Use signing key on HSM to sign assertions

[Cantor, Scott]

s/PKCS12/PKCS11.

-- Scott

> -----Original Message-----
> From: Cantor, Scott
> Sent: Monday, May 7, 2018 9:37 AM
> To: Shib Users <users at shibboleth.net>
> Subject: RE: Use signing key on HSM to sign assertions
> 
> > Basically I would like to customized the code/bean which does the
> > assertion signing. This bean I would then customize to perform this
> > signing using the private key on a HSM.
> 
> It doesn't work that way. That's much high layer stuff. Using an HSM is
> something generally done at the layer of the JCE and generally through PKCS-
> 12. There would have to be code added to abstract the credential objects
> through a provider that also implements the RSA algorithm through the
> hardware. It isn't something anybody has done to my knowledge, and
> certainly not something anybody has ever documented, for the IdP itself.
> 
> I believe xmlsectool has some tested support for using PKCS12 keystores for
> signing, and that's more or less what would have to be done for the IdP, a JCE
> configured and then Java classes written to supply the credential interfaces
> the IdP relies on from such a keystore. We don't even formally have keystore
> support at all right now based on a review I did of the code recently.
> 
> It may be that the actual amount of new code needed is very small, but the
> path to getting to that code is not, if I were to guess. And configuring that
> stuff tends to be incredibly hard, and is inherently specific to each HSM, so
> impossible to effectively cover in any documentation, it's a ton of trial and
> error.
> 
> > The question is what configuration changes are required to only
> > replace the functionality which does the assertion signing? Which
> > bean/beans need to be customized ?
> 
> It is not that simple, not by a long shot. It's an enhancement request at best.
> 
> -- Scott