32 lines
2.7 KiB
Markdown
32 lines
2.7 KiB
Markdown
# HSM Integration (PKCS#11)
|
|
|
|
## Module
|
|
Cryptography
|
|
|
|
## Status
|
|
IMPLEMENTED
|
|
|
|
## Description
|
|
PKCS#11 HSM client implementation for hardware security module integration, with integration tests.
|
|
|
|
## Implementation Details
|
|
- **HsmPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` -- HSM crypto plugin extending CryptoPluginBase; supports algorithms: HSM-RSA-SHA256/384/512, HSM-RSA-PSS-SHA256, HSM-ECDSA-P256/P384, HSM-AES-128/256-GCM; initializes with PKCS#11 library path (or simulation mode when unconfigured); SignAsync/VerifyAsync/EncryptAsync/DecryptAsync delegate to IHsmClient; HashAsync (SHA-256/384/512) computed locally; health check reports connected/disconnected/degraded status with slot info
|
|
- **IHsmClient**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` -- HSM client interface: ConnectAsync (slotId, pin), DisconnectAsync, PingAsync, SignAsync, VerifyAsync, EncryptAsync, DecryptAsync
|
|
- **Pkcs11HsmClientImpl**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/Pkcs11HsmClientImpl.cs` -- production PKCS#11 client implementation wrapping native PKCS#11 library
|
|
- **Pkcs11HsmClient**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` -- adapter delegating to Pkcs11HsmClientImpl with connection management
|
|
- **SimulatedHsmClient**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` -- test double for HSM operations without hardware: generates RSA-2048 + AES-256 keys on connect; RSA sign/verify with PKCS1/PSS padding; AES-GCM encrypt/decrypt with IV + tag management
|
|
- **HsmOptions**: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` -- configuration: LibraryPath (.so/.dll path, empty for simulation), SlotId, Pin, TokenLabel, ConnectionTimeoutSeconds (30), ReadOnlySession flag
|
|
- **HsmMechanism**: enum for signing/encryption mechanism mapping: RsaSha256/384/512, RsaPssSha256, EcdsaP256/P384, Aes128Gcm, Aes256Gcm
|
|
- **Tests**: `src/Cryptography/__Tests/StellaOps.Cryptography.Tests/Hsm/Pkcs11HsmClientIntegrationTests.cs`, `SoftHsmTestFixture.cs`
|
|
- **Source**: Feature matrix scan
|
|
|
|
## E2E Test Plan
|
|
- [ ] Verify HSM plugin initializes in simulation mode when no library path is configured
|
|
- [ ] Verify HSM plugin connects to PKCS#11 library when LibraryPath is set
|
|
- [ ] Test RSA signing and verification with SHA-256/384/512 and PKCS1/PSS padding
|
|
- [ ] Test ECDSA P-256 and P-384 signing and verification
|
|
- [ ] Test AES-128-GCM and AES-256-GCM encryption and decryption
|
|
- [ ] Verify health check returns Unhealthy when not connected, Degraded on slow response, Healthy with slot details
|
|
- [ ] Verify CanHandle only accepts algorithms with HSM- prefix
|
|
- [ ] Test plugin lifecycle: initialize -> active -> health check -> dispose (disconnect)
|