kipuka_hsm/providers/
kryoptic.rs

1//! Kryoptic software token provider.
2//!
3//! Kryoptic is a FIPS 140-3 validated software cryptographic module providing
4//! PKCS#11 2.40+ compliance. It's useful for development, testing, and
5//! environments where hardware HSM is not required.
6//!
7//! # Library Path
8//!
9//! Kryoptic is typically user-installed and the library path varies:
10//! - Linux: `~/.local/lib/libkryoptic.so` or `/usr/local/lib/libkryoptic.so`
11//! - macOS: `~/Library/Frameworks/libkryoptic.dylib`
12//!
13//! Set `KRYOPTIC_PKCS11_MODULE` environment variable to override.
14//!
15//! # Use Cases
16//!
17//! - Local development without HSM hardware
18//! - CI/CD testing pipelines
19//! - FIPS 140-3 compliance in software-only deployments
20//!
21//! # Production Considerations
22//!
23//! While Kryoptic is FIPS 140-3 validated, it does NOT provide:
24//! - Physical tamper protection
25//! - Hardware-backed key storage
26//! - Key extraction resistance
27//!
28//! Do NOT use for production CA keys or environments requiring NIAP CA PP
29//! compliance with hardware security requirements.
30
31use crate::HsmProvider;
32use crate::providers::HsmProviderConfig;
33use cryptoki::mechanism::MechanismType;
34
35/// Default PKCS#11 library path.
36///
37/// Checks KRYOPTIC_PKCS11_MODULE environment variable, otherwise uses
38/// platform-specific defaults.
39pub fn default_library_path() -> &'static str {
40    // In a real implementation, this would check the env var at runtime
41    #[cfg(target_os = "linux")]
42    return "/usr/local/lib/libkryoptic.so";
43
44    #[cfg(target_os = "macos")]
45    return "/usr/local/lib/libkryoptic.dylib";
46
47    #[cfg(target_os = "windows")]
48    return "C:\\Program Files\\Kryoptic\\kryoptic.dll";
49
50    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
51    return "/usr/local/lib/libkryoptic.so";
52}
53
54/// Mechanisms supported by Kryoptic.
55///
56/// Kryoptic implements full PKCS#11 2.40+ mechanism set.
57pub fn supported_mechanisms() -> Vec<MechanismType> {
58    vec![
59        // RSA
60        MechanismType::RSA_PKCS,
61        MechanismType::RSA_PKCS_KEY_PAIR_GEN,
62        MechanismType::SHA256_RSA_PKCS,
63        MechanismType::SHA384_RSA_PKCS,
64        MechanismType::SHA512_RSA_PKCS,
65        MechanismType::RSA_PKCS_PSS,
66        MechanismType::SHA256_RSA_PKCS_PSS,
67        MechanismType::SHA384_RSA_PKCS_PSS,
68        MechanismType::SHA512_RSA_PKCS_PSS,
69        MechanismType::RSA_PKCS_OAEP,
70        // ECDSA
71        MechanismType::ECDSA,
72        MechanismType::ECDSA_SHA256,
73        MechanismType::ECDSA_SHA384,
74        MechanismType::ECDSA_SHA512,
75        MechanismType::ECC_KEY_PAIR_GEN,
76        // AES
77        MechanismType::AES_KEY_GEN,
78        MechanismType::AES_ECB,
79        MechanismType::AES_CBC,
80        MechanismType::AES_GCM,
81        MechanismType::AES_KEY_WRAP,
82        MechanismType::AES_KEY_WRAP_PAD,
83        // Hashing
84        MechanismType::SHA256,
85        MechanismType::SHA384,
86        MechanismType::SHA512,
87    ]
88}
89
90/// Get the default provider configuration for Kryoptic.
91pub fn provider_config() -> HsmProviderConfig {
92    HsmProviderConfig {
93        provider: HsmProvider::Kryoptic,
94        library_path: default_library_path().to_string(),
95        supported_mechanisms: supported_mechanisms(),
96        notes: vec![
97            "Software-only FIPS 140-3 module - NOT for production HSM requirements".to_string(),
98            "No hardware tamper protection or physical key storage".to_string(),
99            "Excellent for development and testing".to_string(),
100            "Set KRYOPTIC_PKCS11_MODULE environment variable to override library path".to_string(),
101        ],
102    }
103}
104
105#[cfg(test)]
106mod tests {
107    use super::*;
108
109    #[test]
110    fn test_library_path_not_empty() {
111        assert!(!default_library_path().is_empty());
112    }
113
114    #[test]
115    fn test_mechanisms_supported() {
116        let mechanisms = supported_mechanisms();
117        assert!(mechanisms.contains(&MechanismType::RSA_PKCS));
118        assert!(mechanisms.contains(&MechanismType::ECDSA));
119    }
120}
kipuka_hsm/providers/kryoptic.rs

kipuka_hsm/providers/
kryoptic.rs
