Switch pkcs11 crate for cryptoki instead

[ximon18]

This PR attempts to resolve #752.

On my Raspberry Pi 4b with the YubiHSM2 Nano with a cross compiled build of this PR code I can now get Krill to talk to the YubiHSM2 via the PKCS#11 interface. It remains to be seen if all tests pass, I suspect they do not yet, but it at least gets this far now: (with some parts of the logging stripped such as timestamps and function paths to make it easier to read here)

[INFO] [...] Using PKCS#11 token 'YubiHSM (model: YubiHSM, vendor: Yubico (www.yubico.com))' in slot 0 of server 'Yubico (www.yubico.com) (Cryptoki v2.30)' via library '/home/pi/yubihsm/yubihsm-shell-2.3.0b/build/pkcs11/yubihsm_pkcs11.so'
[TRACE] [...] yubihsm_pkcs11.so::C_OpenSession()
[TRACE] [...] yubihsm_pkcs11.so::C_FindObjectsInit, C_FindObjects & C_FindObjectsFinal()
[DEBUG] [...] Signer 'YubiHSM2 Nano via PKCS#11' not matched: private key id 'A77978094DEFCCC09F7CE1D5CD94C7727D5371E1' not found
[TRACE] [...] Attempting to register signer 'YubiHSM2 Nano via PKCS#11'
[TRACE] [...] yubihsm_pkcs11.so::C_OpenSession()
[TRACE] [...] yubihsm_pkcs11.so::C_GenerateKeyPair()
[INFO] [...] Updated announcements (1097172) based on BGP Ris Dumps
[TRACE] [...] yubihsm_pkcs11.so::C_OpenSession()
[TRACE] [...] yubihsm_pkcs11.so::C_GetAttributeValue()
[TRACE] [...] yubihsm_pkcs11.so::C_OpenSession()
[TRACE] [...] yubihsm_pkcs11.so::C_FindObjectsInit, C_FindObjects & C_FindObjectsFinal()
[TRACE] [...] yubihsm_pkcs11.so::C_OpenSession()
[TRACE] [...] yubihsm_pkcs11.so::C_SignInit & C_Sign()
[DEBUG] [...] Signer 'YubiHSM2 Nano via PKCS#11' is ready and new, binding
[DEBUG] [...] Signer 'YubiHSM2 Nano via PKCS#11' bound to signer handle 'a71378fb-3046-4d99-b0da-1bf68cb4145f'
[INFO] [...] Signer 'YubiHSM2 Nano via PKCS#11' is ready for use

[timbru]

I am not comfortable with using an unreleased version of cryptoki. Other than that it seems to me that all of this is fine. Lots of changes - but as far as I can tell they are all just about using the other API and none of them introduce different behaviour.

[ximon18]

I am not comfortable with using an unreleased version of cryptoki. Other than that it seems to me that all of this is fine. Lots of changes - but as far as I can tell they are all just about using the other API and none of them introduce different behaviour.

This is resolved now.

[timbru]

Great! I think we can start merging all this into dev then!