### Author:  [@SuicidalLabRat](https://hub.mender.io/u/SuicidalLabRat)
#### Post date: [August 6, 2019, 2:20am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/1 "2019-08-06T02:20:11Z")
We have put significant resource into narrowing the attack surface of our device fleets, including the implementation of HSM type security/crypto modules to manage device secrets and PKI duties.
The mender client is the sole component of our stack unable to leverage these security resources, where, as the highest risk vector for attacking our fleet, the OTA updating service should actually provide features supporting the highest level risk mitigation.
Is there any intention to include HSM support in the client roadmap?
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [August 9, 2019, 8:04am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/2 "2019-08-09T08:04:31Z")
Hi @SuicidalLabRat, we do not have short-term plans to add HSM support on the client.
With that said, it is a feature we are aware and it is a matter of priorities and demand. One can always take a look at speeding up features based on our profession services offerings or if something like this would come as a community contribution that would also (obviously :)) speed it up.
I am curious what type of HMS are you using? Is it something like this,
[https://www.microchip.com/wwwproducts/en/ATECC608A](https://www.microchip.com/wwwproducts/en/ATECC608A)
---
### Author:  [@SuicidalLabRat](https://hub.mender.io/u/SuicidalLabRat)
#### Post date: [August 9, 2019, 6:30pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/3 "2019-08-09T18:30:49Z")
Indeed. That is the exact chip we use. It enables all our mutual authentication, signing and secure boot functionality.
Can you point me at the code currently handling menders auth and signature validation? Assuming its contained/modular enough to be reviewed with relative ease.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [August 14, 2019, 2:19pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/4 "2019-08-14T14:19:24Z")
A good place to start is probably here,
>
---
### Author:  [@drewwestrick](https://hub.mender.io/u/drewwestrick)
#### Post date: [August 29, 2019, 7:22pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/5 "2019-08-29T19:22:25Z")
Just wanted to put my +1 here for this feature. We (like I’m sure many) are moving to using PKCS11 hardware to secure our AWS private keys. Usually, we use the same private key for both AWS and mender. It would be nice once we make this transition to have mender also move to make use of the PCKS11 hardware as well so that we don’t have to maintain two sets of keys (one secured in hw, one on the filesystem for mender). Much like @SuicidalLabRat said, it would be odd if our application is going to be more secure than the mechanism that updates the entire system image.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [August 30, 2019, 9:03am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/6 "2019-08-30T09:03:36Z")
Thank you for the feedback, it is very valuable to us when planing new development.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [August 30, 2019, 9:09am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/7 "2019-08-30T09:09:01Z")
Also @drewwestrick, which hardware are you using? Is it the same from Microchip mentioned above?
I have little experience working with HMS, and would be happy if you can share any information how you are using these hardware modules, what software stack to access them and how you incorporate them in your application.
---
### Author:  [@drewwestrick](https://hub.mender.io/u/drewwestrick)
#### Post date: [August 30, 2019, 12:43pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/8 "2019-08-30T12:43:49Z")
Yes, @mirzak, we are planning on using the [ATECC608A](https://www.microchip.com/wwwproducts/en/ATECC608A) as well. To use the device, we will need to integrate the device driver, [cryptoauthlib](https://github.com/MicrochipTech/cryptoauthlib), which makes use of [PKCS11](https://github.com/MicrochipTech/cryptoauthlib/wiki/PKCS11-Linux-Setup) as an interface. It will also make sense to install [gnutls](https://www.gnupg.org/ftp/gcrypt/gnutls/v3.6/) on the debug device to test things out. Below are a few relevant yocto layers I plan on using:
- [gnutls 3.6.4](https://layers.openembedded.org/layerindex/recipe/89658/)
- [cryptoauthlib](http://layers.openembedded.org/layerindex/recipe/97447/)
The [wiki](https://github.com/MicrochipTech/cryptoauthlib/wiki) from Microchip also gives some additional information on the device and driver installation. To test the hardware, I’m planning on getting a [secure4click](https://www.mikroe.com/secure-4-click) module for my [SOM1](https://www.digikey.com/product-detail/en/microchip-technology/ATSAMA5D27-SOM1-EK1/ATSAMA5D27-SOM1-EK1-ND/7898420) development kit.
Finally, I do know that [AWS Greengrass](https://docs.aws.amazon.com/greengrass/latest/developerguide/hardware-security.html) does have support for PKCS11 URIs. I’m not sure what they are doing under the hood to support PKCS11 but I was going to poke around and see how they are using it to provide public private key authentication for their services. If I continue to make progress on this, I will definitely provide you with updates.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [August 30, 2019, 1:58pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/9 "2019-08-30T13:58:29Z")
Thank you. Highly appreciated.
