What
The Security&crypto repo already contains a pkcs11 crypto provider which uses
SoftHSM2. This task if for showing that NXPs pkcs11-hse crypto provider can be used
within this framework.
SoftHSM2 is much for flexible as the HW based pkcs11-hse. E.g. when creating a AES128
key, SoftHSM2 does not care about the CKA_ID. On the pkcs11-hse, the CKA_ID is mandatory
as it carries information on the slod it, that group id and the catalog id of the HSE key
catalog, where the key is stored. The goal of this PoC is also to list the configuration settings
needed for using HSE for driving the pkcs11 crypto provider.
The PoC will support select use cases, on of which must include key generation and storage.
Acceptance Criteria (DoD)
test_pkcs11_provider with pkcs11-hse backend running on NXP EVB3 evaluation board.
How
Current pkcs11 provider links SoftHSM2 module statically and calls some API functions like C_GetFunctionList,
C_Initialize and C_Finalize from the lib. For the PoC, it will be adapted that the pkcs11 module ls loaded with
dlopen(). By this, an pkcs11 module existing on the platform (like /usr/lib/libpkcs-hse.so.1) can be loaded.
The direct calls from the lib will be replaced by calls using the function list. Some hardcoding of "SoftHSM"
will be adapted.
What
The Security&crypto repo already contains a pkcs11 crypto provider which uses
SoftHSM2. This task if for showing that NXPs pkcs11-hse crypto provider can be used
within this framework.
SoftHSM2 is much for flexible as the HW based pkcs11-hse. E.g. when creating a AES128
key, SoftHSM2 does not care about the CKA_ID. On the pkcs11-hse, the CKA_ID is mandatory
as it carries information on the slod it, that group id and the catalog id of the HSE key
catalog, where the key is stored. The goal of this PoC is also to list the configuration settings
needed for using HSE for driving the pkcs11 crypto provider.
The PoC will support select use cases, on of which must include key generation and storage.
Acceptance Criteria (DoD)
test_pkcs11_provider with pkcs11-hse backend running on NXP EVB3 evaluation board.
How
Current pkcs11 provider links SoftHSM2 module statically and calls some API functions like C_GetFunctionList,
C_Initialize and C_Finalize from the lib. For the PoC, it will be adapted that the pkcs11 module ls loaded with
dlopen(). By this, an pkcs11 module existing on the platform (like /usr/lib/libpkcs-hse.so.1) can be loaded.
The direct calls from the lib will be replaced by calls using the function list. Some hardcoding of "SoftHSM"
will be adapted.