RFC: Upstreaming CKM_HKDF_DERIVE — design questions
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 功能
- 描述清晰度
- 需要澄清
- 活跃度
- 冷清
- 技术栈
- cpp
- 领域
- backend, cryptography
调研方向
Start by reading the PKCS#11 v3 CKM_HKDF_DERIVE requirements and the existing MacAlgorithm, CryptoFactory, CKM_CONCATENATE_BASE_AND_KEY, and CKM_DES_* patterns mentioned in the issue. The reported implementation is inline in SoftHSM.cpp, with tests in DeriveTests.cpp; the issue asks maintainers to decide several design questions before a contribution can proceed. Done means those choices are resolved and the requested implementation and tests meet them.
由索引模型根据 Issue 内容生成。
描述
Hi, I have a working CKM_HKDF_DERIVE implementation against current main and would like to upstream it. Before opening a PR, I'd appreciate input on a few design choices.
What I have
- CKM_HKDF_DERIVE per PKCS#11 v3, parsing CK_HKDF_PARAMS.
- All three salt sources (NULL / DATA / KEY) and all four extract/expand combinations.
- Sensitive/extractable propagation matching CKM_CONCATENATE_BASE_AND_KEY.
- Support for all PRFs.
- Some RFC 5869 Test Cases passing as a CppUnit test.
Known gaps:
- OpenSSL backend only.
- HKDF logic inline in SoftHSM.cpp, not under src/lib/crypto/.
- CKK_HKDF not wired into newP11Object / P11Attributes.
- No CKM_HKDF_KEY_GEN / CKM_HKDF_DATA, no FIPS gating.
Questions
- Crypto layer — should I model HKDF after MacAlgorithm (new + OSSL/Botan subclasses via CryptoFactory), or build it on top of existing MacAlgorithm HMAC and skip a new factory entry?
- Botan backend — required for merge, or acceptable as follow-up?
- FIPS — for WITH_FIPS builds, allow SHA-2 PRFs only and compile out the rest, matching the CKM_DES_* pattern?
- CKK_HKDF object representation — reuse P11GenericSecretKeyObj (like the CKK_*_HMAC types), or introduce P11HKDFSecretKeyObj?
- Would CKM_HKDF_KEY_GEN / CKM_HKDF_DATA be required to merge?
- Tests — anything beyond DeriveTests.cpp and RFC 5869 vectors you'd like to see?
Motivation
My project uses SoftHSM in CI and needs HKDF; we'd rather upstream than maintain a fork.
Thanks!
- 主要语言
- C++
- 星标
- 1.1k
- 派生
- 434
- 平均合并
- 12 天 14 小时
- 30 天内合并 PR
- 2
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
softhsm/SoftHSMv2 的其他 Issue
-
C_DigestKey digests a sensitive EC private key's CKA_VALUE: no check that the object is a secret key未关闭
难度 2/5 1-3 小时 新手友好度 78/100
-
难度 2/5 1-3 小时 新手友好度 78/100
-
难度 2/5 1-3 小时 新手友好度 72/100
-
难度 4/5 3-5 天 新手友好度 54/100
-
难度 4/5 3-5 天 新手友好度 56/100
查看 softhsm/SoftHSMv2 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 69/100
-
area:qmc bug
难度 2/5 1-3 小时 新手友好度 69/100
维护者通常 3 天内回复
-
bug good first issue
难度 2/5 1-3 小时 新手友好度 74/100
ASGC-Game-Jam/asgc-gamejam-2026#563 ·
维护者通常 1 天内回复
-
area/ysql kind/bug priority/medium status/awaiting-triage
难度 2/5 1-3 小时 新手友好度 78/100
yugabyte/yugabyte-db#37523 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100