parallaxsecond / parallaxsecond/rust-cryptoki
Compatibility issues with Luna HSM
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 115
- Forks
- 96
- Avg merge
- 22h 56m
- Merged PRs (30d)
- 2
Description
Issue
I cannot init_token with my HSM using cryptoki in my Rust application.
However, it works with SoftHSM2.
I also manage to init a token using my HSM client binary (not my Rust application).
Context
I'm using an HSM with a PIN Entry Device (PED) (see what is a PED).
It's a device, linked to the HSM, that requires to plug dongle (USB stick) for authentification.
To connect as SO, it's not possible to set a PIN. It is mandatory to use the PED.
So instead of entering a PIN on my PC, I plug a dongle on the PED to login.
For example, if I want to open a session I use this line :
let session = pkcs11.open_rw_session(slot)?;
session.login(UserType::So, None)?
NOTE: I use None to indiacte to use the protected authentication path, in this case, it's the PED.
NOTE2: However, to login as UserType::User, I am allowed to set a PIN, in order to avoid using the PED. In this case, I use Some(&pin) to login as a User.
How to reproduce
If I use SoftHSM2, I indicate a pin I set beforehand (eg. "1234") and it works perfectly. But if I use my HSM, there's not pin set for the SO, so I indicate en empty pin (eg. "").
let slot = pkcs11.get_slots_with_initialized_token()?[0];
let pin = AuthPin::new(String::from(""));
pkcs11.init_token(slot, &pin, "reinitialized")?;
init_token raises a CryptokiError(Pkcs11(GeneralError)).
Expected behaviour
Indicate "" (empty) pin and init the token successfully (that's what I'm doing using the HSM client binary), or using None, like in login().
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue using the init_token example with SoftHSM2 and the Luna HSM, comparing the empty AuthPin behavior with the working HSM client binary. Start by tracing the init_token API alongside open_rw_session and login; done means protected-authentication-path initialization works for the Luna HSM or the limitation is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100