[ssh_x509] support pkcs#11 ed25519 keys, status and plan

[ssh_x509 at roumenpetrov.info]

Hello,

I would like to inform you for some inconsistencies when is used PKCS#11 provider with SoftHSMv2 module. This impacts PKCS#11 regression test. Impact on real secure devices(tokens) is not known yet.

When PKCS#11 module is used directly from PKIX-SSH code or from engine test pass. Work-around for PKCS#11 provider is to exclude 'hashed ECDSA' from SoftHSMv2 configuration. Note that 'hashed ECDSA' is part of recent SoftHSMv2 release-  2.7.0.
Work-around has just been published.

Also RSA and ED keys are not impacted.


Roumen


На 28.07.25 г. в 22:31, ssh_x509 at roumenpetrov.info написа:
> Hello,
> 
> Release 16.2 (25 Jun 2025) supports "provider managed identities". Indirectly, this also means support for pkcs#11 ed25519 keys. Just pushed commit that tests this functionality. It seems to me it works just fine. So, provider as loadable module works unlike various pkcs#11 engines. Remark: this was main reason to force direct support for EC keys and certificates stored in PKCS#11 tokens in version 8.8 (29 Feb 2016).
> 
> The support is direct i.e., identity should use prefix "store:", followed by provider URI. For instance identity 'store:pkcs11:id=%%00%%01' refer to key with identifier '0001'.
> 
> Support in ssh-agent is with normal priority. It will be reimplemented with planed migration to OpenSSL 3x API. Preferred is use of PQ algorithms from cryptographic library.
> 
> 
> Regards,
> Roumen Petrov
> 
> 
> _______________________________________________
> ssh_x509 mailing list
> ssh_x509 at roumenpetrov.info
> http://roumenpetrov.info/mailman/listinfo/ssh_x509_roumenpetrov.info