Cryptoki etas integration by oeweda · Pull Request #49 · eclipse-score/inc_security_crypto

oeweda · 2026-06-10T13:08:33Z

Key Changes:

Integrated the cryptoki module natively into the score_crypto.
Moved the cryptoki provider to score/crypto/daemon/provider/pkcs11/cryptoki.
Updated all Bazel build configurations, Cargo dependencies, and lockfiles to correctly map to the new path.
Verified that the daemon, integration tests, and multi-provider demos build and pass successfully with the new provider location.
Use a single source for openssl (ETAS provided version) found under third_party/openssl
Integrate SCORE Logger into Cryptoki code
closes Integrate PKCS11 (Cryptoki) to SCORE #29 (children tasks PKCS11 (Cryptoki) Integration with SCORE #31 and Integration of PKCS11 (Cryptoki) With ETAS Architecture #32)
closes Have only one version of OpenSSL on target #30 (child task Selecting One OpenSSL Version for the Security Code #33)

Your Reviews will be appreciated @ChansAlive @PandaeDo @masc2023 @schreibwsag @OliverHeilwagen

github-actions · 2026-06-10T13:09:13Z

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.3.0) and connecting to it...
INFO: Invocation ID: d6600a39-6f03-440e-9460-63f927a42cce
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:394:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:394:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:394:31: in <toplevel>
Computing main repo mapping: 
WARNING: For repository 'score_rust_policies', the root module requires module version score_rust_policies@0.0.4, but got score_rust_policies@0.0.5 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'score_crates', the root module requires module version score_crates@0.0.7, but got score_crates@0.0.9 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'score_tooling', the root module requires module version score_tooling@1.1.2, but got score_tooling@1.2.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'aspect_rules_lint', the root module requires module version aspect_rules_lint@1.5.3, but got aspect_rules_lint@2.0.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 17.712s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

PandaeDo · 2026-06-15T07:41:10Z

80k lines. Sorry, but I'm not able to review that. Is it possible to create smaller, readable PR's?

ChansAlive · 2026-06-15T07:45:51Z

Kindly check the PR again and resolve the merge conflicts.
It may then reflect the actual changes that is being brought in.
It currently shows the source code that is already present in the main as incoming changes.
Thanks

schreibwsag · 2026-06-18T05:28:09Z

test_pkcs11_provider fails when compiled with USE_RUST_PKCS11 ("C_InitToken failed: 160").
test_pkcs11_provider tries to initialize the token which is apparently necessary for the SoftHSM2
case, but not for libcryptoki. Proposal: to get test_pkcs11_provider running, do the initialization
parts only if USE_RUST_PKCS11 is not defined. Then test_pkcs11_provider will run:

./bazel-bin/tests/provider_test/test_pkcs11_provider
[==========] Running 4 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 4 tests from Pkcs11ProviderHashTest
[ RUN ] Pkcs11ProviderHashTest.SHA256SingleShotHash
mw::log initialization error: Error No logging configuration files could be found. occurred with context information: Failed to load configuration files. Fallback to console logging.
mw::log initialization error: Error No logging configuration files could be found. occurred with context information: Failed to load configuration files. Fallback to console logging.
2026/06/18 05:17:33.9853564 2801418324 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.SHA256SingleShotHash (126 ms)
[ RUN ] Pkcs11ProviderHashTest.SHA256StreamingHash
2026/06/18 05:17:33.9853692 2801419597 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.SHA256StreamingHash (122 ms)
[ RUN ] Pkcs11ProviderHashTest.StreamStateViolation
2026/06/18 05:17:33.9853802 2801420698 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.StreamStateViolation (110 ms)
[ RUN ] Pkcs11ProviderHashTest.TrueConcurrentStreamingOnSeparateSessions
2026/06/18 05:17:33.9853925 2801421927 000 ECU1 NONE DFLT log warn verbose 4 [PKCS#11] Warning: token label autodetect failed for ' SoftHSM '. Falling back to first present slot id= 0
[ OK ] Pkcs11ProviderHashTest.TrueConcurrentStreamingOnSeparateSessions (123 ms)
[----------] 4 tests from Pkcs11ProviderHashTest (482 ms total)

