Skip to content

zpcprovider for sign/verify (ecdsa/eddsa)#41

Open
holger-dengler wants to merge 39 commits into
opencryptoki:mainfrom
holger-dengler:provider-sign
Open

zpcprovider for sign/verify (ecdsa/eddsa)#41
holger-dengler wants to merge 39 commits into
opencryptoki:mainfrom
holger-dengler:provider-sign

Conversation

@holger-dengler
Copy link
Copy Markdown
Contributor

@holger-dengler holger-dengler commented Apr 10, 2026

This PR requires PR #40.

This PR adds OpenSSL provider support for libzpc. This first version covers the main functionality for store, keymgmt, sign/verify and decoder support.

As the series add a lot of new code, it is split into many commits to make the review (hopefully) a bit easier.

ToDo:

  • public key support for store/decoder
  • alloc/free needs some debugging

Restriction:

  • the tests uses hard-coded public keys, so running tests on other machines require code changes in tprovider.c.
  • the provider only supports uv origins, so testing is limited to SEL environments.

@ifranzki
Copy link
Copy Markdown
Contributor

ifranzki commented Apr 13, 2026

Are you looking at the Travis build failures? You might need to build OpenSSL from source to have a 3.5.0 version to build against.

@holger-dengler
Copy link
Copy Markdown
Contributor Author

holger-dengler commented Apr 13, 2026

Yes, a fix for the travis is in progress. It looks like travis only provides 3.0 out of the box. So I'll build my own. At least 3.5, better 4.0.

holger-dengler
holger-dengler commented Apr 13, 2026
View reviewed changes
Comment thread src/uri.c Outdated
ifranzki
ifranzki reviewed Apr 13, 2026
View reviewed changes
Comment thread src/provider.c Outdated
ifranzki
ifranzki reviewed Apr 13, 2026
View reviewed changes
Comment thread src/object.h Outdated
ifranzki
ifranzki reviewed Apr 13, 2026
View reviewed changes
Comment thread src/signature.c Outdated
ifranzki
ifranzki reviewed Apr 14, 2026
View reviewed changes
Comment thread src/signature.c
@holger-dengler holger-dengler force-pushed the provider-sign branch 2 times, most recently from 7c72889 to 1659e06 Compare May 2, 2026 15:53
@holger-dengler
Copy link
Copy Markdown
Contributor Author

holger-dengler commented May 2, 2026 •
edited
Loading

The update contains:

  • re-order of the commits (move test to the end of the series)
  • rework of signature/eddsa
  • pick review comments
  • minor fixes

@holger-dengler holger-dengler requested a review from ifranzki May 2, 2026 16:10
@holger-dengler
Copy link
Copy Markdown
Contributor Author

holger-dengler commented May 2, 2026

Another update (force push) to remove the merge conflicts and add a fix for travis.

@holger-dengler holger-dengler mentioned this pull request May 2, 2026
Open
@ifranzki
Copy link
Copy Markdown
Contributor

ifranzki commented May 4, 2026

I would suggest to also add tests that utilize the openssl application to use protected key origins. For example, creating/signing a certificate with a protected key origin specified via URI or PEM using openssl x509 -in cert.csr -out cert.pem -req -signkey <protected key origin> -days 1001.

ifranzki
ifranzki reviewed May 4, 2026
View reviewed changes
Comment thread CMakeLists.txt Outdated
@holger-dengler
Copy link
Copy Markdown
Contributor Author

holger-dengler commented May 4, 2026

I would suggest to also add tests that utilize the openssl application to use protected key origins. For example, creating/signing a certificate with a protected key origin specified via URI or PEM using openssl x509 -in cert.csr -out cert.pem -req -signkey <protected key origin> -days 1001.

I plan to rework the test. tprovider will be renamed (t_provider) and changed to do only the lookup for the provider components. All key-related functional test will be moved to a new t_openssl test script, which uses openssl to create keys and call the functions. such a split is required to run the tests in a CI.

ifranzki
ifranzki reviewed May 4, 2026
View reviewed changes
Comment thread src/provider.c Outdated
ifranzki
ifranzki reviewed May 4, 2026
View reviewed changes
Comment thread src/provider.c Outdated
ifranzki
ifranzki reviewed May 4, 2026
View reviewed changes
Comment thread src/provider.c Outdated
ifranzki
ifranzki reviewed May 4, 2026
View reviewed changes
Comment thread src/provider.c Outdated
ifranzki
ifranzki reviewed May 5, 2026
View reviewed changes
Comment thread src/keymgmt.c
ifranzki
ifranzki reviewed May 5, 2026
View reviewed changes
Comment thread src/keymgmt.c
ifranzki
ifranzki reviewed May 5, 2026
View reviewed changes
Comment thread src/keymgmt.c
@ifranzki
Copy link
Copy Markdown
Contributor

ifranzki commented May 5, 2026

I would move the provider sources into a subdirectory, e.g. src/provider/. Maybe even move the library sources into a subdirectory e.g. src/lib/.

