Building an OpenSSL 3 provider for PKCS11
summary
A working OpenSSL 3 OpenSSL provider for PKCS#11 is implemented as a loadable module that translates OpenSSL provider calls to PKCS#11 driver calls, supports PINs in config, and lists keys via pkcs11 URI lookup (demo returns 12 keys). Development uses heavy source reading, GDB, and trial‑and‑error to implement encoders/decoders and key manager hooks. It already interoperates with PKCS11‑kit as a PKCS11-kit proxy for multiple drivers and mostly works with OpenSSL consumers; next steps are integrating with OpenSSH/sshd.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:20Outline
- 0:43The problem
- 1:13What are providers
- 2:32What is a provider
- 3:23Provider vs engine
- 4:07What is the difference
- 6:01Available providers
- 6:55PKCS11 API
- 7:26PKCS11 Standard
- 8:54What is the PKCS7 Provider
- 9:30Goals for the PKCS11 Provider
- 12:42Configuration
- 13:57Print
- 15:15Writing a provider
- 18:43What are operations
- 20:09Function table
- 21:10Key retrieval Key management
- 22:40Signature operations
- 25:31Hard areas
- 27:54Next steps
- 28:41Summary
related talks
48mA PKCS #11 Signing Provider for OpenSSL
15mPKCS#11 providers: security modules used as cryptographic backends
29mIntegrating PQC in OpenSSL & Firefox via Loadable Modules for Cryptographic Agility
32mPQC in OpenSSL Library
52mBuild secure key management services in OP-TEE
27mImplementing Post Quantum algorithms in PKCS #11
44mVault at the Center of the PCKS#11 and Key Management Ecosystems
36mEnhancing Envoy: Certificate Handling at the Edge