Comments (1)
Hi. Thank you for giving the YubiHSM2 a try.
-
Manual Configuration: If by that you mean through the command line, then yes. More on that bellow
-
Access Controls via Software Code: I'm not exactly sure what you mean by "via software code". The YubiHSM2 does not have a concept of users, however, access control can be achieved via a combination of domains and capabilities. Each object on the YubiHSM2 operates within the domains (a total of 16 possible domains) it was assigned to when created. Also, each object can only perform the operation it was given the capability to perform when the object was created. Further more, those parameters need to align with authentication key used to access the object.
For example, if the user is logged in with authentication key A, which operates on the domains 3 and 6, and if there exists an RSA key K that operates within the domains 6 and 7, then that user will be able to list the key K as an available key because both A and K operate within domain 6. However, if that user wants to sign data using key K and RSA-PKCS1v1.5, they will only be able to do so if both A and K were given the capability to sign using RSA-PKCS1v1.5 when they were created. If either A or K are missing that capability, that user will not be able to sign data with key K. Any object can be created with multiple domains and multiple capabilities.
There is a lot of documentation and many user guides available for the YubiHSM2 available on https://docs.yubico.com/hardware/yubihsm-2/hsm-2-user-guide/index.html
-
Recommended Tools and APIs: There are several tools available to interact with the YubiHSM2, including a command line tool called
yubihsm-shell
as well as a library calledlibyubihsm
(available in C, Python, Rust and JAVA) that can be used by developers to write software that interact directory with the YubiHSM. While these are the most comprehensive tools, there are other tools available for specific use cases. Easiest way to get all the available tools is to download the YubiHSM SDK from https://developers.yubico.com/YubiHSM2/Releases/ -
PKCS File Configuration and Software Code Integration: There is an implementation of PKCS11 available as part of the YubiHSM SDK (called
yubihsm_pkcs11
)
I hope these answers were helpful. As mentioned, a lot of documentation is available in https://docs.yubico.com/hardware/yubihsm-2/hsm-2-user-guide/index.html
from yubihsm-shell.
Related Issues (20)
- Unwrapping an exported wrapped key without device involvement HOT 4
- Remote problem HOT 1
- the last changelog entry references wrong version HOT 1
- RFE: is it possible to start making github releases?🤔
- Changelog typo HOT 1
- Unable to import an asymmetric wrapping key? HOT 6
- Cannot generate RSA-OAEP key pair? HOT 3
- Error running keytool on windows with YubiHSM HOT 11
- AES CTR Encryption HOT 3
- Failed to store symmetric key: Invalid command HOT 4
- yubihsm-shell ignores env var YUBIHSM_PKCS11_CONF HOT 2
- "debug" option in config file explodes the shell HOT 5
- Yubihsm ran out of session after a while when using with pkcs11 module HOT 10
- Malformed data error when signing SHA3-384 with yh_util_sign_pkcs1v1_5 HOT 1
- 2.4.2: test suite fails in 12% units HOT 7
- Docker container cannot connect to yubihsm connector running on host on Ubuntu 22.04.3 LTS HOT 1
- Support for SHA3-* HOT 1
- [P11 - ERR 21:10:53.246143] util_pkcs11.c:4593 (parse_rsa_generate_template): Boolean truth check failed for attribute 0x1 [P11 - ERR 21:10:53.246154] yubihsm_pkcs11.c:5248 (C_GenerateKeyPair): Unable to parse generation template HOT 5
- Can't build on Windows
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from yubihsm-shell.