Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RFC7512 URI support #104

Open
dwmw2 opened this issue May 26, 2023 · 1 comment
Open

RFC7512 URI support #104

dwmw2 opened this issue May 26, 2023 · 1 comment

Comments

@dwmw2
Copy link

dwmw2 commented May 26, 2023

Please support specifying tokens/keys using the standard RFC7512 URI format.

Well-behaved applications supporting e.g. client SSL certificates ought to automatically accept a PKCS#11 URI specifying the key and/or certificate to be used. All the user needs to do is give e.g. pkcs11:manufacturer=piv_II;id=%01 in place of a filename, and it should work.

It is not clear how an application author could achieve this using crypto11. I'd like to see a simple function which takes a URI (or pair of URIs for cert and key if they need separate identifiers), and returns the cert and Signer objects.

It should use the system p11-kit-proxy.so provider by default, and load the providers which are correctly configured in the system. Nothing but the URI should be needed in the normal case.

See https://www.infradead.org/openconnect/pkcs11.html for example user documentation for what I considered a "well-behaved application" where PKCS#11 "Just Works".

@dwmw2
Copy link
Author

dwmw2 commented Jun 13, 2023

This code, in particular: https://github.com/ThalesIgnite/crypto11/blob/a81014c7c41025fb5533c0c6b1b14bec016be695/crypto11.go#L285-L298 would benefit from just taking a standard URI and being able to select the token based on it. I normally document using pkcs11:manufacturer=piv_II to select a PIV token on a Yubikey, but that doesn't seem to be supported here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant