GoogleCloudPlatform / GoogleCloudPlatform/kms-integrations
Key generation not usable with standard PKCS#11 clients
- Dominant language
- C++
- Stars
- 47
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
The requirement for the vendor specific CKA_KMS_ALGORITHM in the private key template makes it impossible to use by other than custom developed clients.
One example:
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --list-slots
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --list-objects --token-label slot1 --login
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --keypairgen --key-type rsa:2048 --label "my_key" --usage-sign --token-label slot1 --login
vs
pkcs11-tool --module /opt/gcp/libkmsp11-1.1-linux-amd64/libkmsp11.so --list-slots
pkcs11-tool --module /opt/gcp/libkmsp11-1.1-linux-amd64/libkmsp11.so --list-objects --token-label cloudhsm --login
pkcs11-tool --module /opt/gcp/libkmsp11-1.1-linux-amd64/libkmsp11.so --keypairgen --key-type rsa:2048 --label "my_key" --usage-sign --token-label cloudhsm --login
error: PKCS11 function C_GenerateKeyPair failed: rv = CKR_TEMPLATE_INCONSISTENT (0xd1)
I don't claim that the PKCS11 specification forbids custom template attributes, but using them makes it not possible to use with already existing tools and product that already work with most other PKCS#11 HSMs on the market.
Contributor guide
Assessment
This issue has not been assessed yet.