ca with a pkcs11 hsm complaint HSM. I have built step-ca with pkcs11 support but I need some guidance on how to craft the URI. I found from this SDK doc here regarding what share objects to use from the SDK, but I am not sure how figure out what parameters need to be passed. Also my knowledge on HSM is very limited but I know that this is a network based HSM and I have created a partition on it for this testing. Any guidance is appreciated.

[tashian]

Hi @jwomackgsa,

We haven't tested the Safenet HSM with step-ca or with the step-pkcs11-init tool.
The pkcs11: URI format for PKCS#11 modules is defined by RFC7512. You're going to need the module-path and token label in the URI at minimum.
And here are our docs on step-ca's PKCS#11 HSM support.
You will likely need to initialize the HSM (create a token and give it a label) and generate signing keys on the HSM for your CA before you can use it with step-ca.
Hope this helps. We'd love any feedback you have for improving our docs around this feature!

[tashian]

The value of PKCS#11 is that it abstracts away the hardware... What you're describing sounds very specific to Safenet, so my hunch is that Safenet library would cover that concern and present a standard PKCS#11 interface to step-ca.

[jwomackgsa]

So I have made some progress and been able to successfully run the pkcs11 init and get keys created on the Safenet HSM however I am running the 0.15.15 code and I think there are issues with the uri reading from the init script. I have only been able to run the init when I provide the PIN credential at the requested prompt. I can't seem to get pin-value or pin-source to work. Also it seems like how it is reading the elements of the pkcs11 --kms value doesn't match the URI schema. Some examples.

[root@server1 bin]# ./step-pkcs11-init --kms pkcs11:module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so;token=mypartition1
What is the PKCS#11 PIN?:
kms uri 'token', 'serial' or 'slot-id' are required

[root@server1 bin]# ./step-pkcs11-init --kms pkcs11:module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so;token=mypartition1?pin-value=password123
What is the PKCS#11 PIN?:
kms uri 'token', 'serial' or 'slot-id' are required
[root@e04tcm-dmsutil01p bin]#

##This works however ###
[root@server1 bin]# ./step-pkcs11-init --force --kms pkcs11:module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so?token=mypartition1
What is the PKCS#11 PIN?:
Creating PKI ...
✔ Would you like to overwrite root_ca.crt [y/n]: y
✔ Root Key: pkcs11:id=7330;object=root-key
✔ Root Certificate: root_ca.crt
✔ Would you like to overwrite intermediate_ca.crt [y/n]: y
✔ Intermediate Key: pkcs11:id=7331;object=intermediate-key
✔ Intermediate Certificate: intermediate_ca.crt

I found this also works
pkcs11:token=blah?module-path=/path/to/my/lib

but I can't get ones like

pkcs11:module-path=/path/to/my/lib;token=mytoken;serial=ABCDEF1234

or more importantly for the runtime of the step-ca

pkcs11:module-path=/path/to/my/lib;token=myToken?pin-source=file:/path/to/my/secret

Are you all to reproduce the URI handling on your end?

`

[tashian]

@jwomackgsa I'm glad you got the init program working. Passing the pin value on the command line is insecure—that may be why we ask for it interactively. The step-pkcs11-init program is an experimental program so it has a minimal feature set. Our goal is to eventually incorporate this functionality directly into step.

Unfortunately, we don't have a good way to test or confirm these URIs because we don't have access to a Safenet HSM, but I'm glad to hear you're making progress with it.

[maraino]

Hi @jwomackgsa,

Can you check if quoting the URIs work? Usually on a shell the text after ; will be interpreted as a new command.

$ step-pkcs11-init --kms pkcs11:module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so;token=mypartition1
...
$ echo $token
mypartition1

[jwomackgsa]

Hi @jwomackgsa,

Can you check if quoting the URIs work? Usually on a shell the text after ; will be interpreted as a new command.

$ step-pkcs11-init --kms pkcs11:module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so;token=mypartition1
...
$ echo $token
mypartition1

Yes excellent catch. Upon some additional testing, the quoting of the kms parameter has solved some of the odd behavior I was seeing. I still have some more testing to do now that I have the KMS config setup but so far so good. I will be sure to reply back with some additional information so hopefully SafeNet HSM can be added to the docs for others in the future.