(!) This project is at an experimental stage and is very much a work-in-progress. It should not be used in production deployments at this time. Furthermore the functionality and interfaces offered should be considered unstable.
cascade-hsm-bridge is a Rust application that accepts KMIP
requests, converts them to PKCS#11
format and executes them against a loaded PKCS#11 library. It was created for
use with the Cascade project.
Documentation is available as part of the Cascade project here.
See "Building From Source" in the documentation.
The use case for which this application is primarily being developed is to enable Cascade to make use of a Hardware Security Module (HSM) via a PKCS#11 interface without having to load an untrusted 3rd party PKCS#11 library into its process.
This is particularly important for a Rust application as the PKCS#11 interface exposes the application to code that is likely not protected by the guarantees provided by the Rust compiler, as the PKCS#11 is a foreign function interface beyond which the Rust compiler cannot see.
If the PKCS#11 library experiences a fatal error that may not be reason to exit the parent application, whether or not that is appropriate is highly dependent on the purpose of that application. Any STDOUT and STDERR output produced by the PKCS#11 library may also become mixed with output from the application itself which can be confusing.
This project could potentially act as the basis for a general purpose KMIP to PKCS#11 bridge. However, at present and for the foreseeable future we plan only to implement the tiny fraction of the KMIP specification needed by the Cascade project, and the only KMIP client that will be tested against will be Cascade.
This application is possible thanks to the following foundational Rust crates on which it builds: