search

p11-glue / p11-kit

Provides a way to load and enumerate PKCS#11 modules.
https://p11-glue.github.io/p11-glue/p11-kit.html
Other
149 stars 91 forks source link

Add support for new mechanisms, for example SHA3 ones while remoting #630

Open Jakuje opened 5 months ago

Jakuje commented 5 months ago

I think they are visible ok for local operations, but according to my observation, they are lost when they travel through the client-server connection. The example I used, locally shows 79, but if I jump over to remoting, I get only 46 mechanisms:

$ PKCS11SPY=/usr/lib64/p11-kit-proxy.so pkcs11-tool -M --module /usr/lib64/pkcs11-spy.so
6: C_GetMechanismList
P:1711911; T:0x140709859439360 2024-03-14 16:17:13.616
[in] slotID = 0x11
[out] pMechanismList[79]: 
 CKM_RSA_PKCS_KEY_PAIR_GEN     
 CKM_RSA_PKCS                  
 CKM_SHA1_RSA_PKCS             
 CKM_RSA_PKCS_OAEP             
 CKM_RSA_PKCS_PSS              
 CKM_SHA1_RSA_PKCS_PSS         
 CKM_SHA256_RSA_PKCS           
 CKM_SHA384_RSA_PKCS           
 CKM_SHA512_RSA_PKCS           
 CKM_SHA256_RSA_PKCS_PSS       
 CKM_SHA384_RSA_PKCS_PSS       
 CKM_SHA512_RSA_PKCS_PSS       
 CKM_SHA224_RSA_PKCS           
 CKM_SHA224_RSA_PKCS_PSS       
 CKM_SHA3_256_RSA_PKCS         
 CKM_SHA3_383_RSA_PKCS         
 CKM_SHA3_512_RSA_PKCS         
 CKM_SHA3_256_RSA_PKCS_PSS     
 CKM_SHA3_384_RSA_PKCS_PSS     
 CKM_SHA3_512_RSA_PKCS_PSS     
 CKM_SHA3_224_RSA_PKCS         
 CKM_SHA3_224_RSA_PKCS_PSS     
 CKM_SHA_1                     
 CKM_SHA_1_HMAC                
 CKM_SHA_1_HMAC_GENERAL        
 CKM_SHA256                    
 CKM_SHA256_HMAC               
 CKM_SHA256_HMAC_GENERAL       
 CKM_SHA224_HMAC               
 CKM_SHA224_HMAC_GENERAL       
 CKM_SHA384                    
 CKM_SHA384_HMAC               
 CKM_SHA384_HMAC_GENERAL       
 CKM_SHA512                    
 CKM_SHA512_HMAC               
 CKM_SHA512_HMAC_GENERAL       
 Unknown Mechanism (000002b0)  
 Unknown Mechanism (000002b1)  
 Unknown Mechanism (000002b2)  
 Unknown Mechanism (000002b3)  
 Unknown Mechanism (000002b6)  
 Unknown Mechanism (000002b7)  
 Unknown Mechanism (000002b8)  
 Unknown Mechanism (000002c0)  
 Unknown Mechanism (000002c1)  
 Unknown Mechanism (000002c2)  
 Unknown Mechanism (000002c3)  
 Unknown Mechanism (000002d0)  
 Unknown Mechanism (000002d1)  
 Unknown Mechanism (000002d2)  
 Unknown Mechanism (000002d3)  
 CKM_GENERIC_SECRET_KEY_GEN    
 CKM_EC_KEY_PAIR_GEN           
 CKM_ECDSA                     
 CKM_ECDSA_SHA1                
 CKM_ECDSA_SHA256              
 CKM_ECDSA_SHA384              
 CKM_ECDSA_SHA512              
 CKM_ECDSA_SHA3_224            
 CKM_ECDSA_SHA3_256            
 CKM_ECDSA_SHA3_384            
 CKM_ECDSA_SHA3_512            
 CKM_AES_KEY_GEN               
 CKM_AES_ECB                   
 CKM_AES_CBC                   
 CKM_AES_CBC_PAD               
 CKM_AES_CTR                   
 CKM_AES_GCM                   
 CKM_AES_CCM                   
 CKM_AES_CTS                   
 CKM_AES_OFB                   
 CKM_AES_CFB8                  
 CKM_AES_CFB128                
 CKM_AES_CFB1                  
 Unknown Mechanism (00004003)  
 Unknown Mechanism (00004004)  
 Unknown Mechanism (00004005)  
 Unknown Mechanism (00004006)  
 Unknown Mechanism (00004007)  
Returned:  0 CKR_OK
$  eval $(p11-kit server "pkcs11:manufacturer=Kryoptic")
$ PKCS11SPY=/usr/lib64/p11-kit-client.so pkcs11-tool -M --module /usr/lib64/pkcs11-spy.so
6: C_GetMechanismList
P:1712634; T:0x140651812217600 2024-03-14 16:20:39.561
[in] slotID = 0x11
[out] pMechanismList[46]: 
 CKM_RSA_PKCS_KEY_PAIR_GEN     
 CKM_RSA_PKCS                  
 CKM_SHA1_RSA_PKCS             
 CKM_RSA_PKCS_OAEP             
 CKM_RSA_PKCS_PSS              
 CKM_SHA1_RSA_PKCS_PSS         
 CKM_SHA256_RSA_PKCS           
 CKM_SHA384_RSA_PKCS           
 CKM_SHA512_RSA_PKCS           
 CKM_SHA256_RSA_PKCS_PSS       
 CKM_SHA384_RSA_PKCS_PSS       
 CKM_SHA512_RSA_PKCS_PSS       
 CKM_SHA224_RSA_PKCS           
 CKM_SHA224_RSA_PKCS_PSS       
 CKM_SHA_1                     
 CKM_SHA_1_HMAC                
 CKM_SHA_1_HMAC_GENERAL        
 CKM_SHA256                    
 CKM_SHA256_HMAC               
 CKM_SHA256_HMAC_GENERAL       
 CKM_SHA224_HMAC               
 CKM_SHA224_HMAC_GENERAL       
 CKM_SHA384                    
 CKM_SHA384_HMAC               
 CKM_SHA384_HMAC_GENERAL       
 CKM_SHA512                    
 CKM_SHA512_HMAC               
 CKM_SHA512_HMAC_GENERAL       
 CKM_GENERIC_SECRET_KEY_GEN    
 CKM_EC_KEY_PAIR_GEN           
 CKM_ECDSA                     
 CKM_ECDSA_SHA1                
 CKM_ECDSA_SHA256              
 CKM_ECDSA_SHA384              
 CKM_ECDSA_SHA512              
 CKM_AES_KEY_GEN               
 CKM_AES_ECB                   
 CKM_AES_CBC                   
 CKM_AES_CBC_PAD               
 CKM_AES_CTR                   
 CKM_AES_GCM                   
 CKM_AES_CTS                   
 CKM_AES_OFB                   
 CKM_AES_CFB8                  
 CKM_AES_CFB128                
 CKM_AES_CFB1                  
Returned:  0 CKR_OK

Not all of the mechanisms are supported by the OpenSC/pkcs11-spy either for now so some show unknown mechanism, but I think the remoting should not strip the basic ones, such as the SHA3, which should not make any difference on the wire from SHA2 for p11-kit.