Note

A newer and better alternative is available: p11-proxy-rs. New users are encouraged to use it instead of this project.

PKCS11 Proxy

This fork has the following additional features:

• support for running in "inetd mode", useful for calling directly from stunnel
• seccomp syscall filtering, on by default for Linux builds (see USAGE)
• privilege dropping with --drop-privs <user>
• getaddrinfo support for IPv6, fallback and DNS resolution
• TLS-PSK support to optionally encrypt communication

Plus a number of important bug fixes. This version passes the SoftHSM test suite.

An ubuntu PPA that tracks this version is ppa:leifj

PKCS#11 v3.2

Built against the OASIS v3.2 headers by default (-DPKCS11_V32=ON). All 104 functions are proxied. C_GetInterface/C_GetInterfaceList are exported and offer the 3.2, 3.1, 3.0 and 2.40 interfaces, each matched by its exact version.

The daemon is the trust boundary: it applies the mechanism allow-list and parameter checks itself, and never hands the module a pointer received from a client. Mechanism parameters and attribute templates that contain pointers are serialized field by field and rebuilt in the daemon's memory.

Supported mechanisms (442 of the 472 names in the header):

• everything without a parameter: digests, HMACs, key generation and derivation (SHA-2, SHA-3, BLAKE2b, ...), RSA/ECDSA/DSA with hashes, EdDSA
• post-quantum: ML-KEM, ML-DSA, SLH-DSA, HSS and XMSS, including the optional signing context
• structures with pointers: AES-GCM/CCM and ChaCha20/Salsa20-Poly1305 (also in the message-based API), RSA-OAEP, RSA-AES key wrap, ECDH derive and ECDH-AES wrap, HKDF, EdDSA context, ChaCha20/Salsa20, key derivation from data, *_ENCRYPT_DATA, IKE, X9.42/ECMQV/KEA/GOST key agreement, RC5, OTP (an array of typed values), and parameters that hold another mechanism (KIP, CMS)
• parameters the module fills in, returned to the caller: SSL/TLS/WTLS master secrets (protocol version), key material (four key handles and IVs), the TLS/WTLS PRFs (output and its length), PBE (the derived IV) and SP 800-108 KDFs (the additional keys)
• flat parameters: RSA-PSS, IVs, AES-CTR, key wrap, general-length MACs, TLS MACs, ...

CKM_PKCS5_PBKD2 takes CK_PKCS5_PBKD2_PARAMS2, but programs written for the older header pass CK_PKCS5_PBKD2_PARAMS (a pointer to the password length). The two have the same size; the last member tells them apart (a length is far below 4 KiB, a pointer is not), and the module gets the form the caller used.

Not supported (refused, and left out of C_GetMechanismList):

• X3DH and X2Ratchet: their structures hold byte buffers without a length member, so the daemon can't know how much to copy
• the Skipjack, Baton and Juniper modes and GOST 28147: obsolete hardware, and their parameter sizes can't be confirmed from the header

Tests

cmake -B build -DPKCS11_TESTS=ON && cmake --build build && (cd build && ctest)

This runs a fuzzer for the daemon's parsers, tests that feed the daemon hostile input, and end-to-end tests of the message-based and single-part AEAD, async, mechanism-parameter and interface functions against a mock module. To also test against a real module (ML-KEM/ML-DSA, attribute templates, OAEP, PSS, GCM, ECDSA, ECDH, EdDSA), pass a SoftHSM built with ML-DSA and ML-KEM:

-DPKCS11_TEST_SOFTHSM_MODULE=/path/to/libsofthsm2.so \
-DPKCS11_TEST_SOFTHSM_UTIL=/path/to/softhsm2-util

Credits

This tree is juvex-fi/pkcs11-proxy, which descends from SUNET/pkcs11-proxy and Absolight/pkcs11-proxy. See also THANKS.

• PKCS#11 v3.2 support: Jukka Kangas (Juvex)

Patches from other forks of SUNET/pkcs11-proxy:

• Nate Anderson (n8raid/pkcs11-proxy): fix for an infinite loop when a TLS write fails (e1980b0). Applied as is.
• minhow88/pkcs11-proxy: the fixes below were reviewed and adapted rather than merged as is. Plain tcp:// support was kept, and open() is not limited to read-only under seccomp.
  • b265722: security hardening. Adapted from it: fix for an accept() mutex deadlock, per-connection TLS state, inetd partial read/write handling, egg-buffer overflow checks, response size limit, /dev/urandom app id, sun_path termination, signal-safe run flag, and seccomp on by default with --drop-privs.
  • cede215 and 6d90343: seccomp syscalls for aarch64 and modern kernels, draining the connection pool in C_Finalize, and more mechanisms (the subset whose parameters can safely be copied verbatim).
  • e35bc93: seccomp syscalls for OpenSSL 3.x and --no-seccomp.
  • 8634bf6: TLS-PSK client sends its keyfile's first identity when none is configured.