feat: add support for Ed25519

Signed-off-by: Hubert Hardes <[email protected]>

Author: hhardes

src/module.cpp

@@ -51,6 +51,8 @@ static std::string mechanismToString(CK_MECHANISM_TYPE mechanism)
         return "CKM_ECDSA_SHA384";
     case CKM_ECDSA_SHA512:
         return "CKM_ECDSA_SHA512";
+    case CKM_EDDSA:
+        return "CKM_EDDSA";
     default:
         debug("Unknown mechanism type: %#lx", mechanism);
         return std::string("CKM_AS_VALUE_") + std::to_string(mechanism);
@@ -578,6 +580,9 @@ static CK_RV extractKeyAttributeValue(
         case EVP_PKEY_EC:
             key_type = CKK_ECDSA;
             break;
+        case EVP_PKEY_ED25519:
+            key_type = CKK_EC_EDWARDS;
+            break;
         default:
             return CKR_ATTRIBUTE_TYPE_INVALID;
         }
@@ -613,7 +618,7 @@ static CK_RV extractKeyAttributeValue(
         if (pkey == nullptr) {
             return CKR_FUNCTION_FAILED;
         }
-        if (EVP_PKEY_base_id(pkey.get()) != EVP_PKEY_EC) {
+        if (auto id = EVP_PKEY_base_id(pkey.get()); id != EVP_PKEY_EC && id != EVP_PKEY_ED25519) {
             return CKR_ATTRIBUTE_TYPE_INVALID;
         }
 
@@ -639,23 +644,31 @@ static CK_RV extractKeyAttributeValue(
         if (pkey == nullptr) {
             return CKR_FUNCTION_FAILED;
         }
-        if (EVP_PKEY_base_id(pkey.get()) != EVP_PKEY_EC) {
-            return CKR_ATTRIBUTE_TYPE_INVALID;
-        }
+        auto id = EVP_PKEY_base_id(pkey.get());
+        if (id == EVP_PKEY_EC) {
+            char group_name[256];
+            size_t group_name_len = sizeof(group_name);
+            if (!EVP_PKEY_get_utf8_string_param(
+                    pkey.get(), OSSL_PKEY_PARAM_GROUP_NAME, group_name, sizeof(group_name), &group_name_len)) {
+                return CKR_FUNCTION_FAILED;
+            }
 
-        char group_name[256];
-        size_t group_name_len = sizeof(group_name);
-        if (!EVP_PKEY_get_utf8_string_param(
-                pkey.get(), OSSL_PKEY_PARAM_GROUP_NAME, group_name, sizeof(group_name), &group_name_len)) {
-            return CKR_FUNCTION_FAILED;
-        }
+            auto group = std::shared_ptr<EC_GROUP>(EC_GROUP_new_by_curve_name(OBJ_txt2nid(group_name)), EC_GROUP_free);
+            if (!group) {
+                return CKR_FUNCTION_FAILED;
+            }
 
-        auto group = std::shared_ptr<EC_GROUP>(EC_GROUP_new_by_curve_name(OBJ_txt2nid(group_name)), EC_GROUP_free);
-        if (!group) {
-            return CKR_FUNCTION_FAILED;
-        }
+            return read_safe(i2d_ECPKParameters, group.get(), pValueDest, pValueDestLen);
+        } else if (id == EVP_PKEY_ED25519) {
+            auto ed25519_oid = std::shared_ptr<ASN1_OBJECT>(OBJ_nid2obj(EVP_PKEY_ED25519), ASN1_OBJECT_free);
+            if (!ed25519_oid) {
+                return CKR_FUNCTION_FAILED;
+            }
 
-        return read_safe(i2d_ECPKParameters, group.get(), pValueDest, pValueDestLen);
+            return read_safe(i2d_ASN1_OBJECT, ed25519_oid.get(), pValueDest, pValueDestLen);
+        } else {
+            return CKR_ATTRIBUTE_TYPE_INVALID;
+        }
     }
     default:
         return extractCommonAttributeValue(session, attr, pValueDest, pValueDestLen);

tests/common.sh

@@ -27,6 +27,12 @@ generate_keys() {
     export TEST_EC_KEY="$TEST_KEY_DIR/ec.key"
     export TEST_EC_CERT="$TEST_KEY_DIR/ec.pem"
 
+    echo "Generating ED25519 key and certificate..."
+    openssl genpkey -algorithm ED25519 -out "$TEST_KEY_DIR/ed25519.key"
+    openssl req -new -x509 -key "$TEST_KEY_DIR/ed25519.key" -out "$TEST_KEY_DIR/ed25519.pem" -days 3650 -subj "/CN=Test ED25519 Key"
+    export TEST_ED25519_KEY="$TEST_KEY_DIR/ed25519.key"
+    export TEST_ED25519_CERT="$TEST_KEY_DIR/ed25519.pem"
+
     echo "Generating RSA key and certificate..."
     openssl genpkey -algorithm RSA -out "$TEST_KEY_DIR/rsa.key" -pkeyopt rsa_keygen_bits:2048
     openssl req -new -x509 -key "$TEST_KEY_DIR/rsa.key" -out "$TEST_KEY_DIR/rsa.pem" -days 3650 -subj "/CN=Test RSA Key"

tests/test_pkcs11-tool_export_ed25519_public_key.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: (C) 2025 Siemens
+#
+# Authors:
+#  Hubert Hardes <[email protected]>
+#
+#
+
+set -e
+
+source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
+
+TOKEN_LABEL="pkcs11-to-cmd-0"
+PUBLIC_KEY_FILE="$TEST_WORK_DIR/$SCRIPT_NAME-public_key"
+
+export P2C_SLOT_CERT_0="$TEST_KEY_DIR/ed25519.pem"
+
+# Export public key from our PKCS#11 provider (if implemented)
+pkcs11-tool --module "$PKCS11_MODULE" -r --type pubkey --slot 0 --label "$TOKEN_LABEL" -o "$PUBLIC_KEY_FILE.pem"
+
+openssl x509 -in "$P2C_SLOT_CERT_0" -pubkey -noout > "$PUBLIC_KEY_FILE.original.pem"
+
+diff "$PUBLIC_KEY_FILE.original.pem" "$PUBLIC_KEY_FILE.pem"