Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PROTON-2594: Add OpenSSL PKCS#11 PROVIDER support to enable HSM use #430

Closed
wants to merge 3 commits into from
Closed

PROTON-2594: Add OpenSSL PKCS#11 PROVIDER support to enable HSM use #430

wants to merge 3 commits into from

Commits on Nov 14, 2024

  1. PROTON-2594: Add OpenSSL PKCS#11 PROVIDER support to enable HSM use 

    Hardware Security Modules (HSMs) are physical computing devices that
safeguard secrets and allow performing cryptographic operations like
encryption and signing without necessarily divulging the private key
material.

PKCS#11 is a platform-independent API for cryptographic tokens like
HSMs. It defines a scheme for pkcs11: URIs that describe objects on the
token as well as an API to interact with them.

This commit adds support for transparent use of PKCS#11 URIs: Whenever a
certificate or private key path is prefixed with pkcs11: it will be
interpreted as PKCS#11 URI instead of a file path and OpenSSL will do
all necessary communication with the HSM behind the scenes.

For programs like proton that use OpenSSL, this could have been
realized in two ways:

  - OpenSSL ENGINE:   Introduced in OpenSSL 0.9.6 and deprecated in 3.0
  - OpenSSL PROVIDER: Introduced in OpenSSL 3.0 to replace ENGINE

While both are supported in recent OpenSSL versions, it's more future
proof to use the PROVIDER API, even if this comes at the cost of having
to add an #ifdef to the code.

This has been tested on Linux/x86_64 with softhsm and Linux/arm32 with
OP-TEE, both with v0.5 of https://github.com/latchset/pkcs11-provider.

As everything is loaded dynamically, we do not link against any
PKCS#11-related shared libraries. It's expected that PKCS#11 provider
will already be loaded via OPENSSL_CONF if it's to be used.
    @a3f
    a3f committed Nov 14, 2024
    Configuration menu
    Copy the full SHA
    2b84656 View commit details
    Browse the repository at this point in the history

  2. PROTON-2594: [C++] connect_config_test: factor out some definitions i… 

    …nto header

The test_handler implementation in connect_config_test can be useful for
further tests as well such as the incoming pkcs11_test.

We don't want to add the PKCS#11 test here, because the test is not
applicable to all platforms and it would overly complicate the existing
tests, so let's share code via a common header.
    @a3f
    a3f committed Nov 14, 2024
    Configuration menu
    Copy the full SHA
    2dce899 View commit details
    Browse the repository at this point in the history

  3. PROTON-2594: [C++] add test for newly added PKCS#11 support 

    Existing tests hardcode paths to PEM files. For easily testing PKCS#11 usage
for client certificates on the target, we want to pass in dynamically
PKCS#11 URIs identifying the certificates and keys to use without
requiring recompilation.

Enable doing that by consulting a set of new environment variables:

	PKCS11_CLIENT_CERT: URI of client certificate
	PKCS11_CLIENT_KEY:  URI of client private key
	PKCS11_SERVER_CERT: URI of server certificate
	PKCS11_SERVER_KEY:  URI of server private key
	PKCS11_CA_CERT:     URI of CA certificate

These variables are populated and exported by sourcing the new
scripts/prep-pkcs11_test.sh script prior to executing the test.

The script uses SoftHSM, which is an implementation of a cryptographic store
accessible through a PKCS apache#11 interface without requiring an actual
Hardware Security Module (HSM).

We load into the SoftHSM both client and server keys and certificates.
As the server key exists only in encrypted form, we decrypt
server-private-key-lh.pem, so we need not handle passphrase input when
the PEM file is processed by pkcs11-tool.

When the script is not sourced, none of the environment variables will
be set and the test will be skipped without being marked as error.
    @a3f
    a3f committed Nov 14, 2024
    Configuration menu
    Copy the full SHA
    369965a View commit details
    Browse the repository at this point in the history