> I’m planning on getting a [secure4click](https://www.mikroe.com/secure-4-click) module for my [SOM1](https://www.digikey.com/product-detail/en/microchip-technology/ATSAMA5D27-SOM1-EK1/ATSAMA5D27-SOM1-EK1-ND/7898420) development kit.
I actually have the [secure4click](https://www.mikroe.com/secure-4-click) sitting on my desk, but never find the time to try it out.
---
### Author:  [@SuicidalLabRat](https://hub.mender.io/u/SuicidalLabRat)
#### Post date: [August 30, 2019, 5:36pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/10 "2019-08-30T17:36:59Z")
@drewwestrick Note,that cryptoauthlib recipe isnt building the pkcs11 branch, which didnt exist when Digi published that bb.
Also note, the gnutls build may need to have p11-kit enabled via PACKAGECONFIG to get p11tool built.
SLR-
---
### Author:  [@drewwestrick](https://hub.mender.io/u/drewwestrick)
#### Post date: [August 30, 2019, 6:34pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/11 "2019-08-30T18:34:37Z")
@SuicidalLabRat, Thanks for the heads up. I honestly haven’t really started any of this work yet. Much like @mirzak, I’m hoping to have some time to put toward this effort soon.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [July 30, 2020, 7:56am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/12 "2020-07-30T07:56:03Z")
Note there has been some progress on this recently in the Mender client. Check out the following:
>
---
### Author:  [@SuicidalLabRat](https://hub.mender.io/u/SuicidalLabRat)
#### Post date: [July 30, 2020, 7:52pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/13 "2020-07-30T19:52:13Z")
This is great news!
Thanks for the update.
SLR-
---
### Author:  [@drewwestrick](https://hub.mender.io/u/drewwestrick)
#### Post date: [September 21, 2020, 3:04pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/14 "2020-09-21T15:04:39Z")
Just saw that pkcs11 support made it into Mender 2.5. I’d like to say thanks to Torben Hohn and the mender team for getting this put in. This is a great feature add and has the potential to improve device security and provisioning a ton.
---
### Author:  [@SuicidalLabRat](https://hub.mender.io/u/SuicidalLabRat)
#### Post date: [September 21, 2020, 6:56pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/15 "2020-09-21T18:56:00Z")
Hear, hear! The OTA system is our most vulnerable vector for attack, and this addition will allow us to shore that up by moving related secrets to our onboard HSM.
This is a stand out feature for Mender, something I see as crossing a major delimiting point in their offering.
---
### Author:  [@kacf](https://hub.mender.io/u/kacf)
#### Post date: [September 23, 2020, 6:28am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/16 "2020-09-23T06:28:04Z")
Thanks for the kind words, I’m glad it’s appreciated! I believe @merlin and @oleorhagen deserve most of the praise for the actual work!
---
### Author:  [@SuicidalLabRat](https://hub.mender.io/u/SuicidalLabRat)
#### Post date: [September 23, 2020, 7:33am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/17 "2020-09-23T07:33:43Z")
Kudos to all involved!
---
### Author:  [@Terence](https://hub.mender.io/u/Terence)
#### Post date: [December 16, 2020, 10:56am UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/18 "2020-12-16T10:56:37Z")
Hi,
Thanks for all the great work you guys do !
Is there any plan to support HSM artifact signing with mender-artifact tool for standalone usages ?
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [December 16, 2020, 1:25pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/19 "2020-12-16T13:25:53Z")
> Is there any plan to support HSM artifact signing with mender-artifact tool for standalone usages ?
There is a ticket for it, [[MEN-3163] - Mender and CFEngine (by Northern.tech) Jira](https://tracker.mender.io/browse/MEN-3163) but not much movement on that one.
---
### Author:  [@oleorhagen](https://hub.mender.io/u/oleorhagen)
#### Post date: [November 27, 2023, 2:06pm UTC](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886/20 "2023-11-27T14:06:51Z")
Hello, everyone.
I am hijacking this thread, in order to ask a question about HSM and their use:
Now, that we are finishing the C++ client rewrite, I am implementing the HSM PKCS#11 support.
For now, this is limited to our `Kirkstone` branch, which has OpenSSLv3. As such, we are only supporting the new `Provider` API as such.
I have a couple of questions here:
How are you guys currently loading your providers. When implementing this now, I went for explicitly loading the provider from code:
>
As opposed to having the ssl config do it, like you are probably used to.
Please let me know if this is/will be an issue for anyone, and I will change it. But for now, this is the path I went down.
As far as I can tell, you can still override the provider with your config. But of course, I’m no expert here. As opposed to you guys 😸 🙏
@SuicidalLabRat @drewwestrick
[Next page](https://hub.mender.io/t/pkcs11-hsm-support-for-authentication-authorization-and-signature-verification/886.md?page=2)