[----------] Global test environment tear-down
[==========] 4 tests from 1 test suite ran. (482 ms total)
[ PASSED ] 4 tests.

github-actions · 2026-06-22T09:47:01Z

The created documentation from the pull request is available at: docu-html

Co-authored-by: Copilot <copilot@github.com>

Fix the static library link order for OpenSSL (libssl before libcrypto) to resolve undefined symbols during linking. Additionally, apply missing Eclipse Foundation copyright headers to newly added Cryptoki source files to pass the copyright checker.

ChansAlive

Review done on the daemon changes as part of integrating the rust pkcs11 provider

ChansAlive · 2026-07-14T13:02:49Z

+        ":use_rust_pkcs11": [
+            "//score/cryptoki:cryptoki_cdylib",
+            "//score/cryptoki:cryptoki_headers",
+            "//third_party/openssl",


I believe this would any way be a transitive dependency when depending on cryptoki_cdylib right?

ChansAlive · 2026-07-14T13:05:05Z


-#include <cryptoki.h>
-#include <pkcs11.h>
+#ifdef USE_RUST_PKCS11
+    #include <pkcs11.h>
+#else
+    #include <cryptoki.h>
+#endif


I think it was unnecessary to include the cryptoki.h header in the first place.
You may ignore this comment, I will raise a separate fix later.

ChansAlive · 2026-07-14T13:15:42Z

+#ifdef USE_RUST_PKCS11
+        {
+            CK_ULONG slot_count{0U};
+            CK_FUNCTION_LIST* const fl = m_module->GetFunctionList();
+            CK_RV rv = fl->C_GetSlotList(CK_TRUE, nullptr, &slot_count);
+            if ((rv == CKR_OK) && (slot_count > 0U))
+            {
+                std::vector<CK_SLOT_ID> slots(slot_count);
+                rv = fl->C_GetSlotList(CK_TRUE, slots.data(), &slot_count);
+                if ((rv == CKR_OK) && !slots.empty())
+                {
+                    m_config.slotId = slots.front();
+                    score::mw::log::LogWarn() << "[PKCS#11] Warning: token label autodetect failed for '"
+                                              << m_config.tokenLabel
+                                              << "'. Falling back to first present slot id=" << m_config.slotId;
+                    return true;
+                }
+            }
+        }
+#endif


What would be the rationale behind this callback?

The intention would be to use the correct token represented by the label (plus Model).

The overall idea of identifying the correct provider would be based on the provider name which is then mapped to the token label in the config to match with the pkcs11 token. If this is not honored, how can we ensure that we are communicating with the correct token when multiple tokens are present in the pkcs11 module?

ChansAlive · 2026-07-14T13:50:18Z

+#ifdef USE_RUST_PKCS11
+    {
+        // Hack to modify slot entries since GetSlotEntries returns const
+        auto& slot_entries = const_cast<std::vector<score::crypto::daemon::config::KeyConfig::KeySlotEntry>&>(
+            config.GetKeyConfig().GetSlotEntries()
+        );
+        for (auto& slot : slot_entries)
+        {
+            for (auto& provider_name : slot.provider_names)
+            {
+                if (provider_name == "SOFTHSM")
+                {
+                    provider_name = "SCORE_CRYPTO_PROVIDER";
+                }
+            }
+        }
+    }
+#endif


I think this is not the right way to use the keyslots for the rust pkcs11 provider. Infact there are three better alternatives

Use a common provider name for both softhsm and cryptoki. You can then change the pkcs11_token_config.cpp

Second option is to switch the integration_test_config.json (https://github.com/eclipse-score/inc_security_crypto/blob/main/tests/test_vectors/config/integration_test_config.json) in the BUILD file to use the modified keyslot entries.

