Help us shape the future of Go! Take the 2026 Go Developer Survey

hsm

package
v0.4.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 25, 2026 License: MIT Imports: 17 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Cryptoki added in v0.4.1 

type Cryptoki interface {
	Initialize(opts ...pkcs11.InitializeOption) error
	Destroy()
	Finalize() error
	GetInfo() (pkcs11.Info, error)
	GetSlotList(tokenPresent bool) ([]uint, error)
	GetSlotInfo(slotID uint) (pkcs11.SlotInfo, error)
	GetTokenInfo(slotID uint) (pkcs11.TokenInfo, error)
	GetMechanismList(slotID uint) ([]*pkcs11.Mechanism, error)
	GetMechanismInfo(slotID uint, m []*pkcs11.Mechanism) (pkcs11.MechanismInfo, error)
	OpenSession(slotID uint, flags uint) (pkcs11.SessionHandle, error)
	CloseSession(sh pkcs11.SessionHandle) error
	Login(sh pkcs11.SessionHandle, userType uint, pin string) error
	Logout(sh pkcs11.SessionHandle) error
	CreateObject(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) (pkcs11.ObjectHandle, error)
	DestroyObject(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) error
	GetAttributeValue(sh pkcs11.SessionHandle, o pkcs11.ObjectHandle, a []*pkcs11.Attribute) ([]*pkcs11.Attribute, error)
	FindObjectsInit(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) error
	FindObjects(sh pkcs11.SessionHandle, max int) ([]pkcs11.ObjectHandle, bool, error)
	FindObjectsFinal(sh pkcs11.SessionHandle) error
	GenerateKey(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, temp []*pkcs11.Attribute) (pkcs11.ObjectHandle, error)
	GenerateKeyPair(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, public, private []*pkcs11.Attribute) (pkcs11.ObjectHandle, pkcs11.ObjectHandle, error)
	WrapKey(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, wrappingkey, key pkcs11.ObjectHandle) ([]byte, error)
	UnwrapKey(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, unwrappingkey pkcs11.ObjectHandle, wrappedkey []byte, a []*pkcs11.Attribute) (pkcs11.ObjectHandle, error)
	SignInit(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, o pkcs11.ObjectHandle) error
	Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error)
}

Cryptoki is the subset of *pkcs11.Ctx this package uses. Depending on the interface (rather than the concrete *pkcs11.Ctx) lets tests inject a mock token. A real *pkcs11.Ctx satisfies it.

type P11 

type P11 struct {
	Ctx      Cryptoki
	Sessions map[uint]pkcs11.SessionHandle
}

func NewP11 

func NewP11(modulePath string) (*P11, error)

func (*P11) CloseAllSessions 

func (p *P11) CloseAllSessions() error

func (*P11) ExportCertificate 

func (p *P11) ExportCertificate(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) ([]byte, error)

ExportCertificate extracts, parses and prints a Certificate from the HSM

func (*P11) ExportPrivateKey 

func (p *P11) ExportPrivateKey(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) (key []byte, err error)

ExportPrivateKey extracts, parses and prints an RSA/EC key using an ephemeral AES wrapping key.

func (*P11) ExportPublicKey 

func (p *P11) ExportPublicKey(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) ([]byte, error)

ExportPublicKey returns an RSA or EC public key object as PKIX PEM.

func (*P11) ExportPublicKeyEC 

func (p *P11) ExportPublicKeyEC(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) ([]byte, error)

ExportPublicKeyEC extracts, parses and prints an EC Public Key from the HSM

func (*P11) ExportPublicKeyRSA 

func (p *P11) ExportPublicKeyRSA(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) ([]byte, error)

ExportPublicKeyRSA extracts, parses and prints an RSA Public Key from the HSM

func (*P11) ExportSecretKey 

func (p *P11) ExportSecretKey(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) (key []byte, err error)

ExportSecretKey extracts, parses and prints an AES/DES/3DES key using an ephemeral RSA_OAEP wrapping key.

