Prints a dump of all objects found in the OSSL store

[gilweis]

Hi,
I am trying to write code that dump the information of the objects present in the HSM using pkcs11-provider (like pkcs11-tool --module pkcs11-module.so -O).
I'm using openssl STORE_INFO_get0_() functions.
The only function that return value is OSSL_STORE_INFO_get_type()
I need the attributes of the objects that C_GetAttributeValue() return but I didn't find how to get the data via pkcs11-provider.

[simo5]

pkcs11-provider does not exposes all of the information available on PKCS#11 Objects via the OpenSSL store api because that is not the goal. The goal of the project is to provide access to perform cryptography operations with the keys in the HSM to applications written to use the OpenSSL APIs.

Some information is available because OpenSSL already has interfaces to show that information ab out keys. Like public key values, key types, etc..

For general access to key info in theory we can add custom pkey parameters that you can source from an EVP_PKEY, like the pkcs11-uri.

What attributes specifically are you looking to print that are missing?

[gilweis]

Hi,
I have a linked set of three objects consists of a Private Key, a Public Key, and an X.509 Certificate in my HSM. They are linked together logically on a token or smart card using the CKA_ID attribute to ensure they belong to the same key pair.
Private Key Object (CKO_PRIVATE_KEY)
Public Key Object (CKO_PUBLIC_KEY)
Certificate Object (CKO_CERTIFICATE)
Linking these three objects is a common and recommended method of storing objects in HSM.

Each one of them has a label (object description - CKA_LABEL).
The input to my program is the object name of the certificate in the HSM. for example if the HSM is yubikey5 the input will be:
"pkcs11:object=X.509 Certificate for Digital Signature?pin-value=123456"
The progam need to find the object, get the id ("CKA_ID" object attribute) and then find the private object (object with the same CKA_ID and type (CKA_CLASS) of private) and then execute cryptography operations with the key.
Currently I don't have a way to find the private key object in the HSM.

Another case is that I am signing with a private key and I am required to attach its certificate from the HSM to the signature. I have no way to find the certificate object that matches the private key by CKA_ID.

(dump of all objects was my attempt to understand what values ​​I can find in objects in HSM.)

[simo5]

Yes, this is a common use case, and in fact we have internal function to find "associated" keys (from a certificate or the other key of the pair), but this is not exposed in a direct way to OpenSSL.

In order to expose CKA_ID we'd have to add parameters you can query with a custom identifier from key objects, however there is no way really to provide that info for certificates with the current OpenSSL structure, as they get exported immediately from the token into OpenSSL structures and additional attributes get lost.

The only way to match a public key to a certificate in OpenSSL is to use X509_get0_pubkey(cert) and then compare the resulting key to a target key (which may require you to cycle through all the keys in the worst case).

Unfortunately this is a weak area, and requires modifications to OpenSSL to do this through OpenSSL APIs directly.

In theory you could try to force the import of a public key obtained from the cert into the pkse11 provider, this will cause it to internally search the token to see if that public key is already in the token, and that will give you a handle to the public key on the token.
But finding the associated private key wouldn't be easy after that.

@beldmit @Jakuje is there some OpenSSL API I may be forgetting about that would make this possible ?

[Jakuje]

I do not think there is a better way than you suggest. If you know the ID in advance instead of the label, just searching with the URI containing the ID will give you both certificate and private key you can use, I think.

[gilweis]

Working with ID is less recommended because when I generate a key pair and certificate in an HSM I am forced to choose a free ID whereas when I work with object name I can ensure that no matter which HSM I am working with I can find the ID by name and from there continue cryptographic operations with the objects belonging to that ID.
This is a capability worked well with openssl engine and it is highly desirable to preserve it also when working with pkcs11 provider.