PKCS#11 providers: security modules used as cryptographic backends
summary
Adds PKCS#11 support into OpenSSL and GnuTLS so HSMs or software tokens plug in as drop‑in crypto backends. GnuTLS loads a module path via its global priority file, initializes a provider from the module function list, and replaces the nettle backend with a PKCS#11 backend. Demo uses a cryoptic module and pkcs11-spy proxy to record sessions: public key import, RSA encrypt and private key import, RSA decrypt yielding "hello there" successfully. OpenSSL provider ships in Fedora 42; GnuTLS provider is functional but needs more testing and better PIN handling.
AI-written summary · about
chapters (7)
- 0:00PKCS#11 providers intro
- 1:47Benefits of PKCS#11 providers
- 3:58PKCS#11 integration with libraries
- 4:19Live demo: PKCS#11 with GNU TLS
- 7:32PKCS#11 communication log analysis
- 10:03PKCS#11 providers development status
- 11:42Q&A
related talks
38mBuilding an OpenSSL 3 provider for PKCS11
48mA PKCS #11 Signing Provider for OpenSSL
29mIntegrating PQC in OpenSSL & Firefox via Loadable Modules for Cryptographic Agility
52mBuild secure key management services in OP-TEE
44mVault at the Center of the PCKS#11 and Key Management Ecosystems
29mThe Go Cryptography State of the Union
28mA Deep Dive Into Advanced TLS
36mYou Like It Or Not; You Need It! - PKI And Certificate Management