Upgrade to pkcs11 v3

[miekg]

proof of concept to upgrade to v3 of pkcs11

Signed-off-by: Miek Gieben miek@miek.nl

[madisapsalon]

Hi @miekg
May you predict when the merge to master will happen?

[miekg]

[ Quoting ***@***.***> in "Re: [miekg/pkcs11] Upgrade to pkcs1..." ]

Hi @miekg May you predict when the merge to master will happen?

I don't know how backwards compatible this stuff is... if its 100%, we could merge any time

[zosocanuck]

Hi @miekg May you predict when the merge to master will happen?

I'd also love to see when this merge will happen as I'd like to see if this can be added to sigstore/cosign (via PKCS#11), for testing with ed25519.

[pdtgct]

@miekg and @zosocanuck please include me in the conversation. I may test this first in my fork, at github.com/pdtgct/pkcs11

[pravinrajr9]

@miekg can we know when this will get merged into master?

[phlipse]

Any support for testing needed? I'd love to see ed25519 support as well.

[vanbroup]

Version 3.1 was published on July 23, 2023:
https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/include/pkcs11-v3.1/

[miekg]

[ Quoting ***@***.***> in "Re: [miekg/pkcs11] Upgrade to pkcs1..." ]

Version 3.1 was published on July 23, 2023: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/include/pkcs11-v3.1/

Ah nice, time to merge this then at some point.

[pdtgct]

Fixed conflicts in this PR: #179 -- @phlipse , @vanbroup would you like to test on this? It passes local unit tests using SoftHSM v2.6.1 so it is backward compatible but SoftHSM does not support PKCS#11 3.0 or greater, see SoftHSMv2 Issue #604. I have not tested using PKCS#11 3.0 using OpenSC and an emulator or real smart card.

[matthewhughes934]

but SoftHSM does not support PKCS#11 3.0 or greater

It looks like it does now, the linked issue is closed.

Since conflicts for this branch are in generated files I see they can be resolved automatically, with tests passing:

git rebase master ; \
    go generate ./... && \
    go test ./... && 
    git add --update . && 
    GIT_EDITOR=true git rebase --continue

I only tested with SoftHSMv2 since installing SoftHSMv1 required an older version of Botan that I couldn't be bothered tracking down. The only differences I noticed was that I had to provide --so-pin 1234 in addition to the other arguments listed in the README for softhsm --init-token (otherwise it prompted for a pin) and some extra files in test_data: a .generation and a .token.lock file, though I'm not sure if the old library also generated those but they were just never committed.

I'm happy to help/support however I can to get this change merged.

[spencerpogo]

v3.2 is out now: https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.2/cs01/include/pkcs11-v3.2/