Skip to content

Add PKCS#11 provider support for key generation #682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtrojnar merged 3 commits into from
Sep 4, 2026
Merged

Add PKCS#11 provider support for key generation #682

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
683aeee
Add PKCS#11 provider support for key generation
olszomal Aug 25, 2026
02a3836
Preserve generated public key association
olszomal Sep 4, 2026
179b6bf
Add EC regression test for duplicate key IDs
olszomal Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ tests/fork-change-slot-prov
tests/rsa-oaep-prov
tests/rsa-pss-sign-prov
tests/rsa-keygen
tests/ec-duplicate-key
tests/ec-keygen
tests/ec-derive
tests/ec-derive-prov
Expand Down
1 change: 1 addition & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ New in 0.4.21; unreleased
As a compatibility regression, registering PKCS11_pkey_meths() directly as
an ENGINE callback now leaks methods; use the bundled engine, which caches
methods per ENGINE.
* Added PKCS#11 provider support for `openssl genpkey` (Małgorzata Olszówka)

New in 0.4.20; 2026-08-08; Michał Trojnara
* Added PKCS#11 3.2 interface discovery and updated the bundled header
Expand Down
17 changes: 9 additions & 8 deletions src/libp11-int.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ struct pkcs11_object_private {
PKCS11_SLOT_private *slot;
CK_OBJECT_CLASS object_class;
CK_OBJECT_HANDLE object;
CK_OBJECT_HANDLE public_object;
CK_BBOOL always_authenticate;
unsigned char id[255];
size_t id_len;
Expand Down Expand Up @@ -416,48 +417,48 @@ extern int pkcs11_generate_random(PKCS11_SLOT_private *, unsigned char *r, unsig
/* Generate and store a private key on the token */
extern int pkcs11_rsa_keygen(PKCS11_SLOT_private *tpriv,
unsigned int bits, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);

#ifndef OPENSSL_NO_EC
extern int pkcs11_ec_keygen(PKCS11_SLOT_private *tpriv,
const char *curve , const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);
#endif /* OPENSSL_NO_EC */

#if !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L
extern int pkcs11_eddsa_keygen(PKCS11_SLOT_private *tpriv,
int nid, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);

extern int pkcs11_xdh_keygen(PKCS11_SLOT_private *tpriv,
int nid, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);
#endif /* !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L */

#if OPENSSL_VERSION_NUMBER >= 0x30500000L
#ifndef OPENSSL_NO_ML_DSA
extern int pkcs11_mldsa_keygen(PKCS11_SLOT_private *tpriv,
int nid, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);
#endif /* OPENSSL_NO_ML_DSA */

#ifndef OPENSSL_NO_ML_KEM
extern int pkcs11_mlkem_keygen(PKCS11_SLOT_private *tpriv,
int nid, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);
#endif /* OPENSSL_NO_ML_KEM */

#ifndef OPENSSL_NO_SLH_DSA
extern int pkcs11_slhdsa_keygen(PKCS11_SLOT_private *tpriv,
int nid, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);
#endif /* OPENSSL_NO_SLH_DSA */
#endif /* OPENSSL_VERSION_NUMBER >= 0x30500000L */

#if OPENSSL_VERSION_NUMBER >= 0x30000000L
extern int pkcs11_falcon_keygen(PKCS11_SLOT_private *tpriv,
int nid, const char *label, const unsigned char *id,
size_t id_len, const PKCS11_params *params);
size_t id_len, const PKCS11_params *params, PKCS11_KEY **ret_key);
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */

/* Get the RSA key modulus size (in bytes) */
Expand Down
1 change: 1 addition & 0 deletions src/libp11.exports
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ PKCS11_init_token
PKCS11_init_pin
PKCS11_change_pin
PKCS11_generate_key
PKCS11_generate_key_ext
PKCS11_store_private_key
PKCS11_store_public_key
PKCS11_store_certificate
Expand Down
5 changes: 5 additions & 0 deletions src/libp11.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -572,6 +572,11 @@ extern int PKCS11_generate_key(PKCS11_TOKEN *token,
int algorithm, unsigned int bits_or_nid,
char *label, unsigned char *id, size_t id_len);

extern int PKCS11_generate_key_ext(PKCS11_TOKEN *token,
int algorithm, unsigned int bits_or_nid,
char *label, unsigned char *id, size_t id_len,
PKCS11_KEY **ret_key);

/* Get the RSA key modulus size (in bytes) */
extern int PKCS11_get_key_size(PKCS11_KEY *);

Expand Down
50 changes: 38 additions & 12 deletions src/p11_front.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,7 +440,8 @@ int PKCS11_set_ui_method(PKCS11_CTX *pctx, UI_METHOD *ui_method, void *ui_user_d

/* External interface to the deprecated features */

int PKCS11_keygen(PKCS11_TOKEN *token, PKCS11_KGEN_ATTRS *kg)
static int pkcs11_keygen_internal(PKCS11_TOKEN *token, PKCS11_KGEN_ATTRS *kg,
PKCS11_KEY **ret_key)
{
PKCS11_SLOT_private *slot;

Expand All @@ -454,21 +455,25 @@ int PKCS11_keygen(PKCS11_TOKEN *token, PKCS11_KGEN_ATTRS *kg)
switch(kg->type) {
case EVP_PKEY_RSA:
return pkcs11_rsa_keygen(slot, kg->kgen.rsa->bits,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#ifndef OPENSSL_NO_EC
case EVP_PKEY_EC:
return pkcs11_ec_keygen(slot, kg->kgen.ec->curve,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#endif /* OPENSSL_NO_EC */
#if !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L
case EVP_PKEY_ED25519:
case EVP_PKEY_ED448:
return pkcs11_eddsa_keygen(slot, kg->kgen.nid->nid,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
case EVP_PKEY_X25519:
case EVP_PKEY_X448:
return pkcs11_xdh_keygen(slot, kg->kgen.eddsa->nid,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#endif /* !defined(OPENSSL_NO_ECX) && OPENSSL_VERSION_NUMBER >= 0x30000000L */

#if OPENSSL_VERSION_NUMBER >= 0x30500000L
Expand All @@ -477,15 +482,17 @@ int PKCS11_keygen(PKCS11_TOKEN *token, PKCS11_KGEN_ATTRS *kg)
case EVP_PKEY_ML_DSA_65:
case EVP_PKEY_ML_DSA_87:
return pkcs11_mldsa_keygen(slot, kg->kgen.nid->nid,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#endif /* OPENSSL_NO_ML_DSA */

#ifndef OPENSSL_NO_ML_KEM
case EVP_PKEY_ML_KEM_512:
case EVP_PKEY_ML_KEM_768:
case EVP_PKEY_ML_KEM_1024:
return pkcs11_mlkem_keygen(slot, kg->kgen.nid->nid,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#endif /* OPENSSL_NO_ML_KEM */

#ifndef OPENSSL_NO_SLH_DSA
Expand All @@ -502,25 +509,28 @@ int PKCS11_keygen(PKCS11_TOKEN *token, PKCS11_KGEN_ATTRS *kg)
case EVP_PKEY_SLH_DSA_SHAKE_256S:
case EVP_PKEY_SLH_DSA_SHAKE_256F:
return pkcs11_slhdsa_keygen(slot, kg->kgen.nid->nid,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#endif /* OPENSSL_NO_SLH_DSA */
#endif /* OPENSSL_VERSION_NUMBER >= 0x30500000L */

#if OPENSSL_VERSION_NUMBER >= 0x30000000L
case EVP_PKEY_FALCON512:
case EVP_PKEY_FALCON1024:
return pkcs11_falcon_keygen(slot, kg->kgen.nid->nid,
kg->key_label, kg->key_id, kg->id_len, kg->key_params);
kg->key_label, kg->key_id, kg->id_len,
kg->key_params, ret_key);
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */

default:
return -1;
}
}

int PKCS11_generate_key(PKCS11_TOKEN *token, int algorithm,
int PKCS11_generate_key_ext(PKCS11_TOKEN *token, int algorithm,
unsigned int param, /* bits for RSA, nid for EC, unused for EdDSA */
char *label, unsigned char *id, size_t id_len)
char *label, unsigned char *id, size_t id_len,
PKCS11_KEY **ret_key)
{
PKCS11_params key_params = { .extractable = 0, .sensitive = 1 };
#ifndef OPENSSL_NO_EC
Expand All @@ -532,6 +542,9 @@ int PKCS11_generate_key(PKCS11_TOKEN *token, int algorithm,
PKCS11_RSA_KGEN rsa_kgen;
PKCS11_KGEN_ATTRS kgen_attrs = { 0 };

if (ret_key != NULL)
*ret_key = NULL;

switch (algorithm) {
#ifndef OPENSSL_NO_EC
case EVP_PKEY_EC:
Expand Down Expand Up @@ -872,7 +885,20 @@ int PKCS11_generate_key(PKCS11_TOKEN *token, int algorithm,
};
}

return PKCS11_keygen(token, &kgen_attrs);
return pkcs11_keygen_internal(token, &kgen_attrs, ret_key);
}

int PKCS11_generate_key(PKCS11_TOKEN *token, int algorithm,
unsigned int param, char *label,
unsigned char *id, size_t id_len)
{
return PKCS11_generate_key_ext(token, algorithm, param,
label, id, id_len, NULL);
}

int PKCS11_keygen(PKCS11_TOKEN *token, PKCS11_KGEN_ATTRS *kg)
{
return pkcs11_keygen_internal(token, kg, NULL);
}

int PKCS11_get_key_size(PKCS11_KEY *pkey)
Expand Down
Loading
Loading