ATECC608 (HSM) integration using PKCS11 with OpenSSL in AWS IOT device SDK

[lmajewski]

This is simple request to provide support for HSM devices (i.e. ATECC608) to be used with openssl_posix.c.

There was a similar issue already closed - #1772

Moreover, there are some "experimental" patches - https://github.com/paulbartell/aws-iot-device-sdk-embedded-C/commits/paulbartell/openssl_libp11_support which add such support.

Unfortunately, those were not upstream and only support openssl ENGINES (i.e. ver 1.0.x) but not PROVIDERS (as in 3.x).

[mrjoelkamp]

I ran into this same issue and ended up creating a openssl_pkcs11.c derived from openssl_posix.c that uses PKCS11 for the openssl credentials.

With some additional work, it could be merged into openssl_posix.c to have a common openssl module that supports PKCS11.

If I recall correctly, it was just a matter of extending the OpensslCredentials_t struct to include PKCS11 parameters and some logic to set the credentials. Unfortunately, my changes also use the deprecated openssl ENGINE config. I attempted the PROVIDERS approach but ran into issues with my target/OS to get it working properly.