GoogleCloudPlatform / GoogleCloudPlatform/kms-integrations

Key generation not usable with standard PKCS#11 clients

Open
#7 10 comments 3 reactions 0 assignees View on GitHub
feature request
Dominant language
C++
Stars
47
Forks
24
PR merge metrics
No merged PRs in 30d

Description

The requirement for the vendor specific CKA_KMS_ALGORITHM in the private key template makes it impossible to use by other than custom developed clients.

One example:
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --list-slots
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --list-objects --token-label slot1 --login
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --keypairgen --key-type rsa:2048 --label "my_key" --usage-sign --token-label slot1 --login

vs
pkcs11-tool --module /opt/gcp/libkmsp11-1.1-linux-amd64/libkmsp11.so --list-slots
pkcs11-tool --module /opt/gcp/libkmsp11-1.1-linux-amd64/libkmsp11.so --list-objects --token-label cloudhsm --login
pkcs11-tool --module /opt/gcp/libkmsp11-1.1-linux-amd64/libkmsp11.so --keypairgen --key-type rsa:2048 --label "my_key" --usage-sign --token-label cloudhsm --login
error: PKCS11 function C_GenerateKeyPair failed: rv = CKR_TEMPLATE_INCONSISTENT (0xd1)

I don't claim that the PKCS11 specification forbids custom template attributes, but using them makes it not possible to use with already existing tools and product that already work with most other PKCS#11 HSMs on the market.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.