Repository navigation
PKCS#11 work merge in the upstream #4283
Description
This issue is created to track work ongoing to get PKCS#11 implementation upstreamed.
Currently we have different forked out versions of PKCS#11 implementation.
The base of the work is from @etienne-lms branches and is being used as source to upstream things to mainline.
[1] https://github.com/etienne-lms/optee_os/tree/sks-to-pkcs11
[2] https://github.com/etienne-lms/optee_client/tree/sks-to-pkcs11
At the project [3] page you'll find links to the Jira instance where we keep track of work being planned by Linaro . For PKCS#11 you will find that at LOC-21 [4]. If you scroll down to "is implemented by" and expand that, then you'll see how the work has been divided into small work packages. There you can see which ones are done, the ones that we're currently working with and the ones that have not started. So, depending on your PKCS#11 needs it might or might not have the features that you need.
[3] https://www.linaro.org/projects/#LOC
[4] https://projects.linaro.org/browse/LOC-21
Activity
ruchi393 commentedon Dec 21, 2020
Updates
Current Active Tickets:
PKCS#11 Key management functions - https://projects.linaro.org/browse/LOC-12
PKCS#11 Object Functions - https://projects.linaro.org/browse/LOC-6
Plan of action as discussed in LOC monthly meeting - https://docs.google.com/document/d/15XsqgGktCrRRWiqyaz-erp_cZykwGjkBkhMD2XtUlUY/edit#heading=h.a8fqqq174gf
@ruchi393 to contribute on Object related API's for now.
@vesajaaskelainen to contribute on C_GenerateKeyPair and EC Mechanism
vesajaaskelainen commentedon Dec 29, 2020
@ruchi393 in order to test the find api and ec keygen & sign & verify I had to also had to do get attribute support.
Are you already working on get attribute support or shall I do that?
I am currently able to do those operations with pkcs11-tool and openssl but some cleanups and verifications are still needed and the xtest additions.
I suppose those find & get attribute are pre-requisites in order for EC key operations to be practical.
ruchi393 commentedon Dec 29, 2020
I have the code of get attribute and get object size done. Will update the FindObject PR with these commits.
Just updated the PR for these :
#4288
ruchi393 commentedon Dec 29, 2020
@vesajaaskelainen - I am planning to work next on C_SetAttributeValue() and C_CopyObject() next.
Once these are done,I would add test cases which uses C_CopyObject() and then gets the object attributes using C_GetAttributeValue(). Does this sound ok to you ?
You mentioned that you have the code of C_SetAttributeValue() on your branch. Should I use that as reference ?
vesajaaskelainen commentedon Dec 29, 2020
Sounds OK.
In meanwhile I verify your updated PR.
Feel free to use it. I believe there is one TODO comment there that needs to be addressed at the same time. Certificate support may have modified it a bit so may be a good idea to see if there was some changes for that.
I will test my changes on top of your PR and then can push it for look what there is currently.
ruchi393 commentedon Dec 30, 2020
@vesajaaskelainen , have you explored any conformance suits for the library testing. We can have some tests in xtest but it would be good to find some pre-existing test suite for checking the conformance.
I tried pkcs11test (https://github.com/google/pkcs11test.git) but this doesn't seem to have all the tests in it.
SoftHSMv2 also has tests in its src/lib/tests folder. These tests look quiet elaborate. I am trying to cross-compile and try these out.
Any other test suite you have found/are using at your end ?
vesajaaskelainen commentedon Dec 30, 2020
I don't know if you can buy some test suites -- some test suites that you can search from web seems to have gone bad but actually quite good even thou not sometimes the prettiest is the google's pkcs11 test suite. It seems to be evolving and getting in better shape. One "problem" is that it plays with xDES also in "normal" tests which kind shows a bit bad for OP-TEE as we don't have support for that.
We do have SoftHSMv2 also compiled for the device to have some functional comparison but didn't use time to run its test suites -- if I recall they had some SoftHSMv2ism in them -- which I don't blame.
Then for python world https://github.com/danni/python-pkcs11 has some tests.
For automated testing we have setup more upper level testing that uses tools like openssl s_client/s_server, libp11 and then NSS tools for tests to make sure that things work in our expected uses cases. We also run google's pkcs11tests and we also have some own code to verify some cases mainly for the extensions or if the full test logic would need too large test infra. I am yet to plug OP-TEE's upstream code base for those tests -- that goes to next year.
vesajaaskelainen commentedon Jan 4, 2021
@ruchi393 I got a bit bored ;)... now I have also sliced up RSA key gen, RSA PKCS sign/verify/encrypt/decrypt, RSA PSS sign/verify and RSA OAEP encrypt/decrypt.
OAEP took a bit longer bit of time to verify -- and still only SHA-1 part is verified. I have been using openssl+libp11 for verification work but after digging a bit deeper it seems that openssl's engine interface cannot handle OAEP nicely as its RSA mechanism support is a bit awkward. So ended up with hardcoded SHA-1 for testing as that is what openssl's rsautl also uses (and does not seem support changing that either).
Need to go thru the EC and RSA codes thru once again and once we have find & get support merged I can start making PRs for those.
I also have random number support commits .
I suppose next would be to write xtest test battery for those.
ruchi393 commentedon Jan 5, 2021
@vesajaaskelainen , thanks a lot for taking this up. Looks like we would be able to get all the work of PKCS#11 on mainline soon.
vesajaaskelainen commentedon Jan 14, 2021
@ruchi393 made PRs for serialization fixes.
vesajaaskelainen commentedon Jan 14, 2021
@ruchi393 I pushed some session fixes but for these I do not have tests.
https://github.com/vesajaaskelainen/optee_os/tree/session-fixes
You mentioned that you had issue with session testing so could you try with those two commits if they help?
ruchi393 commentedon Jan 22, 2021
@vesajaaskelainen , thanks for the branch.
Out of the two fixes on this branch, I picked up this commit
"ta: pkcs11: relocate shared session object db to client session"vesajaaskelainen@0a7a450
This fixes the object handle sharing issue for the session objects. Can you raise a PR for the same.
vesajaaskelainen commentedon Jan 22, 2021
Can do -- goes to weekend thou.
etienne-lms commentedon Jan 22, 2021
Enjoy, and thanks for the contributions.
34 remaining items
vesajaaskelainen commentedon Aug 10, 2021
Fyi: OpenSC project has made release of 0.22.0 which includes crash fixes for pkcs11-spy. So with that you should be able to run whole google's pkcs11test suite with spy enabled. You may want to upgrade your tooling.
vesajaaskelainen commentedon Aug 10, 2021
What shall we do for DES/3DES? They are deprecated but still used by test suites mainly. Is there are need to have those for some FIPS/CC or such validation?
github-actions commentedon Sep 10, 2021
This issue has been marked as a stale issue because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this issue will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.
github-actions commentedon Oct 11, 2021
This issue has been marked as a stale issue because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this issue will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.
vesajaaskelainen commentedon Jul 30, 2023
@jforissier could you un-pin this issue?
jforissier commentedon Aug 4, 2023
Sorry, what do you mean?
vesajaaskelainen commentedon Aug 4, 2023
If you look at the "Issues" tab in github then you can see this issue at the top.
"ruchi393 pinned this issue on Jan 22, 2021"
So I assume there is a way to unpin it if you have enough access.
jforissier commentedon Aug 4, 2023
Got it.
Done!