2025-10-07 –, Krakow/ Business Value & Enterprise Adoption
OpenSSL never directly supported accessing hardware modules through PKCS#11. Over the years, the community created various engines for this task, but only with the OpenSSL 3 Store API and with providers integration it became more streamlined, which is when we started working on the pkcs11-provider project [1].
But we did not stop here. From the pkcs11-provider side, we brought the SKEY API to OpenSSL 3.5. We also implemented a new software pkcs11 module kryoptic [2] (using OpenSSL), which closes the circle and we can now use OpenSSL also as a PKCS#11 module.
In this presentation, I would like to talk about the recent development of the PKCS#11 standard, about the development of a pkcs11-provider, and how kryoptic works and what problems it solved for us.
[1] https://github.com/latchset/pkcs11-provider
[2] https://github.com/latchset/kryoptic/
PKCS#11 is a standard defining a unified API for accessing smart cards and Hardware Security Modules. It is widely supported by different cryptographic libraries so they can (to some extent) transparently offload cryptographic operations to hardware, protecting the private key material from potential attackers, effectively preventing heartbleed-type attacks.
Recent publication of the PKCS#11 3.2 specification brought up support for common Post-Quantum Cryptography algorithms as well as new needed APIs or validation API, opening a way for the tokens to signal FIPS certification to the applications.
OpenSSL does not support using PKCS#11 directly, so we implemented pkcs11-provider, de-facto standard pkcs11 provider for OpenSSL over last three years, releasing version 1.0 early this year. But we do not stop here and version 2.0 plans to support PQC cryptography, SKEY API and much more.
Working with a standard API defined in a document that is several hundred pages long is hard as implementers might understand all the requirements differently, leading to interoperability issues. Therefore through the development of the pkcs11-provider, we focused a lot of testing with different software tokens in our CI. This lead us to the last bit, kryoptic project.
Kryoptic is a software PKCS#11 module, written in rust, implementing the latest PKCS#11 standard, using OpenSSL for the cryptographic primitives. This allows us to properly test the pkcs11-provider and effectively instruct OpenSSL to offload cryptographic operations to ... OpenSSL :)
Another side outcome is that we wrote lightweight OpenSSL bindings for rust, that work well with OpenSSL 3 API, as we did not find any existing that would suit our needs.
Kryoptic has one more feature though. It can statically link directly to the OpenSSL fips provider, technically exposing the FIPS certified API to other applications that can now use it via the PKCS#11 API.
Jakub Jelen is a Principal Software Engineer in Red Hat, working on various projects that are touching security and cryptography area.