WEBDIENSTE/NLnetLabs-krill
1
0
Fork 0
mirror of https://github.com/NLnetLabs/krill.git synced 2026-09-21 17:07:44 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
e4e68ecdb032eb0decd9f02a7c1bb6612eba6809
NLnetLabs-krill/doc/development/hsm/requirements.md
T
Ximon EighteenandGitHub b0be88bc10 HSM support for keys (#21) (#733) 
Adds support for PKCS#11 v2.20 and/or KMIP 1.2 compatible HSMs.
Includes backward compatible extensions to the krill.conf syntax.
Includes HSM related developer docs.
Excludes HSM specific API (REST, krillc, Prometheus) or UI extensions.
2022-01-14 14:19:24 +01:00

955 B
Raw Blame History

HSM: Requirements

The primary initial requirements that influenced the architecture were:

Further analysis extended & refined these requirements such that:

  • Krill Signer implementations also support random number generation, so possibly support that via HSMs too.
  • PKCS#11 v2.20 is the most widely deployed version thus we should target that.
  • KMIP didn't support signing until v1.2 so target that.
  • KMIP v1.0 supported only TCP+TLS+TTLV where TTLV is a custom binary wire format defined by the KMIP specification. Later KMIP versions added support for HTTPS, XML and JSON, but only TCP+TLS+TTLV is mandatory for all KMIP servers. Therefore we should support TCP+TLS+TTLV.
Reference in New Issue View Git Blame Copy Permalink