Expand description
PKCS#11 backend for [confium-store].
Implements StoreBackend on top
of the [cryptoki] crate (Apache-2.0), giving Confium a
hardware-backed keystore for HSMs (YubiHSM, Thales, Utimaco),
smartcards, and software tokens such as SoftHSM2.
The current revision wires the trait, configuration, and
cryptoki-level session-establishment plumbing. The actual HSM
object operations (put_secret, get_secret, …) live on
Pkcs11Instance and return
NotImplemented —
see TODO.roadmap/18-hardware-keystore-backends.md.
§Wire name
The backend advertises itself as "pkcs11" so the FFI create path
can look it up via confium_store::backend::find.
§Key-handle semantics
Like the other hardware backends, the PKCS#11 store does not return
raw key bytes from get_secret; it returns the PKCS#11 object
handle (an opaque *mut c_void). Signature/KEM plugins that want
to actually use the key invoke the HSM-style cfmp_sign_withhandle
symbol described in TODO.roadmap/18-hardware-keystore-backends.md.
The skeleton does not yet wire this — every storage operation is a
NotImplemented stub; the session plumbing (module load,
initialize, slot resolve, open session, login) is wired for real.
Structs§
- Pkcs11
Backend - Factory for the PKCS#11 backend. Stateless — all per-keystore state
lives in
Pkcs11Instance.