func (*P11) Finalize 

func (p *P11) Finalize() error

func (*P11) FindObjects 

func (p *P11) FindObjects(slotID uint, template []*pkcs11.Attribute) (objects []pkcs11.ObjectHandle, err error)

func (*P11) GenerateAESKey 

func (p *P11) GenerateAESKey(sh pkcs11.SessionHandle, label string, objectID []byte, keylength int, extractable, ephemeral bool) (pkcs11.ObjectHandle, error)

GenerateAESKey generates an AES key in the HSM.

func (*P11) GenerateDESKey 

func (p *P11) GenerateDESKey(sh pkcs11.SessionHandle, label string, objectID []byte, keylength int, extractable, ephemeral bool) (pkcs11.ObjectHandle, error)

GenerateDESKey generates a DES-family key in the HSM.

func (*P11) GenerateECKeypair 

func (p *P11) GenerateECKeypair(sh pkcs11.SessionHandle, label string, objectID []byte, curve string, extractable, ephemeral bool) (pkcs11.ObjectHandle, error)

GenerateECKeypair generates an EC key pair in the HSM.

func (*P11) GenerateRSAKeypair 

func (p *P11) GenerateRSAKeypair(sh pkcs11.SessionHandle, label string, objectID []byte, keylength int, extractable, ephemeral bool) (pkcs11.ObjectHandle, pkcs11.ObjectHandle, error)

GenerateRSAKeypair generates an RSA key pair in the HSM.

func (*P11) GetMechanisms 

func (p *P11) GetMechanisms(slotID uint) (map[uint]pkcs11.MechanismInfo, error)

func (*P11) GetSlots 

func (p *P11) GetSlots() (map[uint]pkcs11.TokenInfo, error)

func (*P11) ImportCertificate 

func (p *P11) ImportCertificate(sh pkcs11.SessionHandle, cert *x509.Certificate, label string, objectID []byte, ephemeral bool) (pkcs11.ObjectHandle, error)

ImportCertificate imports a certificate into the HSM without wrapping.

func (*P11) ImportPrivateKey 

func (p *P11) ImportPrivateKey(sh pkcs11.SessionHandle, rawKey []byte, keyLabel string, objectID []byte, algorithm string, extractable, ephemeral bool) (handle pkcs11.ObjectHandle, err error)

ImportPrivateKey imports an RSA or EC private key using an ephemeral AES 256 wrapping key.

func (*P11) ImportPublicKey 

func (p *P11) ImportPublicKey(sh pkcs11.SessionHandle, pub any, keyLabel string, objectID []byte, ephemeral bool) (pkcs11.ObjectHandle, error)

ImportPublicKey imports an RSA or EC public key into the HSM without wrapping.

func (*P11) ImportSecretKey 

func (p *P11) ImportSecretKey(sh pkcs11.SessionHandle, rawKey []byte, keyLabel string, objectID []byte, algorithm string, extractable, ephemeral bool) (handle pkcs11.ObjectHandle, err error)

ImportSecretKey imports an AES/DES/3DES secret key using an ephemeral RSA 2048 wrapping key.

func (*P11) Login 

func (p *P11) Login(slotID, userType uint, secret string) error

Login authenticates the slot's session as the given user type: pkcs11.CKU_USER with the PIN, or pkcs11.CKU_SO with the SO / management key. If a different user type is already logged in, it logs out and retries (a session holds only one).

func (*P11) NewSigner added in v0.4.1 

func (p *P11) NewSigner(sh pkcs11.SessionHandle, privateKey pkcs11.ObjectHandle, public crypto.PublicKey) *Signer

NewSigner wraps an on-token private key (with its already-parsed public key) as a crypto.Signer, suitable for x509.CreateCertificateRequest and friends.

func (*P11) OpenSession 

func (p *P11) OpenSession(slotID uint) (pkcs11.SessionHandle, error)

type Signer added in v0.4.1 

type Signer struct {
	// contains filtered or unexported fields
}

Signer implements crypto.Signer for a private key that never leaves the token — the signature is produced by C_Sign. The session must be logged in for the key.

func (*Signer) Public added in v0.4.1 

func (s *Signer) Public() crypto.PublicKey

func (*Signer) Sign added in v0.4.1 

func (s *Signer) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.