[PATCH] scripts: bareboxtlv-generator: add PKCS#11 engine support

[PATCH] scripts: bareboxtlv-generator: add PKCS#11 engine support

[Sascha Hauer]

From: Sascha Hauer <sascha@saschahauer.de>

When a PKCS#11 URI (pkcs11:...) is passed as the signing key, the
openssl pkey and pkeyutl invocations need extra engine arguments to
route key operations through the pkcs11 engine. Detect pkcs11: URIs
and add -engine pkcs11 with the appropriate key format flag (-inform
for pkey, -keyform for pkeyutl).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 .../bareboxtlv-generator/bareboxtlv-generator.py    | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/scripts/bareboxtlv-generator/bareboxtlv-generator.py b/scripts/bareboxtlv-generator/bareboxtlv-generator.py
index 2eba0aeb23..5b51fb53d8 100755
--- a/scripts/bareboxtlv-generator/bareboxtlv-generator.py
+++ b/scripts/bareboxtlv-generator/bareboxtlv-generator.py
@@ -65,7 +65,14 @@ class PrivateKey:
             sys.exit(127)
 
         self.inkey = path
-        self.public_key = serialization.load_pem_public_key(openssl(["pkey", "-pubout", "-in", self.inkey]));
+        self.is_pkcs11 = path.startswith("pkcs11:")
+        if self.is_pkcs11:
+            pkey_args = ["-engine", "pkcs11", "-inform", "engine"]
+            self.pkeyutl_args = ["-engine", "pkcs11", "-keyform", "engine"]
+        else:
+            pkey_args = []
+            self.pkeyutl_args = []
+        self.public_key = serialization.load_pem_public_key(openssl(["pkey"] + pkey_args + ["-pubout", "-in", self.inkey]));
 
     def sign(self, message: bytes) -> bytes:
         """
@@ -75,8 +82,8 @@ class PrivateKey:
         from cryptography.hazmat.primitives.asymmetric import rsa, ec
         from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
 
-        # Access private keys only via the openssl cli so that any configured provider, such as pkcs11, can be used.
-        sig = openssl(["pkeyutl", "-sign", "-rawin", "-digest", "sha256", "-inkey", self.inkey], stdin = message)
+        # Access private keys only via the openssl cli so that any configured engine/provider, such as pkcs11, can be used.
+        sig = openssl(["pkeyutl"] + self.pkeyutl_args + ["-sign", "-rawin", "-digest", "sha256", "-inkey", self.inkey], stdin = message)
 
         if isinstance(self.public_key, rsa.RSAPublicKey):
             return sig
-- 
2.47.3

Re: [PATCH] scripts: bareboxtlv-generator: add PKCS#11 engine support

[Jan Lübbe]

On Thu, 2026-03-05 at 07:57 +0100, Sascha Hauer wrote:
> From: Sascha Hauer <sascha@saschahauer.de>
> 
> When a PKCS#11 URI (pkcs11:...) is passed as the signing key, the
> openssl pkey and pkeyutl invocations need extra engine arguments to
> route key operations through the pkcs11 engine. Detect pkcs11: URIs
> and add -engine pkcs11 with the appropriate key format flag (-inform
> for pkey, -keyform for pkeyutl).
> 
> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  .../bareboxtlv-generator/bareboxtlv-generator.py    | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/scripts/bareboxtlv-generator/bareboxtlv-generator.py b/scripts/bareboxtlv-generator/bareboxtlv-generator.py
> index 2eba0aeb23..5b51fb53d8 100755
> --- a/scripts/bareboxtlv-generator/bareboxtlv-generator.py
> +++ b/scripts/bareboxtlv-generator/bareboxtlv-generator.py
> @@ -65,7 +65,14 @@ class PrivateKey:
>              sys.exit(127)
>  
>          self.inkey = path
> -        self.public_key = serialization.load_pem_public_key(openssl(["pkey", "-pubout", "-in", self.inkey]));
> +        self.is_pkcs11 = path.startswith("pkcs11:")
> +        if self.is_pkcs11:
> +            pkey_args = ["-engine", "pkcs11", "-inform", "engine"]
> +            self.pkeyutl_args = ["-engine", "pkcs11", "-keyform", "engine"]

This would break use of the PKCS#11 provider, which automatically handles
pkcs11: URIs when enabled via openssl.cnf. I'd suggest adding a --engine CLI
option to explicitly enable engine support.

Jan

> +        else:
> +            pkey_args = []
> +            self.pkeyutl_args = []
> +        self.public_key = serialization.load_pem_public_key(openssl(["pkey"] + pkey_args + ["-pubout", "-in", self.inkey]));
>  
>      def sign(self, message: bytes) -> bytes:
>          """
> @@ -75,8 +82,8 @@ class PrivateKey:
>          from cryptography.hazmat.primitives.asymmetric import rsa, ec
>          from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
>  
> -        # Access private keys only via the openssl cli so that any configured provider, such as pkcs11, can be used.
> -        sig = openssl(["pkeyutl", "-sign", "-rawin", "-digest", "sha256", "-inkey", self.inkey], stdin = message)
> +        # Access private keys only via the openssl cli so that any configured engine/provider, such as pkcs11, can be used.
> +        sig = openssl(["pkeyutl"] + self.pkeyutl_args + ["-sign", "-rawin", "-digest", "sha256", "-inkey", self.inkey], stdin = message)
>  
>          if isinstance(self.public_key, rsa.RSAPublicKey):
>              return sig

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |