OpenSSL 3 drops engines for providers. Wire a PKCS11 module through p11-kit so EVP ops hit the token via C_Sign/C_Decrypt. Config walkthrough for Ubuntu, Debian, RHEL.
https://www.valtersit.com/vault/configure-openssl-3-provider-to-load-a-pkcs11-module-via-p11-7dd1db/
#openssl3 #pkcs11 #ValtersIT

PKCS11 key wrap/restore with C_WrapKey and C_UnwrapKey: encrypted blob only the peer token can decrypt. pkcs11-tool --wrap/--unwrap, CKM_AES_KEY_WRAP or CKM_RSA_PKCS_OAEP.

https://www.valtersit.com/vault/back-up-hsm-keys-to-a-wrapped-blob-and-restore-on-a-peer-tok-5f5740/

#pkcs11 #wrap #ValtersIT

PKCS11 CKR errors: enable verbose tracing via PKCS11SPY. Point pkcs11-tool at libpkcs11-spy.so, set PKCS11SPY to the real module, log every C_* call + CKR code.

https://www.valtersit.com/vault/enable-pkcs11-debug-logging-to-diagnose-ckr-error-codes-034c8a/

#pkcs11 #opensc #debugging

pkcs11-tool walks PKCS11 slots, tokens, and objects via C_GetSlotList/C_GetTokenInfo. Enumerate class, label, ID, flags on Ubuntu, Debian, RHEL. https://www.valtersit.com/vault/enumerate-all-pkcs11-slots-tokens-and-objects-with-pkcs11too-b5f4cc/ #pkcs11 #opensc #hsm

pkcs11-tool --keypairgen creates RSA-4096 keys inside the token via C_GenerateKeyPair. Private exponent never crosses the HSM boundary, non-extractable by default. https://www.valtersit.com/vault/generate-an-rsa4096-keypair-directly-on-a-pkcs11-token-e2fc06/ #pkcs11 #rsa #ValtersIT

To explain #pkcs11, I first need to explain #pkcs10.
To explain #pkcs10, I first need to explain #pkcs9.
To explain #pkcs9, I first need to explain #pkcs8.
...

Nikola Ubavić in "Cryptography with Serbian eID Cards" at #balccon2k26 #balccon
cfp.balccon.org/balccon2k26-...