new tool zpckey for UV key origins#43
Open
holger-dengler wants to merge 37 commits into
Open
Conversation
The new dependency to OpenSSL requires a custom built OpenSSL, as long it is available as distro package. This workaround can be removed, if OpenSSL v3.5 or later is available as distro package. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The zpc functionality will be exposed via the OpenSSL API. Query the required OpenSSL package during build. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The provider is the base to plug-in further implementation like key-management, ciphers and so on. It has no functionality itself. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The provider-specific key object structure is shared between the provider components and references to the internal zpc-key structure(s). Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
A hbkzpc-URI references a hardware-backed key origin. The parser destructs the URI into key-value pairs. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The mapping helpers provide mappings between e.g. algorithm strings and algorithm-related values. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Introduce a store-loader for hbkzpc-URI based keys. The store-loader creates a provider-specific key object and adds relevant information from the URI. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Introduce a asymmetric key management to map the provider-specific key object to a intern zpc-key. Not supported: - key generation - key import/export Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add helpers to generate DER-encoded algorithm-ids based on key and digest information. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add signature algorithms for sign/verify with ECDSA and EDDSA keys. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add the supported TLS properties of the hbkzpc provider. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The ASN.1 module provides DER en-/decoding for hbkzpc-URIs. These functions are required for the decoder/encoder support. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add decoders for PEM and DER to support hbkzpc-URI files. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
To use the zpc functionality via the OpenSSL API, the zpc provider has to be defined in the OpenSSL configuration. The build configures the template and creates a `openssl.cnf` file, which can be used for test purposes. The configuration file will be created in the build output folder. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add provider test framework with a base retrieval of the hbkzpc provider. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add tests for the sore-loader. It covers mainly the open()/load()/eof() sequence. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add test for loading a EVP PKEY object from a hbkzpc-URI via store and keymgmt. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add sign/verify tests for full and pre-hashed messages. The verification is checked across both variants. Note: The test covers only ECDSA and uses a hard-coded key origin. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add tests for the DER encoding. It takes the hard-coded ECDSA key and stores it as a file. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add simple decoder fetch test. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add tests to use hbkzpc-URI file for sign/verify (instead of loading the URI via store). Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Contributor
|
I would move the zpckey sources into a subdirectory, e.g. src/zpckey/. |
ifranzki
reviewed
May 6, 2026
Contributor
|
It seems that one can specify any garbage as hex UV ID, that garbage is passed right away to the URI. OK, garbage in -> garbage out.... But couldn't you validate that string that it is a valid hex string and if the correct size? I usually copy & paste the hex ID from 'pvsecret list' and it has 0x in front. zpckey accepts it, but later on when the URI is used it fails. So as best allow it to be prefixed with 0x and strip it off. Also check for other non-hex chars and the ID length to be 32 bytes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a new tool for managing the key origins for the zpcprovider. It covers key origins for UV retrievable secrets.
The PR is based on #41 , so only the last 3 commits are relevant for the review. This PR should not be merged before the other one.