pkcs11 | pkcs11 wrapper for Go

I have a signing key that I need to safely store.

What I used to do, was store it directly in the Hardware available on that same host (TPM2.0, using pkcs11 API). Now I am moving my services to Kubernetes, I have tried googling "Kubernetes TPM" but everything I have found was securing Kubernetes with a remote TPM (Via a Key Management System), not on the host itself. Is using the hardware located on the node an anti-pattern (Because I see very little about using the node TPM with Kubernetes)? What is the thing that is most commonly done to protect those signing keys (aside from KMS)?

Thanks!

My problem concern the usage of an hsm with Java (openjdk 11.0.12). Hsm should be use for signature purpose, by SHA512 RSA algorithm. I could be wrong in a lot of the following sentences, I'm totally newbie with HSM & co, so I apologize in advance.

For what I've understand there are three kinds of approaches:

1- Using SUNPKCS11 provider

2- Using vendor lib (hsm is shipped with a couple of jar, in my case nCipher is shipped with nCipherKM.jar, which should be vendor provider.)

3- openssl (we have some software in c already doing this, I prefer to avoid)

The usage of vendor lib it's really easy, at least until the Get info call, which send an Unknown Parameter to HardServer, causing an unmarshable exception. This is difficult to debug, communication protocol isn't documented. Right now I've put this solution aside.

In any case I prefer the SUNPKCS11 solution, it doesn't work out of the box for me, but it was simple to debug and analyze. And should be a standard.

In this case i'm using European DSS library to interface with PKCS11Provider, making things a little simpler for me to configure and implement.

The problem occurs during SunPKCS11 (vanilla) initialization.

At some point it calls a method "P11Keystore.mapLabels()" that match, according to code and Oracle documentation, all private key handlers (CKA_PRIVATE_KEY) coming from that slot with certificate handlers (CKO_CERTIFICATE), looking for matching between cka_id, in order to build a software in memory keystore with aliases map containing the CKA_LABEL attributes. (Private key is unextractable so access is read only https://docs.oracle.com/javase/8/docs/technotes/guides/security/p11guide.html#KeyStoreRestrictions)

In signature initialization this private key entry is used to fetch from HSM (by some key attributes that I don't have) the private key handler.

The problem is that my hsm nCipher doesn't expose any object for CKO_CERTIFICATE, so the match returns 0 result and my software keystore is empty.

When I try to extract the private key handler from keystore I obtain nothing and I cannot initialize Signature object.

My predecessor manually wrapped the private key attributes inside a local jks, and rewrote a new provider in order to load certificate from file and not from HSM/PKCS11.

I dislike this solution, I don't want my application to have configuration depending on HSM certificate.. it's HSM certificate job to handle those keys, not mine.

Instead, I wrote another provider to fetch and use directly the private key handler, from CKA_PRIVATE_KEY, using a preconfigured CKA_LABEL, bypassing the certificate match. And it works.

However I dislike this solution too, it means more maintenance costs for a standard protocol, and the jar must be signed each time, which for me is a nuisance.

I have the feeling that I am approaching the problem from the wrong side, maybe because I'm a noob in the matter.

Explanation are over, so here my questions: 1- Am I wrong to claim that CKO_CERTIFICATE is a prerequisite for SunPKCS11? 1- Could/Should HSM expose CKO_CERTIFICATE object without malevolent side effects? 2- Is this missing object a limitation of nCipher HSM or, probably, a configuration missing during installation? (It works even without so it's a java prerequisite more than an HSM missing) 3- If the CKO_CERTIFICATE cannot be installed and exposed: Is it ok to implement our own provider to obtain the workaround, or could exist a better way to get it working?

Sorry for my English, I'm not a native one. Thanks to those who have come to read up to here and who will answer.

I'm using OpenSC's PKCS11 engine for OpenSSL. I want to obtain the logs from OpenSC, also I want to force a login. According to https://github.com/OpenSC/libp11/blob/master/README.md I can do so with the VERBOSE and FORCE_LOGIN parameters, but where do I put them?

I tried to put them into the corresponding OpenSSL config section:

Using a MacBook Pro, Big Sur OS, I followed the hyperledger fabric documentation, I installed all the required files and tools. However, when I reached to the final step, the code generated a goimports error that I am not able to repair. The Error was the following:

I'm working on an automating a hashicorp vault process, and I need to repeatedly run the vault operator init command because of trial and error testing, I tried uninstalling vault and installing it again, but it seems like that doesn't remove the previous unseal keys + root token it generates, how can I do this?

I read somewhere that I needed to delete my storage "file" path which I already did but its not working (Actually my /opt/vault/data/ directory is empty), here is my vault.hcl file:

I'm trying to use AWS IoT embedded C SDK.
After compiling, every demo works just fine, except for the fleet_provisioning demo.

SDK version used: 202108.00

logs:

I am running Hyperledger Fabric v2.2.3 from github release, in Oracle Linux 8.4
https://github.com/hyperledger/fabric/releases/download/v2.3.3/hyperledger-fabric-linux-amd64-2.3.3.tar.gz

I am running the orderer and peer without dockers.
and I am running PKCS11 using SoftHSM 2.5.0 without FabricCA.
I have also followed the guide at official document to setup the PKCS11.
https://hyperledger-fabric.readthedocs.io/en/release-2.2/hsm.html
I have also read this stackoverflow post stating that need to remove the SW section.
peer node start throwing Could not find default pkcs11 BCCSP error

I successfully generated the token, the certs for both Orderer and Peer.
My Orderer started everythings successfully, but not my Peer.

Question: is the pre-built peer binary in github release for v2.2.3 is not built with PKCS11 enabled ?
Am I need to build the peer myself to enable the PKCS11 support ?

I'm building a 32 bits embedded device that an external actor can communicate with through a PKCS#11 interface.

Basically there are 3 components :

• Our embedded device (only supports 32 bits)
• The host (may be 32 or 64 bits, not up to me)
• The host library (can be compiled in 32 or 64 bits)

I'm developing both the device and the host library and my main issue right now is to ensure compatibility with both 32 and 64 bits host applications.

The pkcs11t.h defines CK_ULONG as such :

I followed the guide in the page linphone-sdk and also run these with the MSYS2 MSYS command in Windows 10: