zpcprovider and tooling#45
Open
holger-dengler wants to merge 48 commits into
Open
Conversation
The new zpc_ec_key_compare() function compares two key objects. In general, if both keys has the same public key, they can be assumed to be identical. Only if one of the two keys (or both) has not set a public key, also the protected key blobs needs to be compared. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The libzpc API is no longer exposed as shared object, so make the constructor and destructor explicit. It is now up to the consumer to call them. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Call the global zpc constructor/destructor once for all tests by exploiting the gtest environment API. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Update travis configuration to noble and add install the new package dependencies (e.g. OpenSSL). While at it, also remove deprecated statements and remove environment variable settings. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The gtest release 1.11.0 produce build problems because of outdated versions. Updating to version v1.12.1 fixes the problems. While at it, migrate from archive-download to git checkout. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The libzpc API is no longer exposed as static or shared library. The object module is only available for internal purpose. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
As the libzpc API is no longer externally available, also the extensive testing (gtest/wycheproof) has to be made internal. Introduce a new build option BUILD_INTERNAL_TEST. Enabling this new option will build the extensive tests. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Adjust indention, no functional change. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The new target converts markdown man-pages to troff format. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The zpc functionality will be exposed via the OpenSSL API. Query the required OpenSSL package during build. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Introduce the build option BUILD_ASAN to enable the address sanitizer in the compile options. Executable or shared library targets has to enable the address sanitizer in the link options as well. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The provider is the base to plug-in further implementation like key-management, ciphers and so on. It has no functionality itself. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add a module build target for the zpcprovider. Other than shared objects, the provider module has no so-name and also no API versioning. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The provider-specific key object structure is shared between the provider components and references to the internal zpc-key structure(s). Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
A hbkzpc-URI references a hardware-backed key origin. The parser destructs the URI into key-value pairs. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add internal object build target for uri. The internal object can be shared between targets. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The mapping helpers provide mappings between e.g. algorithm strings and algorithm-related values. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Introduce a store-loader for hbkzpc-URI based keys. The store-loader creates a provider-specific key object and adds relevant information from the URI. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Introduce a asymmetric key management to map the provider-specific key object to a intern zpc-key. Not supported: - key generation - key import Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add helpers to generate DER-encoded algorithm-ids based on key and digest information. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add signature algorithms for sign/verify with ECDSA and EDDSA keys. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add the supported TLS properties for the zpcprovider. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The ASN.1 module provides DER en-/decoding for hbkzpc-URIs. These functions are required for the decoder/encoder support. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add internal object build target for ASN.1 module. The internal object can be shared between targets. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Add decoders for PEM and DER to support hbkzpc-URI files. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
To use the zpc functionality via the OpenSSL API, the zpcprovider has to be defined in the OpenSSL configuration. The build configures the template and creates a `openssl.cnf` file, which can be used for test purposes. The configuration file will be created in the build output folder. The build also configures a second template and creates a configuration drop-in file `zpcprovider.cnf`. This file can be included in existing OpenSSL configuration files. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The scripts set breakpoints for to all zpcprovider functions, which are called by the OpenSSL provider API (dispatch functions). Each zpcprovider component has its own gdb-script. Sourcing multiple scripts is possible. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The tool `zpckey` is a key management tool for the zpcprovider. It supports the composition of key-origins (compose) and prints information about existing zpcprovider keys (show). The tool supports key encoding as hbkzpc-URI, DER or PEM. Currently, only keys of origin type `uv` are supported. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
As PEM/DER key files are supported now, exclude them from version control by default. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The test script iterates over a list of algorithms and generates the required key files for further tests. It covers test-cases for the tool `zpckey`. The test-case depends on one clear-key for each algorithm. These clear-keys must also exist as related UV retrievable secret. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The test script iterated over a list of algorithms and query parameters of the key for each algorithm. The test depends on the keys files, which are created by the `t_ossl_prepkey` test-case. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The test script iterates over a list of algorithm and performs the following tests for each algorithm: - sign with zpc-key, verify with zpc-key - sign with zpc-key, verify with clear-key (priv, pub) - sign with clear-key, verify with zpc-key The test depends on the keys files, which are created by the `t_ossl_prepkey` test-case. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The introduction of platform-independent targets allows to build parts of the project for non-s390x platforms. This is required at least for the tool `zpckey`. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The tool pkeycmp takes two provider key files (PEM or DER) and compares them. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
As the project supports building on non-s390x platforms, enable the multi-arch build in travis. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
- Migrate README to provider API - Remove all parts, which are not yet supported by the provider - Flag the gtest/wycheproof tests as "internal" Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The project now also allows builds for non-s390x platforms. Rework the spec-file accordingly and split the build results into separate packages. Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
This was referenced Jun 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is the successor of #41 and #43. It also contains a lot of cleanups and rework for the shift to the new provider API.