Symmetric MAC support

[optnfast]

At present crypto11 only supports asymmetric keys. We would like to extend it to support symmetric ciphers too. This issue covers the relevant integrity interfaces and the issues that they raise.

• For confidentiality, see Symmetric Ciphers #6.
• For the implementation, see the experimental symmetric branch.

Interfaces

hash.Hash

crypto/hmac models HMACs as keyed hashes, using hash.Hash. There are three nontrivial methods:

• Write(). Adds input data to the MAC.
• Sum(). Retrieves the current MAC (or hash), but leaves it open for further updates.
• Reset(). Resets the MAC state.

Creating MACs

We have two options for creating MACs using an HSM-protected key. One is to buffer all the data and do a C_SignInit followed by C_Sign. This will behave badly for large messages.

The other is to do a C_SignInit followed by multiple C_SignUpdate call on each Write() and a C_SignFinal call when Sum() or Reset() is called. The possibility of getting intermediate values with multiple calls to Sum() would be lost (I don't think this is a big deal).

Verifying MACs

Go offers no interface for verifying a MAC without having the MAC of the input data in hand within the Go process. In other words it's not possible to use the C_Verify.... functions. This isn't an insurmountable problem but it does mean that processes that only verify must still have sign permission on MAC keys, reducing some of the value of protecting such keys with an HSM.

References

• PKCS#11 2.40 s5.11 Signing and MACing functions
• Go crypto/hmac
• Go hash