@holger-dengler
Copy link
Copy Markdown
Contributor Author

holger-dengler commented May 5, 2026

I would postpone the source code restructuring until the provider transition is done (symmetric cipher, secure-key origins etc). There will be eventually also some removal of no longer used code.

ifranzki
ifranzki reviewed May 6, 2026
View reviewed changes
Comment thread openssl.cnf.in
@@ -0,0 +1,28 @@
HOME = .
Copy link
Copy Markdown
Contributor

@ifranzki ifranzki May 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about installing OpenSSL config snippets into /etc/pki/tls/openssl.d/ ? That way the user does not have to manually edit the OpenSSL config file, but the config snippet for your provider is automatically included, due to

#Place the third party provider configuration files into this folder
.include /etc/pki/tls/openssl.d

Copy link
Copy Markdown
Contributor Author

@holger-dengler holger-dengler May 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is planned for the next PR version. IMHO we need both, the current one for stand-alone testing purposes (without installing the provider), and the snippet for the install. For the latter I need to find out, how to get the OpenSSL module-directory.

Copy link
Copy Markdown
Contributor Author

@holger-dengler holger-dengler May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not yet included.

ifranzki
ifranzki reviewed May 12, 2026
View reviewed changes
Comment thread src/tls.c Outdated
ifranzki
ifranzki reviewed May 12, 2026
View reviewed changes
Comment thread src/tls.c Outdated
ifranzki
ifranzki reviewed May 12, 2026
View reviewed changes
Comment thread src/signature.c Outdated
ifranzki
ifranzki reviewed May 12, 2026
View reviewed changes
Comment thread src/signature.c Outdated
ifranzki
ifranzki reviewed May 12, 2026
View reviewed changes
Comment thread src/keymgmt.c Outdated
ifranzki
ifranzki reviewed May 12, 2026
View reviewed changes
Comment thread src/keymgmt.c Outdated
@holger-dengler
provider: Add asymmetric key management
e8b288d 
Introduce a asymmetric key management to map the provider-specific key
object to a intern zpc-key.

Not supported:
- key generation
- key import/export

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Integrate asymmetric key management
f07093e 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
provider: Add algorithm-id helpers
144b3f5 
Add helpers to generate DER-encoded algorithm-ids based on key and
digest information.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Integrate algorithm-id helpers
7aacb4a 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
provider: Add signature algorithms
26ef552 
Add signature algorithms for sign/verify with ECDSA and EDDSA keys.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Integrate signature algorithms
3a8f900 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
provider: Add tls-property helpers
58f9a12 
Add the supported TLS properties of the hbkzpc provider.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Integrate tls-property helpers
819d144 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
asn1: Add ASN.1 module (definition and functions)
4e62720 
The ASN.1 module provides DER en-/decoding for hbkzpc-URIs. These
functions are required for the decoder/encoder support.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Add ASN.1 build target
2ee6a8e 
Add internal object build target for ASN.1 module. The internal object
can be shared between targets.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
provider: Add decoders for hbkzpc-URI
608349d 
Add decoders for PEM and DER to support hbkzpc-URI files.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Integrate decoder implementation
7d4447e 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add OpenSSL configuration template
aa53a68 
To use the zpc functionality via the OpenSSL API, the zpc provider has
to be defined in the OpenSSL configuration. The build configures the
template and creates a `openssl.cnf` file, which can be used for test
purposes. The configuration file will be created in the build output
folder.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add provider tests
7b374cd 
Add provider test framework with a base retrieval of the hbkzpc
provider.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
cmake: Integrate provider test
aaf0682 
Integrate new provider testcases for builds with test enabled.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add provider test for store-loader
7487849 
Add tests for the sore-loader. It covers mainly the
open()/load()/eof() sequence.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add provider test for PKEY (store/keymgmt)
006ea68 
Add test for loading a EVP PKEY object from a hbkzpc-URI via
store and keymgmt.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add provider test for signature algorithms
4515fff 
Add sign/verify tests for full and pre-hashed messages. The
verification is checked across both variants.

Note: The test covers only ECDSA and uses a hard-coded key origin.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add asn.1 tests
e314843 
Add tests for the DER encoding. It takes the hard-coded ECDSA key and
stores it as a file.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add decoder tests
5110589 
Add simple decoder fetch test.

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: Add signature test (PEM)
27c8ed2 
Add tests to use hbkzpc-URI file for sign/verify (instead of loading
the URI via store).

Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
test: provider: Add ed25519 PKEY test case
4b97023 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
@holger-dengler
WIP dbg: Add provider gdb-scripts
d281dfe 
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ifranzki ifranzki ifranzki left review comments

@fcallies fcallies Awaiting requested review from fcallies

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@holger-dengler @ifranzki