mirror of
https://github.com/luxfi/hsm.git
synced 2026-10-30 16:22:43 +00:00
zeekay
8232dc56c4
Add KMIP 2.1 signer (build tag `kmip`) using gemalto/kmip-go for Sign/SignatureVerify/Activate/Revoke/Destroy over TLS 1.3 mTLS. Wire-format complete; live KMS integration tests deferred. Add TR-31/ANSI X9.143 banking key block (Version "D" — AES-256 KBPK Variant Binding Method) for PCI-PIN interop. NIST SP 800-108 KDF + SP 800-38B AES-CMAC + AES-CBC. Authenticator-bound header prevents relabeling attacks. Tests cover roundtrip, header tamper, key tamper, wrong-KBPK, and NIST CAVP AES-CMAC vectors §D.1. Add RequireFIPSProvider startup gate that rejects local / mldsa / nitrokey / zymbit / personal hardware wallets in FIPS-mandated deployments. Approves aws / gcp / azure / pkcs11 / kmip / yubihsm. Add STANDARDS.md compliance matrix tracking 50+ standards across API (PKCS#11 v2.40+v3.0, KMIP 2.1), auth (TLS 1.3 mTLS, FIDO2), crypto (NIST SP 800-90A/B/C/108/131A, FIPS 197/180-4/198-1/202/203/204/205/186-5), hardware certs (FIPS 140-2/3 + CC EAL4-7+), banking (TR-31, TR-34, ISO 9564, PCI-DSS, PCI-PIN), and crypto-currency (CCSS L1-3, NIST IR 8214A). Honest claims only — entries cite test fixtures or are flagged as in-flight or missing with a remediation plan.
54 lines
1.8 KiB
Go
54 lines
1.8 KiB
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
//go:build !kmip
|
|
|
|
package hsm
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
)
|
|
|
|
// KMIPSigner is the universal KMIP 2.1 signer. The default build (no
|
|
// `kmip` build tag) provides only this stub. Building with `-tags kmip`
|
|
// swaps in the real implementation backed by github.com/gemalto/kmip-go.
|
|
type KMIPSigner struct {
|
|
Config KMIPConfig
|
|
}
|
|
|
|
// NewKMIPSigner constructs a KMIPSigner. The stub returns it without
|
|
// contacting the server; Sign/Verify return errKMIPNotBuilt.
|
|
func NewKMIPSigner(cfg KMIPConfig) (*KMIPSigner, error) {
|
|
return &KMIPSigner{Config: cfg}, nil
|
|
}
|
|
|
|
// Provider returns "kmip".
|
|
func (s *KMIPSigner) Provider() string { return kmipProviderName }
|
|
|
|
// Sign returns errKMIPNotBuilt in the stub build.
|
|
func (s *KMIPSigner) Sign(_ context.Context, _ string, _ []byte) ([]byte, error) {
|
|
return nil, errKMIPNotBuilt
|
|
}
|
|
|
|
// Verify returns errKMIPNotBuilt in the stub build.
|
|
func (s *KMIPSigner) Verify(_ context.Context, _ string, _, _ []byte) (bool, error) {
|
|
return false, errKMIPNotBuilt
|
|
}
|
|
|
|
// Activate, Revoke, Destroy return errKMIPNotBuilt in the stub build.
|
|
func (s *KMIPSigner) Activate(_ context.Context, _ string) error { return errKMIPNotBuilt }
|
|
func (s *KMIPSigner) Revoke(_ context.Context, _ string) error { return errKMIPNotBuilt }
|
|
func (s *KMIPSigner) Destroy(_ context.Context, _ string) error { return errKMIPNotBuilt }
|
|
|
|
// Close is a no-op in the stub build.
|
|
func (s *KMIPSigner) Close() error { return nil }
|
|
|
|
// errKMIPNotBuilt is returned by every method on the stub KMIPSigner.
|
|
var errKMIPNotBuilt = errors.New(
|
|
"hsm/kmip: binary not built with -tags kmip; rebuild mpcd with " +
|
|
"`go build -tags kmip ./cmd/mpcd` to enable Thales CipherTrust / " +
|
|
"Utimaco / Entrust KeyControl / Fortanix DSM / Vault Enterprise " +
|
|
"KMIP 2.1 management",
|
|
)
|