Recently I’ve been working on a project that makes use of Thales HSM devices to encrypt/decrypt data. There’s a number of ways to talk to the HSM, but the most straight-forward from Linux is via PKCS#11. There were a number of attempts to wrap the PKCS#11 spec for Python, based on SWIG, cffi, etc., but they were all (a) low level, (b) not very Pythonic, (c) have terrible error handling, (d) broken, (e) inefficient for large files and (f) very difficult to fix.
Anyway, given that nearly all documentation on how to actually use PKCS#11 has to be discerned from C examples and thus I’d developed a pretty good working knowledge of the C API, and I’ve wanted to learn Cython for a while, I decided I’d write a new binding based on a high level wrapper I’d put into my app. It’s designed to be accessible, pick sane defaults for you, use generators where appropriate to reduce work, stream large files, be introspectable in your programming environment and be easy to read and extend.
https://github.com/danni/python-pkcs11
It’s currently a work in progress, but it’s now available on pip. You can get a session on a device, create a symmetric key, find objects, encrypt and decrypt data. The Cryptoki spec is quite large, so I’m focusing on the support that I need first, but it should be pretty straightforward for anyone who wanted to add something else they needed. I like to think I write reasonably clear, self-documenting code.
At the moment it’s only tested on SoftHSMv2 and the Thales nCipher Edge, which is what I have access to. If someone at Amazon wanted this to work flawlessly on CloudHSM, send me an account and I’ll do it 😛 Then I can look at releasing my Django integrations for fields, storage, signing, etc.
Héllo,
Thanks for this code.
Do you know the NitroKey hardware ?
They build and sell the best HSM USB hardware ;
-> https://shop.nitrokey.com/shop/product/nitrokey-hsm-7
-> https://github.com/Nitrokey
Best wishes,
Gandalf
Not specifically, although I know a whole bunch of similar devices exist. There’s also now PKCS#11 modules to use the TPM on some hardware. I’m pretty keen to see it all working, so PRs or devices would be great.
I take them in contact to come back to you.
Ask them for a sample to help your code and bugs fight.
It could great for all to enhance usage HSM availabily.
I have already NitroKey for testing but it’s badly far away in my TODO list, and have no availability soon.
Tell me if they can help you with giving a NitroKey HSM device.
Very nice! Thank you for that effort and please stay tuned!