Add support for PKCS#11 3.2 validation objects #306
Conversation
Jakuje
force-pushed
the
pkcs11-3.2-validation
branch
from
de1c46f to
5ad9e90
Compare
Jakuje
force-pushed
the
pkcs11-3.2-validation
branch
from
5ad9e90 to
abebfe3
Compare
Jakuje
force-pushed
the
pkcs11-3.2-validation
branch
3 times, most recently
from
c4eba0f to
dce5711
Compare
Jakuje
force-pushed
the
pkcs11-3.2-validation
branch
3 times, most recently
from
9080717 to
a5db2de
Compare
| @@ -0,0 +1,137 @@ | |||
| --- | |||
| name: Test kryoptic FIPS module | |||
There was a problem hiding this comment.
Shall I add it to the required workflow to pass for a PR?
There was a problem hiding this comment.
I think now this can be done using the "Check if all checks succeeded (pull_request)" job, thus, Jakub can adjust it himself.
There was a problem hiding this comment.
I am not sure if it would not need to be in the same workflow file to work though to be able to use in the "check if all checks succeeded". Given that how large this workflow is, I did not want to mess the main ci.yml with it for now.
I hope this job will be stable, but I would rather keep it for some time non-mandatory and add it to the required just after some time we will see it will work as expected to avoid working around some required jobs.
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Jakuje
force-pushed
the
pkcs11-3.2-validation
branch
from
a5db2de to
b5e82e5
Compare
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Signed-off-by: Jakub Jelen <[email protected]>
Jakuje
force-pushed
the
pkcs11-3.2-validation
branch
from
b5e82e5 to
90b7ad9
Compare
3 participants
The PKCS#11 3.2 introduces a way to query the session for the validation flags of the last operation. This is done with the new API
C_GetSessionValidationFlagswhich is being exposed now also to the users of this crate.It also defines the new attribute specifying if the given object is matching the requirements for the validation.
Last but not least there is new validation object exposing information about the validation itself.
There is currenly almost no coverage for these, as this is implemented only by kryoptic (as far as I know) and not enabled in the default build we are using in CI.
Opening as draft as it depends on some fixes in kryoptic (latchset/kryoptic#315) as well its based on other code changes here (#304).