We have put significant resource into narrowing the attack surface of our device fleets, including the implementation of HSM type security/crypto modules to manage device secrets and PKI duties. The mender client is the sole component of our stack unable to leverage these security resources, where,…

Also @drewwestrick , which hardware are you using? Is it the same from Microchip mentioned above? I have little experience working with HMS, and would be happy if you can share any information how you are using these hardware modules, what software stack to access them and how you incorporate them i…

Yes, @mirzak , we are planning on using the ATECC608A as well. To use the device, we will need to integrate the device driver, cryptoauthlib , which makes use of PKCS11 as an interface. It will also make sense to install gnutls on the debug device to test things out. Below are a few relevant yocto lay…

Thank you. Highly appreciated. I’m planning on getting a secure4click module for my SOM1 development kit. I actually have the secure4click sitting on my desk, but never find the time to try it out.

@drewwestrick Note,that cryptoauthlib recipe isnt building the pkcs11 branch, which didnt exist when Digi published that bb. Also note, the gnutls build may need to have p11-kit enabled via PACKAGECONFIG to get p11tool built. SLR-

@SuicidalLabRat , Thanks for the heads up. I honestly haven’t really started any of this work yet. Much like @mirzak , I’m hoping to have some time to put toward this effort soon.

Note there has been some progress on this recently in the Mender client. Check out the following: keystore: use openssl bindings mendersoftware:master ← Linutronix:devel/torbenh opened 11:13AM - 07 May 20 UTC (UTC) …

This is great news! Thanks for the update. SLR-

Just saw that pkcs11 support made it into Mender 2.5. I’d like to say thanks to Torben Hohn and the mender team for getting this put in. This is a great feature add and has the potential to improve device security and provisioning a ton.

Hear, hear! The OTA system is our most vulnerable vector for attack, and this addition will allow us to shore that up by moving related secrets to our onboard HSM. This is a stand out feature for Mender, something I see as crossing a major delimiting point in their offering.

Thanks for the kind words, I’m glad it’s appreciated! I believe @merlin and @oleorhagen deserve most of the praise for the actual work!

PKCS11/HSM Support for authentication/authorization and signature verification

General Discussions

TheYoctoJester November 28, 2023, 10:48am 21

@oleorhagen also note PKCS11 not working on mender client with TPM - #4 by sandevins

Topic		Replies	Views
How to write a custom client interfacing a Mender server Mender	3	6510	April 23, 2024
Mender 4 with OpenSSL 3 TPM2 provider General Discussions	0	106	February 8, 2025
PKCS11 with OpenSSL 3.0 General Discussions	4	1142	July 22, 2024
Mutual TLS with mender General Discussions yocto , zeus	43	1769	May 5, 2021
Microchip ATECC608B / cryptoauthlib support in scarthgap General Discussions yocto , mender-client , pkcs11 , openssl	2	235	January 21, 2025

PKCS11/HSM Support for authentication/authorization and signature verification

Related topics