In HP-UX, how do you write a C program using PKCS#11 api?

[marziparzi]

I am heavily confused by HP-UX's manual on its cryptographic module linked here.

It gives an example of a C code using PKCS#11 apis, but nowhere can I find information on where to find the shared object to use the PKCS#11 api. I have inferred that maybe the shared object is replaced by loading the module somehow, but if that's true, I don't understand how to load the module targeted at this c program.

Can somebody help me out on this?

[ranganath ramachandra]

Have you tried using p11-kit along with HP-UX KCM ?

[marziparzi]

Thanks for the reply.

The p11 kit page you linked won't load for me.

[ranganath ramachandra]

That link was to the page listing the HP-UX port of p11-kit, at http://hpux.connect.org.uk . You could simply go to the site and search for it. I found it through a google search for "hpux pkcs11" (without the quotes). I wonder why the link won't work for you though (what exactly happens when you click on it?).

I know nothing about PKCS#11/KCM/p11-kit; my understanding from the KCM documentation and the contents of the KCM depot is that the API which the documentation describes is available to kernel code; from the description of p11-kit it appears that it (p11-kit) is to be used for user-space access to the functionality implemented by KCM. From your question, it was not clear whether you are trying to access the KCM functionality from within the kernel or in user-space. So I'm only pointing to something that might help you, I'm not sure it does.

[marziparzi]

Nothing happens when I click on it. The page wouldn't load at all. Even http://hpux.connect.org.uk won't load.

Maybe it's because I'm in korea and it's for UK? Not sure.

I can load this link though, http://www.connect-community.org/hpux-connect/. Can you check if it's an equivalent link?

And I'll clarify my question. In the original link to the KCM documentation, on page 9, there's a snippet of C code showing how to use the PKCS api.

It calls #include "pkcs11_kcm.h"  and #include "pkcs11.h".

I found pkcs11.h in "/usr/local/include/gnutls/pkcs11.h" and "/usr/local/include/p11-kit-l/p11-kit/pkcs11.h".

Not sure if those were there in the first place, if they are there after installing the KCM depot file, or if they were installed by someone else.

I cannot, however, find "pkcs11_kcm.h".

Regardless, it's not that important I have the header file or not because I can just create it.

What's important is that I don't have the .so file associated with the header file. The documentation doesn't mention anything about it.

[ranganath ramachandra]

---

@marziparzi wrote:

Nothing happens when I click on it. The page wouldn't load at all. Even http://hpux.connect.org.uk won't load. Maybe it's because I'm in korea and it's for UK? Not sure.

well, "oops".

I can load this link though, http://www.connect-community.org/hpux-connect/. Can you check if it's an equivalent link?

I'm afraid not.

And I'll clarify my question. In the original link to the KCM documentation, on page 9, there's a snippet of C code showing how to use the PKCS api.

It calls #include "pkcs11_kcm.h"  and #include "pkcs11.h".

I found pkcs11.h in "/usr/local/include/gnutls/pkcs11.h" and "/usr/local/include/p11-kit-l/p11-kit/pkcs11.h".

Not sure if those were there in the first place, if they are there after installing the KCM depot file, or if they were installed by someone else.

I cannot, however, find "pkcs11_kcm.h".

Regardless, it's not that important I have the header file or not because I can just create it.

What's important is that I don't have the .so file associated with the header file. The documentation doesn't mention anything about it.

---

This is what I suspected. Did you read what I wrote about the KCM API being available in kernel space? That means you can use it (only) if you are building a kernel module. There would be no user space shared or archived library providing the functionality that you can link with to create an executable. It seems this is the problem the p11-kit is trying to solve, by providing a way for user space code to use the functionality of modules like KCM. So my guess is, you could write a C program to use the p11-kit API to make use of KCM.

[Matti_Kurkela]

---

---

This is what I suspected. Did you read what I wrote about the KCM API being available in kernel space? That means you can use it (only) if you are building a kernel module. There would be no user space shared or archived library providing the functionality that you can link with to create an executable. It seems this is the problem the p11-kit is trying to solve, by providing a way for user space code to use the functionality of modules like KCM. So my guess is, you could write a C program to use the p11-kit API to make use of KCM.

---

I'm afraid the p11-kit is not designed to give user space access to KCM, but rather as a wrapper to allow several PKCS#11 (also known as Cryptoki) user-space libraries to be installed in one system, and to manage their use by multiple applications.

The actual PKCS#11/Cryptoki libraries (the .so files) would typically be provided along with the driver for e.g. a SSL accelerator or Hardware Security Module, by the manufacturer of the appropriate hardware.

Back in year 2002 or so, when PA-RISC processors were still state-of-the-art, I maintained some web servers with SSL accelerators. The driver for it came with the PKCS#11 library that used the hardware.

The KCM is not a PKCS#11 library for applications: it's a kernel-level PKCS#11 library for HP-UX drivers. I guess it's been released to make it easier for HSM manufacturers to write HP-UX drivers for their hardware products, so that every driver author doesn't have to write their own implementations of encryption and hash algorithms and possibly FIPS-certify them.