Generic PKCS#11 HSM Provider

PrivX can be configured at install time to use a generic PKCS#11 HSM. You can use this for testing PrivX with HSMs that are not explicitly supported.

info

SSH does not provide support for the generic PKCS#11 HSM configuration option. Using it in production deployments is not recommended.

The following configuration options are prompted when configuring PrivX to use the generic-pkcs11 provider:

• PKCS#11 provider library path
• Slot
• Pin
• Optional feature flags:
  • aes-gcm-zero-iv: Supply all-zeros IV for AES-GCM encrypt and let HSM generate the IV
  • aes-gcm-luna-random-iv: Supply zero length IV for AES-GCM encrypt and let HSM generate the IV (used with Safenet Luna)
  • aes-gcm-padding: Pad input to AES-GCM encrypt using the PKCS#7 padding method
  • sym-key-size-in-bits: HSM reports symmetric key size in bits
  • fips-mode: Disable functionality that is not supported when HSM is in FIPS mode
  • serialize-ops: Serialize all PKCS#11 provider library calls
  • disable-object-cache: Disable internal object handle caching
  • vormetric-mode: Enable Thales Vormetric DSM specific functionality
  • ncipher-mode: Enable nCipher HSM specific functionality
• Keyvault symmetric-encryption algorithm:
  • AES128withGCM: AES-GCM with 128 bit key size
  • AES256withGCM: AES-GCM with 256 bit key size
  • AES128withGCMPkcs7Pad: AES-GCM with 128 bit key size using PKCS#7 padding for plaintext
  • AES256withGCMPkcs7Pad: AES-GCM with 256 bit key size using PKCS#7 padding for plaintext