commit c53dee302d94c4efc78dfcd7cda23c9e617d9ad3
author Andrzej Kurek <andrzej.kurek@mobica.com> Tue Jan 23 05:44:20 2018 -0500
committer Andrzej Kurek <andrzej.kurek@mobica.com> Tue Jan 23 05:44:20 2018 -0500
tree 9e8d0d5d6b381bf3e2bb9470bfae81187cd1706c
parent e7353105513d36b7488b5f5db12912638e3aa742

New module: pkcs11_client

New module pkcs11_client.c, defining an opaque pk engine whose backend
is a PKCS#11 token (cryptographic module using the Cryptoki API).

New config option PKCS11_CLIENT_C. Requires pkcs11.h to compile and a
pkcs11 library to link.

Test setup meant to be used with the SoftHSM v2 library (libsofthsm2).
The test setup is not yet integrated with the Mbed TLS test framework.
Before running tests involving PKCS#11, you need to run

    cd tests && scripts/pkcs11-client-test.sh init

include/mbedtls/config.h

diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 4933108..d4869ef 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -2212,17 +2212,31 @@
 #define MBEDTLS_PKCS5_C
 
 /**
+ * \def MBEDTLS_PKCS11_CLIENT_C
+ *
+ * Enable support for keys stored in an external token, using the
+ * cryptoki (PKCS#11) interface.
+ *
+ * Module:  library/pkcs11_client.c
+ *
+ * This module requires a PKCS#11 library.
+ *
+ */
+#define MBEDTLS_PKCS11_CLIENT_C
+
+/**
  * \def MBEDTLS_PKCS11_C
  *
- * Enable wrapper for PKCS#11 smartcard support.
+ * Enable wrapper for PKCS#11 token support with libpkcs11-helper.
  *
  * Module:  library/pkcs11.c
  * Caller:  library/pk.c
  *
  * Requires: MBEDTLS_PK_C
  *
- * This module enables SSL/TLS PKCS #11 smartcard support.
- * Requires the presence of the PKCS#11 helper library (libpkcs11-helper)
+ * This module enables PKCS #11 token support, e.g. to use a private
+ * key stored in a smartcard for an SSL/TLS connection.
+ * Requires the presence of the PKCS#11 helper library (libpkcs11-helper).
  */
 //#define MBEDTLS_PKCS11_C