RFC7512 URI support
dwmw2 opened this issue · 1 comments
Please support specifying tokens/keys using the standard RFC7512 URI format.
Well-behaved applications supporting e.g. client SSL certificates ought to automatically accept a PKCS#11 URI specifying the key and/or certificate to be used. All the user needs to do is give e.g. pkcs11:manufacturer=piv_II;id=%01 in place of a filename, and it should work.
It is not clear how an application author could achieve this using crypto11. I'd like to see a simple function which takes a URI (or pair of URIs for cert and key if they need separate identifiers), and returns the cert and Signer objects.
It should use the system p11-kit-proxy.so provider by default, and load the providers which are correctly configured in the system. Nothing but the URI should be needed in the normal case.
See https://www.infradead.org/openconnect/pkcs11.html for example user documentation for what I considered a "well-behaved application" where PKCS#11 "Just Works".
This code, in particular: https://github.com/ThalesIgnite/crypto11/blob/a81014c7c41025fb5533c0c6b1b14bec016be695/crypto11.go#L285-L298 would benefit from just taking a standard URI and being able to select the token based on it. I normally document using pkcs11:manufacturer=piv_II to select a PIV token on a Yubikey, but that doesn't seem to be supported here.