A PKCS #11 Signing Provider for OpenSSL
summary
Builds a pkcs11-sign provider that lets OpenSSL 3.x call HSM signing operations via PKCS #11 while keeping ephemeral ECDH and symmetric work in software, splitting TLS keys into two key subspaces (HSM-protected signing keys vs. non-HSM ephemeral keys). Implements signing by calling PKCS #11, forwards derives/verifies to the default provider for performance, and tests with OpenCryptoki and Apache (requires Apache -X). Works functionally but requires PIN-in-URI handling, session and C_Initialize care, and some OpenSSL provider limitations.
AI-written summary · about
chapters (13)
- 0:00PKCS #11 signing provider intro
- 2:07Identity theft threats in TLS
- 7:49TLS protocol and key types
- 12:26High-risk vs low-risk keys
- 14:12OpenSSL-PKCS #11 integration challenges
- 23:12ECDH key derivation solution
- 27:05PKCS #11 tokens and sessions
- 29:56PKCS #11 signing provider design
- 34:17Comparison with other PKCS #11
- 36:48OpenSSL provider improvements
- 39:23Missing symmetric keys support
- 40:07Conclusion and future outlook
- 41:52Q&A
related talks
38mBuilding an OpenSSL 3 provider for PKCS11
15mPKCS#11 providers: security modules used as cryptographic backends
27mImplementing Post Quantum algorithms in PKCS #11
23mHSMs in Plain Envelopes: A Code Signing Story
24mHSM Advances Supporting quantum-safe PKI Automation
50mBuild code signing and crypto PKI tooling
32mPQC in OpenSSL Library
24mUpdate on end-to-end PKI and HSM integrations with ML-DSA