topic Re: Removal of PKCS#11 functionality in CST tool in i.MX Processors

Removal of PKCS#11 functionality in CST tool

pfaust60 — Mon, 14 Mar 2022 16:58:11 GMT

I just downloaded the latest CST tool 3.3.1 and found this in the documentation.

The /back_end-hsm directory contains the sources and headers necessary for replacing the open source cryptographic libraries with an implementation that can interact directly with a Hardware Security Module (HSM) by using the PKCS#11 interface definition. More detailed information can be found in the README file located in the directory.
Note: This add-on is deprecated and will be removed in the next CST release.

What will this be replaced with? Having private keys on the build machine is not a very safe practice.

Re: Removal of PKCS#11 functionality in CST tool

Zhiming_Liu — Tue, 22 Mar 2022 02:40:03 GMT

Hi @pfaust60

We will release a safer way to enable HSM in next version.

Regards

Zhiming

Re: Removal of PKCS#11 functionality in CST tool

pfaust60 — Tue, 22 Mar 2022 13:47:20 GMT

Thanks for the update. When should we expect a new release and be able to evaluate the new mechanism for integrating with an HSM.

I assume the new solution will still use the industry standard pkcs#11 interface?

Paul Faust

Re: Removal of PKCS#11 functionality in CST tool

Hendrik_M — Wed, 16 Nov 2022 12:13:42 GMT

Is there an update on the status of the new HSM implementation? This is also a pressing matter on my team.