Azure-iot-sdk-c: DPS - custom HSM library interrface with a crypto chip

[syedelec]

• OS and version used:
  Ubuntu
• SDK version used:
  2018-04-02

Description of the issue:

I have a crypto chip that can generates, stores keys/certificates/data and performs cryptographic operations. The most important thing is that I generate the device certificate/private key using the HSM and that the private key never leaves the hardware.
From what I have tested, the custom_hsm_lib needs to return the private key as plain text in order to work. It is ok for development purposes but not for production.

Having a look at this issue : https://github.com/Azure/azure-iot-sdk-c/issues/442
It has been suggested to write a tlsio layer that understands how to interprete the key that is returned.

Could you provide an example to get started with writing a tlsio_layer that can interprete the key differently that plain text ?

Code sample exhibiting the issue:

N/A

Console log of the issue:

N/A

[lakshmisivareddy]

Hi @syedelec in SDK
azure-iot-sdk-c/provisioning_client/adapters two files
hsm_client_riot.h
hsm_client_riot.c
check these two files

[jebrando]

@syedelec If you look at one of our x509 files it will give you a good starting point (https://github.com/Azure/azure-c-shared-utility/blob/master/adapters/x509_openssl.c). I the x509 private key is passed unmodified from the DPS object to this object and you can do the processing in here. I can see I need to have an example of this somewhere, and I will get this on my backlog.

[syedelec]

@lakshmisivareddy in this example (hsm_client_riot), the private key is in plain text : https://github.com/Azure/azure-iot-sdk-c/blob/master/provisioning_client/adapters/hsm_client_riot.c#L617
I don't understand how this example can help in my situation. The crypto chip should never provide the private key in plain text so I cannot return it to provisioning client.

@jebrando, from what I have understood, I need to modify https://github.com/Azure/azure-c-shared-utility/blob/master/adapters/tlsio_openssl.c and https://github.com/Azure/azure-c-shared-utility/blob/master/adapters/x509_openssl.c to perform verification operations using the crypto chip API instead of openssl verification API ?

[lakshmisivareddy]

Hi @syedelec
in my case i write a custom wrapper to convert public key and private key to char*

[massand]

@syedelec - We are working on improving the documentation for your porting experience in this scenario. What specific documentation would you like to make this easier?

[syedelec]

@massand I have multiple documentation requests that should help:

• how to use a custom hardware to keep private key stored and only use the id/slot in the azure sdk
• how to write a tlsio layer that understands how to interprete the key that is returned from the the call of custom_hsm_get_alias_key

[jyrkiclaned]

@massand Any progress with documentation?

[yzhong94]

@jyrkiclaned @syedelec We have not started on the task yet, but we have taken the feedback you have and plan on addressing the porting process in the next few sprints.

[jebrando]

@jyrkiclaned We have added more documentation for provisioning. We plan on expanding this as new questions come up. Let us know what you think.

[az-iot-builder-01]

@lakshmisivareddy, @jebrando, @syedelec, @massand, @jyrkiclaned, thank you for your contribution to our open-sourced project! Please help us improve by filling out this 2-minute customer satisfaction survey

[LaptevPasha]

Hi @syedelec
I'm working on DPS and HSM integration too.
Could you please explain how azure sdk signs a challenge which receives from Azure DPS ?
I mean where it happens in the code.

[rakeshzalavadiya]

Hi
Do we have any resolution on this issue ? We are facing the same issue described in this forum. We have integrated the Azure C SDK in our platform. We are using the ATECC608a crypto chip from microchip. This chip never allows to read the private key out of chip. What needs to be done to ensure that all cryptography request goes to the chip instead of sharing the private key to Azure C sdk ?