lifetime of pkcs#11 objects created by the provider

[dlansky1]

Some pkcs#11 objects created by the provider have CKA_TOKEN=true.
The reason for that (if I got it right) is due to provider's pkcs#11 session management that is transparent to clients - so any session can use any key.

How is the system expected to deal with such token objects, i.e. when and by who should they get destroyed?

For example:
Application wants to generate a short term EC keypair and use it for some transaction. When transaction completes, that keypair is not needed anymore.
If this is a PKCS#11 client app, the app would open a PKCS#11 session, create session key objects (CKA_TOKEN=false) then use them then close the session which destroy (delete) them.

But in our case, the app is an OpenSSL client which allocates a PKEY then use it then free it.
pkcs11-provider translates this into GenerateKeyPair with CKA_TOKEN=true but when PKEY is freed, the keys are not deleted from the token. They persist "forever".
This is kind of resource leak and token would become full at some point.

Does pkcs11-provider count on some external entity for cleanup?
How this is expected to work?

[simo5]

Can you share how these keys are created? Is the application explicitly forcing generation of ephemeral keys on the token by explicitly forcing the use of the a EVP_KEYMGMT handle from the pkcs11 provider?

Unfortunately at this time there isn't a way to ask pkcs11-provider to create ephemeral keys, this is not information that openssl has any knowledge of and the applications have no way to signal that the intent is to create a key that does not need to be stored.

Generally pkcs11-provider is used to bridge to HW tokens therefore ephemeral keys are generally not generated on "slower" tokens and handled purely in OpenSSL.

However for EVP_SKEYs we have added the ability to pass a custom parameter defined P11PROV_PARAM_EPHEMERAL (named "pkcs11_ephemeral"), we could extend this to be applicable to asymmetric keys as well.

[dlansky1]

The application is doing something like:
pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
EVP_PKEY_keygen_init(pctx);
EVP_PKEY_CTX_set_params(pctx, params); // params contains curve_name
EVP_PKEY_generate(pctx, &pkey);

When using P11PROV_PARAM_EPHEMERAL, when would the ephemeral keys get destroyed? I mean, app is not aware of session management in pkcs11-provider.
Would the keys get destroyed upon app shutdown, when all cached sessions are closed?

[simo5]

Yes, ephemeral key s are destroyed when the application shuts down.
In theory we could intentionally destroy them when the last handle to a key is freed for ephemerals, but I do not think we do that yet.

[dlansky1]

One use case for ephemeral key generation via the provider is when a keypair is used in ECDH operation.
After ECDH completes (with the generation of shared secret), the original keypair can be deleted.

I think it makes sense to extend P11PROV_PARAM_EPHEMERAL for asymmetric keys.
I also think it would be better to explicitly destroy the ephemeral objects when handle is freed. Otherwise, in case of repeating keypair generation (let's say I need to renew ECDH every now and then), storage would get exhausted.

BTW, "always generate as TOKEN object", in addition to the lifetime aspect, has another aspect of object isolation.
As TOKEN object, any app/session can access it, even from outside the provider. Supporting P11PROV_PARAM_EPHEMERAL will improve isolation as it can be accessed only from that specific provider session.