Add new keyslot entries in the existing json. Adapt the test to use the new keyslot resource identifier when rust pkcs11 is selected.

ChansAlive · 2026-07-14T13:55:05Z

+    }
+    auto& km = km_result.value();
+
+    auto slot_result = ctx->ResolveResource("HMAC_SHA256_IntegrationTestKey_SoftHSM", ResourceType::kKeySlot);


Since we want to choose either softHSM or cryptoki, it may be better to rename the keyslot resourceId to have a generic name. Else it is bit confusing. The change requires updating the config json.

ChansAlive · 2026-07-15T07:58:32Z

Are these patch files really required to be merged?

masc2023 requested changes Jun 14, 2026

View reviewed changes

Comment thread docs/crypto/architecture/index.rst

Comment thread docs/crypto/architecture/index.rst Outdated

Comment thread docs/crypto/architecture/dynamic_architecture.rst Outdated

Comment thread docs/crypto/architecture/dynamic_architecture.rst Outdated

oeweda force-pushed the cryptoki_etas_integration branch 4 times, most recently from 4d92606 to cc51b96 Compare June 17, 2026 04:36

oeweda force-pushed the cryptoki_etas_integration branch 4 times, most recently from 4e95a25 to 0f08964 Compare June 22, 2026 09:41

mina-hamdi and others added 14 commits July 7, 2026 13:46

Adding a readme describing the PoC.

29c6306

Code Base For Cryptoki PKCS#11 Rust Implementaion

b5cf931

Code Base For Cryptoki PKCS#11 Rust Implementaion

ba1388b

Added rust shell Rules to MODULE.bazel

8209103

Fix bazel ci errors

1c805ed

Fix Bazel Docs build issue

5e13d97

Co-authored-by: Copilot <copilot@github.com>

Initial Cryptoki integration into ETAS

bfdf8d6

Initial Cryptoki integration into ETAS

ac79449

(CI) fix documents

70f3f33

CI (fix docs)

ecc7ccb

Fix BUILD alias conflict and apply codebase formatting

1190d51

skip SoftHSM token initialization when using Rust PKCS#11

feab5c3

Cryptoki: Migrate Rust PKCS#11 library to score/cryptoki

164079a

ShoroukRamzy force-pushed the cryptoki_etas_integration branch 2 times, most recently from cf44556 to f305820 Compare July 7, 2026 13:32

ShoroukRamzy force-pushed the cryptoki_etas_integration branch 4 times, most recently from 0710419 to ab068a8 Compare July 7, 2026 14:27

perf: introduce weak PIN hashing as a temporary optimization workaround

83fc569

ShoroukRamzy force-pushed the cryptoki_etas_integration branch from ab068a8 to 09800f7 Compare July 7, 2026 14:31

sunildevda requested a review from ChansAlive July 8, 2026 08:30

ChansAlive suggested changes Jul 14, 2026

View reviewed changes

ChansAlive reviewed Jul 15, 2026

View reviewed changes

Comment thread third_party/patches/BUILD

ChansAlive Jul 15, 2026

Copy link
Copy Markdown

Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these patch files really required to be merged?

checkpoint: working cryptoki state

2811e99

ShoroukRamzy force-pushed the cryptoki_etas_integration branch from 09800f7 to 2811e99 Compare July 16, 2026 09:12

Uh oh!

Conversation

oeweda commented Jun 10, 2026

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

License Check Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PandaeDo commented Jun 15, 2026

Uh oh!

ChansAlive commented Jun 15, 2026

Uh oh!

schreibwsag commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

ChansAlive left a comment

Choose a reason for hiding this comment

Uh oh!

ChansAlive Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ChansAlive Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

github-actions Bot commented Jun 10, 2026 •

edited

Loading