pkcs11-gateway is a software that allows you to use a Linux PKCS#11 module
on FreeBSD i386/amd64.
It consists of a FreeBSD Cryptoki wrapper library that serializes and forwards
PKCS#11 function calls to a Linux server program that dlopen() and use the
real module. The communication between the two components is via a UNIX socket.
pkcs11-gateway is based on the rpc-layer of Gnome Keyring.


USAGE:

On the server side you have to specify the PKCS#11 module and the socket path
on the command-line, like:

# pkcs11-gateway32 /my/path/libmycryptoki.so /tmp/mypkcs11.socket

You may use /usr/sbin/daemon to put it in background.
If you have a 64-bit PKCS#11 library use pkcs11-gateway64 instead.


On the client side you may specify the socket path in two ways:

1) setting "socket='/tmp/mypkcs11.socket'" in C_Initialize as
   CK_C_INITIALIZE_ARGS->pReserved parameter

2) setting the PKCS11_GATEWAY_SOCKET environment variable


NOTES:

Not common mechanisms with complex parameters are not supported,
they are automatically filtered out from mechanisms list.

Parameters with CKF_ARRAY_ATTRIBUTE bit set are not supported,
but no error is given, strange things will probably occur.

Contributions to fix these issues are welcome.


HARDWARE:

The following HSMs have been tested successfully:

- SafeNet LunaSA
- nCipher netHSM


LICENSE:

GNU Library General Public License 2 (as Gnome Keyring)


AUTHOR:

Alex Dupre <ale@FreeBSD.org>
